~�ղ�Ue�'2!���{U�wY�Ty����tO?K���9��K�� ym4#;�*8��j���Gop<�����"��H���#��_���#���B�&��6*)�WE�� Ӣ}@��ƺ1�"���J�nĐ���=���v'� ����X�ŸK���)n�f���R<$�Pp4d��Um���y���w�WRN`���1+�y^rN䧁��f<ژ&��l��a�������\C��s )�ġ[އ�bUZ֨e�ls�b��^����vrf�t�@䶏 p������&J���1Y�3��X3I�EF�F��<4����:Á듕H�����+X��JU%�<O9�S��Z,w�mF�b��3N�g�Q�i�������?�_��qK{�'�����J�Ǡd�+����:=��qB�Ü���:��H�:�����Ѝ9����泎�ʿ��uo�6��Zn�G�;�����g|e�=�����46U C��u�V��%nvo(��`�/���YUp���������$0�+&�h-X�q�k�^m�{��*��?���~f[95k4��'ܥ_�e kG��vx�����V=�L+%54j6P{mP�'~k_X�ֆ��w|�g���4�Ȳ�i1��Pg�0>�3��#bU\"mw� o���o2�w����>9q������Ѐ�`V�0+�$��W*S� �����&���SG�ʢ뮠���6#��S���b�>Z�D���8%�Ǔ�=;e�mw ������D��_Arh*��n&c��C2�V�&��M Ġ;PP8{kq��,o��jY��@��G%>\Ɖ��D��t�;Cǔ�I�f���R���������j �AHP�+b���*_�����;-��^cZ:��W�����T�y �}.?��_"d�^���b�]�����b ����dv�,���K��u5�Us�b�;�] /�3 Ӏ��jn�Cl�1��"W����kYU���z�sDm�$@�J��~�_^B���~��{d�U�k���.iM�����К�>��f���r_��M�X�_F���/̳�.|��cc]E;c j"I�=���F��3%w�:.��r$VA>'!,�t�S����M�%(��U�K�7�0�w�����v��[�����#<>=a��.���~�`N�o5��N�}v,�D�O���'̂��T I�謔�@���"ǘR拇�j��f\���\��HDŸ;�����X��]�s�c$8�"1�Yԍ)muSz��� ��(;�����2(��=a '��iCI�D�����s���_� 5]pE<z���gӪ'5���9wD�0�gtj����(�n��-���sWA�#!�u�%��ff��{�����2������s�V�����@��$b�n���9 �;b�T��i�z���.���-pe��,�S \���mߋ1�~.w��6� uC��;8g���L�$���Y�����5��X����w(��Ef�<+���w�����Hʸ�r9Y�hE�3��$�������U�t�(X����ng�r�0jg<�}Ϩw�d�����#�@�f��[%� ʞ�~2A?`݄d��2m�� "|�]���9���~F)5\d:�W��}�;�-����o���B"�z�Ϋ�X�4;(��f��:�"r7��\����� �K"�jZ�K~Vu�.mJvȚl��n���el1y���Op��f@@B�,�ސ�}�vt0 �3��.�dM\��#�7�"/|�7���@mD��*���6,+�H�����(���1�[� �&r�П��Q����]����$�I��K�<�b<{ԥڗm֬bΊ�}��q~s��*��;��-�镛�EB���Z�ʕ#��^mI�5Y��wj� c�pI|�I�cWGT�:�����\�mt�8����"y�h�R��Q���fy�E�1dy��+75ڪ��h���Շ�*��h^�a�������PP/�&ܝJ[}$���4+����a�PPa\�I!��r�cF�>�c�w$������(�$��eG���Y�4%���K���"��_Ƅg��k#�'QJ?Q�3S�y䏕QF������E�N �EO_�+�qO(ZD��7�:���2,m�G$}c��������P+��ՒO���Ľ}�6t�q�ʷo�Y�^�.����!�պ����h%�K�?Y��,lkk4�;\%(\r������%mvQ���R�dF�)�t��f��Xf0A��$�b�F��r�c4��������M��a7rl�"gھV��ma����۬�唛���3T�����x�1Z5��,�:߃��XQ�v�e��ōuٛ:��CM��.r/�1j�Zk��o霈��bFN�$��2�f6Ő�95�<e�k�~�@��:������1�B�c;e5��<�%�eb�xv8�Q�u�!CA8ͯ��|��xe�#�����Ej�|��#�d�����ێv1�p����ӄ����Xc{5W�/�ű]�{ �cL��[=�5$E��R8�\�����"�8�Jg@֪B�Ub��3-�k��Ӽ��,;Z]��k����S�5+��Y��;� �@;��rMi���[�$�����t,B Z��}�;}����x�.V�ձq0�h$���q&)vf��������ê]̆�����EV�G�l��0�T�;t1�P�j��P���J ��_~�Ċ��,z��ƞls�֗�����~I�\��4sbg ����,�@��e�K�[1�m'R4����6��%W"��yz��y� �x����Fx%ө�g➟8�KV>s(��;.��5�I�2�Nh��ܕً�QE��[<��~[4���a;j��ѿ#tm|�*t/����up� NYr0��sn�#I�U�K �'�)&p z2��� h}�o���d�^�(T���JB�.�!��d2��!00N��ͻ�_an��薛g����E�qn�=�\|���+�]q@�3F�o��߰�D�x l�1� _��v*'�{y��61�8M��,�A LC2:��')�H�!Ԋ�%���,J��) jޤ ��)�č��|�l9�<�B/�؏�� R���[��'���
Behavioral task
behavioral1
Sample
52a27224afecdd4c2a614c9758157a60_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
52a27224afecdd4c2a614c9758157a60_JaffaCakes118
-
Size
405KB
-
MD5
52a27224afecdd4c2a614c9758157a60
-
SHA1
3385ce2b2a38a0a6333d8bee640aeded8605a759
-
SHA256
cb5f09e2ee35914c1c37aea5ca1c0963be13e65f80e9dbdf2f72e65345bdcc5c
-
SHA512
a0d0a006bace63fc8dd81b4a222c8382d0b45a6715136baef92b97093fc00c83d2e41f7cae1c9a66f6adbc2e6ce64bb342729e5ba76596f66b232575c2e20b61
-
SSDEEP
12288:gV1XLs8lqkFhp268m7TN9hYSd2Dmo2QVlOpEHblXgz:gV68LFh5uDmt8UUlX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52a27224afecdd4c2a614c9758157a60_JaffaCakes118
Files
-
52a27224afecdd4c2a614c9758157a60_JaffaCakes118.dll windows:4 windows x86 arch:x86
e6b1998d4dddad3f34d30e0e1958df7b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
VirtualFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowWindow
advapi32
RegQueryValueExA
oleaut32
VariantInit
Exports
Exports
Sections
CODE Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 22KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 402KB - Virtual size: 401KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ