w�|u�}~�g~�9� �4�F�_��������h��PP� ��-֭=�$n����6��mr:)Xv�@�wVvϔ���9��$��y�n�k�yX"�1�v�Ү��/+���}Rk�x�i�B�1`y)�^�����(�|&���-:���G�W��s����a���ܹ�I�Ɔ����9t0�X=<�L��'��{Y�x���[o�D���O�j.^1�w�U9�y,�P�"e ]4�B��W����^�I |0$�"I=�f>fSLX��.��!���"�0Z������zˤZ��-B�V �`z^�>�n���Id8��߆�F:U���mU�H�MqG�ʀԐ��w����Pz���#";+�uF�5!qsF�����\�qmǜ\�B�=-_��{12S"�����g$mo�����R�Sf&?��*؍gb�ı��J�/����O�t�4a�� ���H��٢��ѧ�¾�;9���p0"$P:*����&� �{*e{P)�AJ��`j���צ���w\ �Z�"i���j� H8��]n�.&���&S,*��r��_�t�!� k�n�u�+a��#y~�|�m��ז����i�Ny�?�J�ۜb�Dg�9���V�����,۰����aN<����M˨��\��,+�韻��k��W����-� g<sW�f_��|E������Q���e�?��Q�n�� ��L}��b�ʘz���օ�3c�g�_s���(}��z��^3���H�ڂE!��4혆BD����2+�!~�]K=�A��ɱ[���+(M'#w�KD�\��"�c��؛$���dv �`ȳò$�V&ʈd9A�3Q2��ŷ���H�:i5iz��I�EV�Y�)�x{$*aS_� d=���5��R�/Q��#A��'bN����Z�'�B��e�.+i#є$��40n<hȉ�Q����ߜA@g�5�g-�OF_hpf?Ɉ���"��X�v� ̅�h��Z1џ�#H�+vb��y* �srzc���X��䴖ΐ����g�j�ϚF5�s-h2���#`Y��~μؚ�� �a�k��1q���N�]�H�>n����������\X�cn[���Jh��/����)�&��@�??q�^��ćB����T�F��a.�-G�s.fB����Iqq�Ï+�*��wV�&��}�h]O�Ӕ�q����\ ��cց"���2�-<>��D�(����� 4� ZM�X���R��?k�!v2G�$��s���}K�x}V=5*����F�������Ch�)w�i����U�� ���t�H���g�x�9��{�}�'�}y9������Ɍ|�<�_��!����X�X���ʠn�vqE1��T� axxK��fAE,���)��Ob�1:b���UL!&�w�|�/>�p�rNx��v�"g�A����~8fߘH�5��@n-���7*��N�?�>iAf���'��~U\�s��,���w�A֧ <#�6a���4�4�|N��bn~vY�kAACj�Ws��w;���~M�A�v>`e_�� ��Ax Sxz6��kJu5a�ж��/������kvDž�z��FN*����{I'T�� qG#�i�4�$�'��;!�A;1������"^�������bbd��#W�і|�z��A�n8O�#��Hȱ�)�gz��&��(*?~H��Z���zJ�����0Q.�V,/��O=���z�**�"�0*�S��-���,pUH�'�ON��Fa�����n������]��+��f�jӶ(�Gϥ�j����0$�w�������5�6���8[�K�w���T������ȵ�� �F�}P��Q EzDr�fz4����S/��\ �����7�~43�:�����Q��^��F�킳{��ᇹ�Z ��`#:����Wo+�L�=�j�F�$c��z��R1��Q�*�T����I����p#��)��C�aӛ�� R���,���u�=ɤ��l�}�F ��U+��8����u����X$UN��K�����[�-0s�j�W��"�� L��+Z��"B���ɦ�Q�01��tP+A�F>;�E�����uU~ַ�3��!�iq]�*>SCt��n�����)����F��\N���)�0/�:��bG�4ۆ��N������j��twy�3�4��T1�/r�����P�/��A*f)�����������??{�W��I���s�`*4�@-*���g��nO �N>��V�V�6�r!��6/�aɽh�������S 6<��u�[M��D��?�v���*=�!3�!S5.xU���2�p)������)^0��9��j�hϐ�#B�Y{X�r)�Pm� �u�H��M��|<��N�ܓɐM�[��V1������]���_������he|i�W��/"���A=$z��mq��'�&�F��� �p@j��~����Լ� W�P��w0���`��ۇ����ԪYu��6��(�Xď���C�3m�\�I��EOM�0����a���KzpU%ֳ��d5��~�J�����1u�I��XL�y#���q���D��e&�U3� �y�ٶ�pʌ�����\Ğ�h�Ck�����s�='M�7%l�fy�@9�+a�oc���f6S��E�'<�f�8��!6 o��+��)J;zr��x|:����.�v߱�,�x����n�P�C�i �C�!�Dt�;��5�F�U釧���!����oY�����c�_��[���c��]n!��v�����1�u�A�ݯ�ƍ,���w�p,���Κ������RՔQ� ����@�e�\2H;�ת~�����l�[�2�ΛQ��׀����2������Ǻ�t��cM�G�P���' �-m6�4�f91��d)x;����TU(�Q�������gY-~ܖ�e0B�%�D��:��0�Sd�=Q�O�a��˅+Zi5��b� �����$]��FL��ɱF��ĕ�^�e_d�ۖ�E%�1.��#�O�34M`�cՃs��^hHB�N,F>��H�����M��&�U#�g�8QRtԷ��I�84w|F�2�Pk��JX����������K���
Behavioral task
behavioral1
Sample
52de941257c71243f41c574686373d3f_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
52de941257c71243f41c574686373d3f_JaffaCakes118
-
Size
120KB
-
MD5
52de941257c71243f41c574686373d3f
-
SHA1
ec6a9ea812ed2bc438d2af10accd91c77748fcaf
-
SHA256
6f5526352ef9771d2eebfa50b08e82ea794e07b3481f24782f663d9b3083d324
-
SHA512
985ebd6aab21a3217c448865cc389ddeb454888bb2ea7972731815a8e9d22a684f5880f9f1acd5f6fd14c309bc21c9ccc3b4d5b87a761c0836ab9d8dd14851f2
-
SSDEEP
3072:JpoXYDL9xrFN5ThG+2wCk7gs01VfnmulBeFPS64+n2B:bX/Trb5ll2m7Z03vl6PS6/U
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52de941257c71243f41c574686373d3f_JaffaCakes118
Files
-
52de941257c71243f41c574686373d3f_JaffaCakes118.dll windows:5 windows x86 arch:x86
50f75c6727a8541233a15288062aae6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TerminateProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcr90
free
Exports
Exports
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 434B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ