�o�fP���ƿ���p�Pj� ��94���V���>����h��5�A����뭌��Ƒ��J��� pJ,������s �r��`؉�/� w�&�mO�B\z�('�K3 ����N�;�D B4}�昵�����k����l��G<P��d�w{�QK@��7����i�j��tb>^!0 �Z@�y����>����A��!Y2U}���.<u�^��}�k ��±��O�X�HNz��\4�����[��C���#_�L�#�OU<��pj�!��@�k)b- �1�Sh��8DL�Fg,i1-���=���IN2_]l�g�K�0��S��(=�=�»um����w��l�- $��I���n/��%���o��ȏ��fc�6٦���C�y}7���h���o �ּ I��}U��ӈ@��-�����nN�xi8,�X�����(ˢ9Q�s� ��j#�US"�C7�և�<��0 ���!��ǻ.��HU��ެ�����ѡ�Ĉ��n�������@�Qp��k��l-_�4��v��u����$C��Q�����ò�U&XW�*�m�8�n���|�P�8���,��"ǹA<�z�T�4��'���PpP�ϼ���Y�qWq�'��s�t1���w�@)�S]�]P��?t�͗J^Ϯ�G�8�~@������emV�� \���$������*�HK�<8�a�$���@���J��]��B��:��L?F�Kը��sW;iXEu:��mE�g��4�o0���>�/k,��B�����!�+Hu6���Yw8U�<����������a`gr��J,�'3@A�C�(�}�� H߃{����~�!M�F�F����Jɝ��%�~�����sA!��� q�/0\q<LW��$9Y�Acl��֝X�>�Y@f�f;ø�T�Ց���� %4�%��z���'�#ɠܺ3�X�9vڑ_��ufw��t�d�Wk���ӻ- q�F�7���Q�טa{�ӟm�ZF=ch���>�X��UࣆuZ������RY%�O�٪����4[���p\S�U�������-Q�K �Sr6�(����D)+h.�eh D�tb�2�YV�Ӱs�_���x����~8(!��52TX� =�'m������% 5&6F咭r�6���Z��I�}�n�m���W���ϒ�n�so�j&�����@�ٛ�N�o�.Y}7�Iж�J�����,,�(��6��1����iHbW���OR4�~՛#ڵN���ŊSa?Ƞ@I+�������Ь�oq�^�Y��W��q�H�&Vv�h�դ����{�|V�"�_O=>���9$1X��O�0��n��yZ�X6�/�X2o� z���:*��ɲ����d1��'|N9��e�\�n�pGA�O����_���#�E�ɳ�� uw�A��`T6M,����Ҏ�|y����=���~/����d�֭P�W��X�,�5/�"�FNk�L�o�}�xs��A!�@� 2I��^c���1:�%�����(�}��ʍ����[~4InWX��t��d��}F�l �����g36�"�eB��W8��7��� _�� �KY�?�W�� R�HzC��`0B�;��b�g����TU5 ��� o��� �@�46<|!5Oh��'N�g��n?��@�F^&[��`M��yI��)e�?���"�~��b�M`t�|,��P���C��]�"8���>XF��HM��&�\�O}{@��� ���"(M ��4% ����GԌ��Kq���jb�v%2�"���< �e��Gf(73%�O��Du�g}��i�H1��\j�H��{r�>���>�� ��F ��{���0J��=��1������[C�6�aߒ9��4��pk+�MK���PL?>H��]N~�X���Ԇ�y��ub��Jz���5�ŀg�M�t�!N,�B�z�z�*=��ؚ���=P�ѧG4�,D~�.�_�Ⱥ������*<d��|����2L���x��t_����� �X�`h��oܧ�c�,�{��!X��fg�������P�\�M���?Tג0ްS�j�$>y�"Әxgj�|���L���{��q��Gp쏗JH�mjekZşu��Y�W5M<-2͇b��S+ĊhD~� ~Z��:V�[�'��s�nC���N�����+Ned�JN#�M,<�J\����uх\I��˚u����ç��������˒�IO p����G&�G���$���G�7k����o4�=��TYe[��{�6��|R�mu����QY���N~l�+��{PA����đ��}�cD[":���WBރs ��������F:*�j���"#��7���Q6�O#YW�����q�V(m˶�,S��P���Ő���ұ&��~�n�-##�. _P�Y���R��#�v���OƮҪ"������7�J�i)Q����S��_�<�s��}4��ӡ7�� 0���G�T�T��Y���<6L���ė?Q�d��)�#�6ya�rql$)�hu��p&�������6'���6��X�C����VI�X�¿Z<�C����%��N�(&Ͱ�5�iy�oö<I����c;ԊykK�a�F���O��ίW�7x�M����'pm�c��j Ɯ��,Lx�V��#�l?Іٺ��^����%$����uQV�p~{/��s�X�fO���$8� �?S�n1���H.�x{������y��J!�N�ǖ�Õ�j�u$(��r7{��:��R�(˳�f�6���Ӟ�(��wYRl����W�wxIV�)��.0�|O��!�� (d����_����i(lYr�Z�@���N�&���X<NP��(���2hS�e��#K��Q�y�&X�ֿ�����P�|u_��EF;�yX>��i�X�U��5b��Y�X1�ی���˨� 6�P�C�³�?(��_]�iE/\ɤ諸�$�^����� ��}M6���?��d3�j]��[߸A���dK�����9��~�ǿSgW��@��'k�G�7&�>�Y~�L�����?��d{`���r��͍��,_��o�V��Ïܯi�G'm�l�.��k���ãud"��+
Behavioral task
behavioral1
Sample
f87cf3a4f055f178e511a8b8042db744_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f87cf3a4f055f178e511a8b8042db744_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f87cf3a4f055f178e511a8b8042db744_JaffaCakes118
-
Size
6.4MB
-
MD5
f87cf3a4f055f178e511a8b8042db744
-
SHA1
b9df9b755fe70a4e9255aa9a0759a7843a10336d
-
SHA256
b337212bc1cc05e059a1bb198fe134a805085e6bab1100dfdc9a546194380eb8
-
SHA512
a205462fc800c4098d97b98f48c0a0b298b74edd1e7779287b8760cb0385c1e733cee6fecfe51462385f2e6dc5af13c34036e1ef7723efffb48615e416e033b2
-
SSDEEP
98304:koNT3ek6Rp78wqh8mgFuOV9+eyznXSFDQAjJjyzIVkkV2KqbFH4aSmu6D:koNbek6/7Rql8uC9+tDXStDj6iSb8m
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f87cf3a4f055f178e511a8b8042db744_JaffaCakes118
Files
-
f87cf3a4f055f178e511a8b8042db744_JaffaCakes118.exe windows:6 windows x64 arch:x64
9efc2bcbad1a50215acc5aa2fceb9bde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
inet_pton
wldap32
ord211
crypt32
CertFreeCertificateContext
advapi32
CryptReleaseContext
d3d9
Direct3DCreate9
kernel32
VirtualAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
xinput1_3
ord2
d3dx9_43
D3DXCreateTextureFromFileA
bcrypt
BCryptGenRandom
userenv
UnloadUserProfile
rpcrt4
UuidToStringA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 850KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ