!(���Z�h1���(k��.fV�^�����,% ֫��">���a �&C^��u�}�R���n��{���'M�Aɇ68Qu@Uc�m,rL �����l�9�ٚ⚏��LB�� ��D�1+8���d]n+�"y3��aAӪ�H��M�d���BO!�<��f�c��=�����']�������8����-��D�F�1�����A��G}�l<g,�D���� ��F@z��"��go(�#����Y �Z���6�+�-�Q�N ݧ�ޜ7���F��s������Ơu�QÆ��RP�ҿ_���[����yP;��.�|��c��+0q�&1$&�������g�`%�(��g#h�5�X��U�S��N�������B08p�I���}V��{j�̘�o�G��x�ʒ���5��3:��Ώ/��؊Y���ƈc�aE@ΉW�!#�+mj�(g�_��.l��I����:���^������vv�u�J\�=�uI_�1�X�m@>����10����+�g������wV ��phT����&l'�&P�|�B��aj�&F*������-4�R�2h���jj�{�9��-������'�:G��S���R�L��(���au���-(�n��x�b)��kex�_��e��C`n����S�a����3��r��A���?U�Ų��0�jkeX|]��+ �F~�.����Ly�G8� ���p��p���/�N����F�n�n���`O����.�������B�=J���-&\<=n�O������O����Y�O&���L>5����X��5J�cpe)�{$���+wTfӛO����[Z��@?�Py�W�{N����Y��-�1����һ�<��m"��8!J'��>p�y���<yE��}�����jm�J�������������$?��߀�_��@��L�t�a��q+#�/ӯ/y�������mvU�������N����a�������I�`�:~���%��<ջ�l��Ͻ{"��Eȓ8����@8QC�g_j�z�7�0d<2���c�ٛeC%�]��'������څc�]Nh3HIHu��{Ggĉ��7��8t�i��P ^l��P�4j�(}=��0�� ��/ժ���&.���π�n��/��>����ְ�#1�4#�b��3KtI_�f��J�N��f�L�o���8-6|�5˛8ǜ��ذ/�+C�%H6�b�.��_;��l���b���.�#K���#rǴ�t��&@��Xg�dQ.h�*h0�3�'F ��l]�8��70)�[����@[�)V^0��*��&z ��G�U�����2�2m���s� vk�����w���'9��R�D���;0abC��56+�)cT�b��K�� #�X!Qdcy�����c�u�k�9����"NA>�����F����3�0�7.���&�>2� �H��9ԅ"�K���{��{Gv|���ӎ���/�E`�64�%�K{�0�����X�m�2����;�ի���p����e��5UE�%QV�#�]��U�\n@�&��4�XTG._1�R-ّ��������ٛ�3<�_ߚ cWr���� �}|Z�]�Fы�N�-u{/��0S�Q�uq�<x� �Ύ��o�}�p�gg�P�Re�fx�l�D��n�B�i�ǜ�Ꮔ����u)�4XO�����8��ߙը�xL&���6`v���ꢞ�����P̓��r˓���議��GU���_3��3��@��?q�nH ����J����]=M�6q A�k��I�u���Y)C<��Z��Lj����"n�oD��}r�ƪ�F�'j>� �4Yn$~�(�~b�谹c��������L��[@`fݲuT'��C�Wz��+xR �#���O�d/�Thė��̂E�!�%�ڵ��jIpN����-q�s�����m�.�/�����kق$���uc ��p���m@j�s��bϧ�l8Y�T�^HR��״H�\tC��X���������g�S��lnÞ�*p���`�H8C�!�NR��(���8I\�lN�8S�T�*����f��S��o��sv�c���n���s�$���V��T�Ѥn�,MV���M����3*,����I�%�.����*�g�Q�uD���~K};�����'kԛ��E<�o�y��#��,P��?p)E=�~P��ߒ�g�L�`[!Ӟ-��.��!z�Y� ���Ұ��I�=��8KS�����9�r���H|l�����)$�n�ӽb��F6H�+���� B=i�Ġ�����X��4��5v�_��ͳUz�`Ճ�Aa���&��.��jM�61�OTHb��`��Mη������F�An�W���Z�l�9ѻ������Q0=Mbl �?��j�62� ��aؐ#��*����I��YP�ßӚE���3��d��8_+Ԋ���[��e�G�T��+��NS�Y��r������:n7�P�Q��bϞml�g�Y�ÏT����k���`nt�����q���9�D�)�;�� 쎨�_?.���l�|����Z<f3�����^Q`ƀ����C��,��#X�Wf��e".�������-g4��y�؟�!��@�I���;�.���&����w�Eg�>W�zЉX�0�+�/�d�>p9����{���瞊�8����N+�Z�!��Z5q����B�}�D�~f�m�������%�>Rj~ |7�$R�9S�((�a�<�(ķi`��rc��kt�Y�k� ��0e��N�Uf<�<����}�[� ���]���RL�e����J�� �l4����n���g�yR�������pm}�:����p"����"z��,B� ��/U/^��΄�L�ٍ� қ��K�5�x�8� =U�|V����@�|�ʉ{�{�Ҋށii�jy�J:~P�W�:��oQ�@k�pް�';��)�fe�j��;%�q�BK�|������Eҡs ls���|LpE��yʁ����m���h[�`�l@�ewmy��[�5����T#J]-��e+�9�e'j�����Q-{ސ�����<� 6�7������qV/3.�Z�}\Xnr���Zs�H���[xojUW
Behavioral task
behavioral1
Sample
fa4801b786f4a7c8d65b7ccc975eb1d5_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fa4801b786f4a7c8d65b7ccc975eb1d5_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fa4801b786f4a7c8d65b7ccc975eb1d5_JaffaCakes118
-
Size
251KB
-
MD5
fa4801b786f4a7c8d65b7ccc975eb1d5
-
SHA1
d3b9a45a5488a51c7f4c686b5d6e39f9feb72f93
-
SHA256
5b85c3ea18541be68151c65d6584d25784c871eded491d9b9cb2429594e170b2
-
SHA512
223fb499fa33736027fad0f991f9c41ea01efe04cf275c461daf5be0742afa9d83e8a1f4ed0e9dac3fc8d5ce5a0003f597ed4ffc399fac243febe5e549ef3a52
-
SSDEEP
6144:mo2JhDjTawP0zWJqjawaROvs704szGEoW98yZ:FqhDiZfJUXZsloW6yZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa4801b786f4a7c8d65b7ccc975eb1d5_JaffaCakes118
Files
-
fa4801b786f4a7c8d65b7ccc975eb1d5_JaffaCakes118.exe windows:5 windows x64 arch:x64
1c917c311cf0317ced289439c4117192
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostThreadMessageW
advapi32
RegQueryValueExA
ws2_32
gethostname
dbghelp
MiniDumpWriteDump
userenv
CreateEnvironmentBlock
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ