��K���K�3��Hn�j��6m;6�<lhT������E+�ٰ�mq �Τ�!�W|�݀ǂ-w�s,敁^ ����X<b�yь;I�G\u?� ��S��n{�(v��W��������SQÑ(I�7�4��G\ȝR��'"u$|dʫOW���c���*7�]&)!DH��b+=*G�����̆oO��x�Xc+wIn����p��K�ŠS����Q��w�+�a���lAj�Sk�,&U���� �����������<��#坂I�H�����6 UeΌ̳��������c��0J��$VF��Nf�-n_��e���0/�F%�=���#0n�5���FJ��5��/��+��|k6n�j4F_��x���^|��eͿ�}��9P�R[�����c���'����3�g�_`o�/�U�L������K�n0i Č#7W�/Ds��ܾ&�Nf�|P�R:�����g�������4)M++oK�������K$�{Z�%_����=Q��f�4N(�8 �?vD� ��\qY6���HX���W�^������y��P1Q0����� mI�'mKt��s���R��[���q���'��m�������V�%���B��;���,;��]���<Q�ުp���Dn�q�:�*#tGX�!c�}��z|z��8A���&q=�I��ދ�����eރ��"2������d�Ñ���Dz�������kA�ւ�&�:5��bOG�t��D�x����k����{���ܺ'������F�%�K��ޣ���2��o(�.��D����.�o�<�a���ۻg�2�]{�%�F�ʏ��pFp��g~ R��Ǯ�n������UX:<�.Jӷԑ.���`(��(�����4D���:7a��������)$[��Sރ���x�����g �����.����?��-w������}K !��������p���DxΗ��hkUfv�̌��<���N#��U�S�[���@ "p���\`I�j��t�7�� �nZ���I/@DCߒ�g[gәj�a�Pǰ�g�1|;ѵ�{�:}&s����<�`l���&S�+���R�Z-�d�im���ۍ�!1Ʒ����<��}���t4�I�%n��us����v���xv�AM�S���!�I�:D���z�~�c�VM2�=7��:���xߚ;:�}3vO�� �7�7��o���<�}F��Kvވ����բ �o Vz@�$U��#8�CaE)Id��[��DP���2| ��J��#;�������*�m��>=���o������C���½�V��V̢�ߊՅ��Ů&����\�C�Ű��>j )!0K�b`��߄��a��9�Pb)��9�u�]�@Ti��BN1�6uM�$Y�����\���{ؼ���A8W�b��( l��U-�?_A�#�9�#�,���>�Ȩs|l��,J���:w��|a>Vg���!���Ҳ+��J,�� ���@rQ5�����,�~_=,g�{8���3a�0_�T�L�A��V:ت�ը��QA�}d.�2CR8��A?��d^`+]G&���v�3��8�HO�(`{�2���8�OыQK��������c�2ME�<zq���u�x�B ]�y���9�����,��`������ޕ�n�_�-G�dѮl�邶����Kr��*���$`�����1�G���@"�m�+�dx�[M��#���?���K����[,#�S:�u>�:��^Hl�ݬ��ݴ�v}z᠏^L2A_7,�U��@7w�[ǥ��� ��v�9��蒩�%TN'��_�'@ `�bD�'[��>ӅT-�h����(�2a�'Ԡ��A�x�9�|B�tMֆ��a�0#�� �N�'�'�2��>0� ����pd���p�M��0Y���ƛ������v����X3�0��0 ?d�r�`�������Wٗ<��s�6esNVK��x�7�Q,�'�8�42w��z���-�q�ZPҞwM+��$����>ЀW�g�����A��xPp$ݷӒ���/)X(�/�N�&v Ҙ��Qx-�>zP��o.@dl0���O���HO��5�e���(~jЙ����fp�˩x��1 ��2���$�y�!�z�W�*���$�d[�H�\�@���lR[/Ε��Z��x�7�*Ge��VV5�,e��Ljx� ��P��{���Wo��9�N˅Gg�����Ag�J�537�sn~�z_�@%�� `�*�7���g84������9�k!2��A�s+��u�����:��,)]���&1�EA�zf��V�#�,rϔ �P��~S�4u��Oe��\ ����H���U5���l���T""NH�,*�2f��bO��Mb2��=�+F�]����Y��\�8���Ι�*=�x&u��Sݦ�IC��|� }5�����Z�H;�c���������M��{�w��p��/��66��;��(}�F�i,v�Hgm*�\�����&�a���td����Ѻ�RcJK^�O-C�ŕ�)����u���m&��`QK�,a�'}Tڑ=K� %�E�F����%F����\��X�w�듗tT�O�̗�\�f+p)��|��}D��*���:Vq��e�C������k5^N�ł�jJ��hf�]R��f�S�`�/�8K�E2�����Ĵ�?��dx$5�C�<k��?7��/�<�%�~ݩ��!�:{҄����T�Oԁ�Y��M;�C�ǁ:�K�{�B3���L��S��SZ��P��E�#�Ȯ)�{p��x���j�@�0ȃ|�$V/��c���o�?��� q��r�����"�`�0p4� ��U�`���r�������>�M=���;־q�ІK(*ԙ;��b��̶�h�`���9C���ϱ�]6�o}�Jm�r�B����چk&(��߆!��]tG"}��|{O�M�1V���ME� ����St�h�� Ϣ�0��!+�h^|p��N��>����}V��A����I>�+J��3�_vA���&�жئL� ��h��Ƀ4�_�矇��� K����{���
Behavioral task
behavioral1
Sample
177e8de838cca2b3d4acb49bc3b50ae2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
177e8de838cca2b3d4acb49bc3b50ae2_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
177e8de838cca2b3d4acb49bc3b50ae2_JaffaCakes118
-
Size
6.0MB
-
MD5
177e8de838cca2b3d4acb49bc3b50ae2
-
SHA1
5a92181ad9964ae8a4f8858646402f547570e425
-
SHA256
11f80a231bdb490903e827855b9017aefded7bd84cea082f4f7420dd20b817eb
-
SHA512
9c0a9810dbd02f82c6679767d34aa6b9ddcb3abccedce6367c1d78fbcec8463c6e011be95de14807d5e4b96e336644903f0140f508cd9ba9cb9554c5ec6e41c3
-
SSDEEP
196608:xyHuqVqNpKTaHMr29wTS+OVCUsjSFRWcCf7:8XVOpKTv2+SxtssED
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 177e8de838cca2b3d4acb49bc3b50ae2_JaffaCakes118
Files
-
177e8de838cca2b3d4acb49bc3b50ae2_JaffaCakes118.exe windows:6 windows x86 arch:x86
23e7a01e244568d763c438a7509be09c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoInitializeSecurity
oleaut32
SysAllocString
ws2_32
send
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 479B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ