�I�-Q���J���u)�ϒf��"d��c��̹��i�^�8��$i����Q�W}�ty-�q��ce���w�UO���\�,�uQ���p$cR�@�E7���>��t%��t �!,lK�@a�s�B.DœwX���E'N�5�z�Է(���2�����^w����U�α(Yj 1��D�!62Y���!CB�n���}碧W��]�_D�B�Ե��x�x3iB.���D�${�)t��H��b��l"�OqPo�R���n�z� �����tqV��"<4�*pf�q�ƥ��x+��]'1�?e��i�I��2��Ĉ��N�0�]��W~yn� ڣw@��Ɛ��Mo��JN- �3������KRɶ�-7��Ji�Y�~G�pfQ��9��%�M�/��>��I�z�ܼ�z*��Uv�"�C/��Ċ�**�lym�X�M�FĢ�Eў�:�Ԙ��H�t��W� xi�bC�����!Đ���>�؇'��h"U:�pc�sN�D=� �N�2��c#�Ĵ�,]9m=�R��Bb��=��u��ہki�ǭZ<X�� u\�Z%�Gw�b�{ռO8��������ms^� ��R{#�A�O�(� �0���7�b��Gq��&���#a\x۵��3�C�Z�D�n$oƝi�v�T�L�9���w����IQ�?��),P�"0��B�b&��O�����\9�Fruf�1���Z%\t�^�w�4���4"c���cᆕ��-o#�i�-�Q��9��eF`� ��FLdݶ��7Pr��8��)��)�oHq ˅F�Bf������b:E�¹��`|nȅ}�C6�y��y��o7o.Z<o8H��R��1�l�yV1Byf����Կo��nb+��e�]dK����"�F`L�W��F�C������#�G�O^(`�>,��;���t��;���+�ĜV˗�'��]�h|�B�x�ew"��R�����P7���Cr�G��^��zQ"�p���" ��8��^�ED���G�~oi�g~[ lS�r�d�~�UJ�� (�uӛ. @Md��=�qn�ّ�K&w��F�p�~z/n��=S' т"��+Cs�˵��ׄx4+i[!=qs������{Eu�>��d/�ׇ�c�a.�d����:\[`��m�eڛY�{���_�"1A<�$�l9�������7���r�Q�$�S��!ᅡ�rj�����3�¦2�7��omP9�n����M����?�j:� �C�;G��.�f~�/��R�u�Z]�a"巖a�G� 7���#U��{�n����,�KeĢ��X���(�GA4ν���>T�>�i�uxm�� �h�p�y�<{�v�d�](��~�l3�ƶ��ǧ��ڠ�6���� n��vƠ���bT�\w�����zȪA�,���^�����q�W#\aM�N�\Z�u��̖����.J����*ؒ _:[7�+�H���Z��q�Dќ���t(z�{H��t�G�`���kp5<4��G��QE��3�������s'X ~��$ Ǟ6�`��(�H��4��sK�#s u�OT���3|p�b��y��L�(����'H+i��G�֘X�A�����Lq��!�*Ν (�M{���̺Ϋ<lYl� =��Q�{̙Un�|V@���[��=�s�j3(@�ʒP���TѮ�Lv�� 6�F �d�'�v��{NQR�S���aM�L���]�;/J�h#���\S��"@��<���Թ~/�$w i�q���i6K\�y��H���;s�s�>ڈDq�Z]�L���QB�/��|��<�t�pIG=�FUoqP��%ќ�}��Il��z�T��E��Hn"���䨂|�!�F�E����i�4��Ô�� RIS��I��,9�ָn��YV�� ������"����%�&L�A� �g0bx������kS_D���y���ɚ�v����mМ�9�"..}OE��@v�H3:r�:����p��h��Ag�psBp�[����K�{!����E֡���Um���}#�9F��?�\���p$��e��4!ש ���5��_7]����)!ٰ��ֺ(����� �7���`Ǐ����Y���u�@#����o�=}S6H�!�����3~�9��B�Ӫ�ZuTx�ՕY��s�F�[���P�抓����p�@�i�wM�9��?�=:m�� r�|��7��a�q�vK,�}�&�� ��ǕӐ9`��Ku�M��w����P{0�`�Iti&X�Ee 0F;�?tmXr�ɋ�w%��k-ðX���ڬ�!K����Y�4|�����-�>�b�O:q�ԛ2br�"�Rk�\LrY�|mU�����4�T�U�������(@O*4������kt�:Y� !)Z_;��� �!���=F8���ѫBh��[� ��i�u벏Z��3;��<ų�`�`�Ɓ��"�SCy �C��ĂꢄO�"PB���ΐ�U��'��������R��_+���ƕ���ad��Xt��y�c�2|h�i>��o��E"��������`�ʑ�ό�ɞ.%�~M��O��҂یS��&�G��2��(zd���9EHe��]����@��$Z�� \n�����Q�*����K�Ĉ��{' ���.�^�(����V\�{Tl���,lQ���McT��9���b�-"=�y�'�LD+�n�g� �����T�CaW �b"�\���1�1 �HC�������þ %��vϕlwݚn�/p��s-6�����9��h�V��%�=Y����(/mN��# ���XbK�2�6������� �݉ x���}$�O��nH����h�{�fw>j wǦ����/�ն�?&n�"�PF� ���/�v��d�7���"1�9�$6�C�fG�9t�FS�ܢ���5��#�������%(�7}^?@m|A}�.ؓ�⦹�`i��&�����[P�6��z%���`VB�KV�AC}T���xu�����B���7�s�tC0U�;�)�ji�wa��<aD���S[s^rX�{d��P�L�!*3"b�j��W�����\�
Behavioral task
behavioral1
Sample
fc8e2ad5b0dc094956ce7bffb405e210_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fc8e2ad5b0dc094956ce7bffb405e210_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fc8e2ad5b0dc094956ce7bffb405e210_JaffaCakes118
-
Size
3.7MB
-
MD5
fc8e2ad5b0dc094956ce7bffb405e210
-
SHA1
397bb21fa33147d84a3c96293ab646920a738b14
-
SHA256
18cfefd0900c82ff8fedd3cfb8f047ad4da2fbcb4130f229bc3af763d7385577
-
SHA512
1513570d2ce4d4f40a81f6cdbdc42304203d4a4da12ef9a3d08e69e73ecd73004bc06896b80fcca2e8005864d6b7d25756f57320162e31fb822ae46ba444aeed
-
SSDEEP
98304:aA+Oe3kh9qsUnF9bamSGIfSJJWISYKvoKwhrVgAxVEfw2:3hNnqTDbampIfSJJW9YKAnhhxVEY2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc8e2ad5b0dc094956ce7bffb405e210_JaffaCakes118
Files
-
fc8e2ad5b0dc094956ce7bffb405e210_JaffaCakes118.exe windows:5 windows x86 arch:x86
39527ca1bc3b4daa5eda5639f2107b52
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
EndPaint
gdi32
GetViewportOrgEx
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ole32
OleInitialize
gdiplus
GdipGetImageEncoders
imm32
ImmGetCompositionStringA
shell32
ShellExecuteA
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
comctl32
ImageList_Draw
shlwapi
PathFileExistsA
winmm
midiStreamOut
ws2_32
WSACleanup
version
GetFileVersionInfoA
rasapi32
RasHangUpA
oleaut32
VariantClear
wininet
HttpQueryInfoA
comdlg32
ChooseFontA
Exports
Exports
Sections
.text Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 928KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.7MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ