ɥ)���D$Z��_�����;�G|^<q ͉�JH��e�â�~M��uq��������� �G�w��%W�05�GD�{N}Hб����t�L����e0(�.�#��\���|h<X�X�;��t�}.n�~.K��֓`w'�"��� ���/{��,�:��+��1l� ��8���6�U%ޔ��W(M�����LC����n8���h������S�-k�ⲽ�R�ck��i���$-�{І��J������:��@� �7�3��W�}�o�i�0��vi!�6����Z���J��T?K\#7���B�wSj��bD#�� hGr}ҳ_Zy#B�� ��Rp��L�1��mщ�Q$�ޒ��C�yw�(��^��ٛm���G��d�À��4��N^eܝ�(��M+�ڪ����0p'M�D��ؖ�gh��� ��np�����N�Ѐ�����vs�=�Jn�K����VT"�j9��>��eo\�+=����n:�`W_��ggN���ޥ#���%���a�3ɬ��LW��ڤ�� �ꇩ>���ү���5P��L��8## D�R0�����'zD-�F�D(r� )�l�Y�:��NT�=�����TU��FʀSoW̐�A���B9GP��z��H�����j:���:*�R�>������������#dO���ޟC��l��x�����+U�fN<̀��\�`��Q3�Op����+V8��I�W��g�k�r$Д���' M ��B�v��m �3�#,�ff3�¾<P�{]�2WCF����K����H�,�S��~�� �T�b������3�y��KgZ��.��xIP� 4�.��3 %QA]ۂI�bfO>�X�K�c��#le�� �S�0�G��J�7+�Ըh^�T����u���s��(���hp��x�KxJ���S��UV� p9�ߨ~�f-�0o�Kn3�4�aΚ�~��������WrM�[�Y,��9M��,C�μ>zX8�+�r���+? R�*���&�m��������5��P$4�f���ΗO��rk�|�0FY����G�=��5����������O���ގ%9���lu��j��TC;��sq��Z��\��O�����3@�`'J l�������U��]�n �JU�%���N�I�Y�R�V\��WNlC�N��%n� �w��`���E8���BT��h=N���N0�E�bn8������]���'�Y9c�[��a౫)z7�h(����ȩM��n�����ʼ�D&�6�7э>�Q"�d՛�Xg�z>(�h�K��=2�/ҋs9|���Y*�H&�?H�S�l4���Z��|�Q'�T�壑�(0���B�4���Ai~��+�|E�#�PG���mp�d=��]���?�K� ;/ݟ�j�J��E7��� �Ф�����T�T��/��Bv�ͧD�؛j?� �hͰ��_S,�a;��R���1�Z�4B�D9�ī�]�N�]V�{�)� �>?���uϣ�ؿ� IZ�M�m��k(EK�Ko1�X� *[f90��?��k%zݎW� $x��@�m�yG�Z��k� J�Ufg�1�N��C֢�� =����Y頹sg��<{�0=)K��w�g���r} �Y�3��՝@�$��&��j6�8� -�͂G�+!)�������H�H]E5G9k��GGUj�m>@hg����mkd9�oR�*?��Cg�NG�:�i7'M�P*hI ��y��<���~�#ٻ�Ya~՝�]�U��v4�sr�����/�oSz�g���VN��m%Q�p����V�8A��:��yN�-w^g����~j ��G�v��dl��4P�#{a)Iu#`+�K�M�|7x���m|���������v�;�����7�x=�ș2+��������od��_�mU�>���?, A��w�'^*����LZ�P��Bq"��ÑU#F�V+�/k��~L蔄֍���2��7���0z�X��Sxz���l�`����(��VZW��܅� ��3�(���Q�Cd�N��!�iU�x�]&����������������w����l,b�/*:�v����Z<crO<ӝ�FڹB�o��B��,&^��J�G�z�ۥp=��y��?���:����-j����s�"��l�կaY������փ�7��cI�����rcB\i�!՜�v cj²�&��78����@f���2Iɧ��-�RoRD,;�7j�Z�/��3��;�l+�?�~�Ia�y��{d>/3�����` �#k�q|��[bW$�I��N� ��^��E'����r�#���C�R�T�`����\q�2�O���PV���W�Ɀ's6��V�<ǰ��g�=� -@<��*��cBl}���M�#˚n�[##m4������xJi[�� |��H�s�k�d��l�'5QҨ;�O"���IYY�J|m��1�=�����J����P��(��rbW�T([��0���Bp��38�n��N���f������ h;���k�vֱ5ˈ�/wytT���6K�O<z8�]d��84��QXA��N�g��/8���� z/�7�Iii���w;�P����:@�����[���^�U��^����;�@�3�逤Y<��4d�[=/m��f(��Itq#2$�`!�j�+|N؎l��˫ ���_;L�= �g����h3@B�����t�����������&���gs� @+�^�n�ut���Ox�e���f)�δ�����LjZ��#O�\�"��+��GA?D��S�e��>�;�څ~>J3 ��QՁ���p�YNB��O��B����S���,D�0v�l�� k���䊷BlĜ�7y���4����>�W��˞�Q�S~~��A;k�K�g���JV���1��rԩ"� �wY���'9l�f�ܒ��6E��1Ē�� ����'@���c/�d�'R���;Z���}��Ihڀ$��|č��$o��Đ{^�Y����\�����h��!G[$6�S�Y^�[�PNIf�r��X�y��7[�q"hm��H�6u���`�3���W���f;�Z���I����權h��x���gl���`
Behavioral task
behavioral1
Sample
a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
b.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
b.exe
Resource
win10v2004-20240226-en
General
-
Target
fe49674b920ac6d7bf6d18841445afd9_JaffaCakes118
-
Size
1.5MB
-
MD5
fe49674b920ac6d7bf6d18841445afd9
-
SHA1
3ee482ed1f54868cb1289f5b020eab4a5d5e7bc6
-
SHA256
c6ef1177024c4c1490203d420b218249f43213acf03c523f743072930c5b5245
-
SHA512
e087d3eb703d3485b5809440e41d000ef906383c73fd11ab31d196fd64b3a489f8db54377f8e79fab623977194a92610d040f50dec00359535a9610b50ed5664
-
SSDEEP
24576:ChnIFiuZw89BQEYlIXQDiZfGsBLpTnr52iKLJYJJs4ns:CFgVMzSADihpL9nr51wis
Malware Config
Signatures
-
resource yara_rule static1/unpack001/b.exe vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/a.exe unpack001/b.exe
Files
-
fe49674b920ac6d7bf6d18841445afd9_JaffaCakes118.cab
-
a.exe.exe windows:4 windows x86 arch:x86
ed4285929b7d0d831f66d393d0ecac85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strrchr
??3@YAXPAX@Z
??2@YAPAXI@Z
fclose
fprintf
fseek
fopen
_mkdir
kernel32
Sleep
CloseHandle
WriteFile
CreateFileA
CompareStringA
GetProcAddress
GetModuleHandleA
lstrlenA
GetLastError
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
ExitProcess
WinExec
GetModuleFileNameA
GetEnvironmentVariableA
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateMutexA
TerminateProcess
LoadLibraryA
GetTickCount
CreateThread
DeleteFileA
CopyFileA
user32
wsprintfA
DispatchMessageA
TranslateMessage
PeekMessageA
GetWindowThreadProcessId
FindWindowA
SetTimer
KillTimer
GetMessageA
SendMessageA
keybd_event
SetActiveWindow
SetForegroundWindow
SetWindowLongA
ShowWindow
advapi32
RegCloseKey
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
RegOpenKeyA
Sections
.data Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
b.exe.exe windows:4 windows x86 arch:x86
7a8f6184244e63294ec95553c54d0a85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterClipboardFormatA
gdi32
GetTextColor
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegEnumKeyA
comctl32
InitCommonControlsEx
shlwapi
PathStripToRootA
oledlg
ord8
ole32
CLSIDFromProgID
oleaut32
OleCreateFontIndirect
wininet
FtpGetFileA
Exports
Exports
Sections
.text Size: - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE