��� C�켈��� pp_�`�m��L�����}�E;�<��>;�D�~��0��av�y�����Ҝ"�ik� 5}�d\�P��T��7��� ��t�#T�����C0��%��� ���Q]Y�R,X��5l�N�߁���0 �7��H�1f5�u(jz����Un�`�z���TN���P�P|�b��<k�����"�n��E�L�ʐ��Ҿ���⒫GZ_!`<�4g\}�RDwy��d�j+'���67�_"WT�ېA?�� ���Σ��R�i��L=$^.��]�O~�)�LF!�*�/��,26���q���l��{�y-��&�(f��VY���X7�B�EB�4�ڭ$�s4���Y`_� ��l���k\ъґ ��������F��Q��k�j�},D,�����N���&nz��/��F1< ���z�jy[��9��o�syc]{���r-�6|CD�om��/f�;�-�,7� �.���:����&vL��������uJ�K~R Hyk��4�� �I"�jY.1��"��2p��\D��vD�V�w���|�{l����#@[ϑ:iOV�w�a�����@����Y8�#w����=I�1'�����3�I�·��'��]��}q���B�?�EJ�#�8h�x�>o���%{`�)f]H�!�{�1�^}��Oѽ������X���|&�U���Z�WknF-I���G��N�� �-�s�*��VJz�QQ�gк��b�������C�9`��gXxN����r��Xΰ���j>�z4�z�H���Gt�e�!5��yT^�z(x�w��e4�C�k>�o��=�t�eS�%}�!�'i8�P̡>��M��T:�r�m4/gcm8DޙQ4T_W���gq+q}@:W��RWbFJ.���� ��B���`ZW01�� (�(&keq<�p~�� �`\܋}�^��/)���$YE�����hȶ��8�P[N� �'h#�sHv9~B�\1e,�z�ޅ�q�|��P��/��t��� �xǚ���� uL2�Gc0]F�k�@���FC���M�Ѻp �(��a�>(��|�4O�7;r��I);,�C�XfO�n�4�����6̱c�GAx��^%qYm��N�4�Y�zx��\��%|{�(!��,�?"]`��%j������l[W=���9|u�ޞqa"oC��%{LR��m��� �O��T8&朾` 'J�/'�������I�R���$�?j�^1Lxl)�oW!������`g�gM%����\���+��.���yM���ꄬ�k.�W������%kRIO1V���c�����v3�+��9��L+�CW�R�Y\��'jg�h����wF�9q8�5ҥ#�n��E�i��?5�H��#��/�q�g�oXH�n{8,�4�{�JLA�f�p�&� ʣY��:x���;3&��NYw��f��AGV � H*��zF����n�`_��<����J!�:5Z����~�h��с/�ep��K�-�@��I%�<{���Ԍ�Hwc��-ё&��q.��E������g+S���{-�'�2��� ��0��t~��D�����T7�X������V�7��ZFI�uFw�����)gpD���L����V� �(�0;���21�n1��LX H.���2�/�{������y;���������TJ�����'@|17�I� ��{>�f����|��O�i��!�<�^_S0" �1��.4~`�xڢ;{� *z/���X+�w2�gӢV�)�8���oj;�2�����c0�j�n�Ǘ0��0����E-�S�n��>b��a�I�*�MV�����XS[��ĺf �O����o<.�-�R�(�7#N3�k�Z@�w����k�qj���=�k�nJ����0�2�����=�D�+���{�(9� ����Ua ʜV��a���a�E�HF|� �T�����BG�[(�����іTT�k���/q-�q /1��[:mU`'�9��%#`$#3�nɝ��n3M�%����h ���%�4=>$�ӡY!�`q=b��%�3�<�bZ�u,�M'q������� &���FIn�"7�%�u���.`ٿJ�|�<���n|Ǻ[��^0���/V�e�R����inL�) �H|���e89�̍E�� �۰Ns@KϻP�Wܙ}cI���ën;{Xoǖ�|��Vɛ7�_�����s�rf� @�� Q����p<�\M�R�=�� �Q)3g�P�}_�v�#TSX>��Q�2��T�Y�}���6�y춌���L3\�!\E��>ԯL�N��4YEw��t�oce|2�~o�^b���0�4��M��>B����\&+y������c��5���bWI�^so ��I��i���L�R L5��(�����C ��T�~�^����#[���{O�� �&V�?�i��� �;Y�ve����jpH:�L�e�bڧ��8�@+��&��r�t�-Z��rBw��gˈ��l�����4?�S6T��$f V�WE����U��?|qZ`g��L�oTUr�����6� ˠ�C�9t���S7�B�3&�uW-�� d��8U����w�������i�დdЀ+8�Sݨ��m�ܽ{z���[��/�D U���C�f~�\7r�s�kJ�v创�hAA��NHX�.^�^ZWGpR��fZZg�T����T����R'5{��k���i��L����ѻ���*#V*��%�vߗ�Q�҇���r)� ���H2�)L�w�#���j�]���g�62�7��6�Ys�����<�䕈����e�n���ؤ��_vQ�A�96��qJ��Ι�(JT�#�i1��xQ���# Oo���%�R�g�&x`����J�F��X�ߞ$?p�M�v @è�{�b�����f��w���^UYI�;5���)p����y�X�*�z<�?��=l�6$�x�R0%��uQ.��w�LbX6pA�CdSƽ��F��!��f�M�B�-�-�hѶ;��$�/�I�� ������T V�ߟ)�"�|����m�[WE�wu�@�N�ġ���9�`i'
Behavioral task
behavioral1
Sample
f21094f0e415f6b9567f7581ce20546b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f21094f0e415f6b9567f7581ce20546b_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f21094f0e415f6b9567f7581ce20546b_JaffaCakes118
-
Size
124KB
-
MD5
f21094f0e415f6b9567f7581ce20546b
-
SHA1
8f366c96d64e4b6d9addaabf47e0af9d39d566ef
-
SHA256
d205a3764d971bf0e9540a5376ae90a42e692e4207001800b703052553408c46
-
SHA512
cfe68c062f360dae650924c44f17096801eb1894c93bb20fc59d8a97d25538c5d9cc6f8803d0f2aa07bf5186c73336acd0dae0dc1114198edbaf51f1e8357780
-
SSDEEP
3072:dqTGDunCLLS/wwyWAdkg697OtJ9vYlK+inrLG:dqGDunCXFwqJLqlOnrL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f21094f0e415f6b9567f7581ce20546b_JaffaCakes118
Files
-
f21094f0e415f6b9567f7581ce20546b_JaffaCakes118.exe windows:4 windows x86 arch:x86
c84da386a07dd11a2cab562a5844f88e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateSemaphoreA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
??1type_info@@UAE@XZ
comctl32
InitCommonControlsEx
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ