�^H�,?����D��C�� ���F���B�h�14iP��D�0��ǡ^�X;%�2Aq�p%����I9��وg�wg�XX�:�ی�����/搵���p�������<C��K��Q�}X4�'���1P�N=�6������$ɮ[���W���)�,��1�^p�߿&5��h���}��R������A&7�ҵ�E�t�U��;�,8�X��L����4������+�t??b;Z.��*�w�iN�����S~����6�ù�7�X[�kP�*�y"1� <@)x�4� ��qp� ���Ǐ�A%r�����q�������������K�_���dd��H��Q�����>4�������ȳdӓ�����LN%�b���f��O� D�9W87��rM�o�01��G7\�ۇ*͒0l{�=�X��OS�p��E�R����Po,��>�[' $Ԅ�π��9��d���1d=�VI`�јl0n��|����2�U$�������z_Rj��s�T�FN4&߭f�SM�tQi�K�۾����cl;�M�^�[I2��0I.�(is���kԊ�V=DŽ�;`�L%]����F���UN��,n1 j����g����a�J���'�V�l�l�4_t�zq��mp��G�Y���,30�a*ں@��jvci8�rbހ釺n4O�I���m��~��%�1���}zPg��p��7w���y�֞p ��Y�j5c���H:��0mi�~4��-ߪ�����0I��!x�H������6���.�V5��\mM�S��g|����+��Ls �սP+R:�C�����4��9T�tG���X��v(�N��{,w�g�h�b���]R��_A?qCtk;ɭu��S�D�[f������%���"��s�v��2`�!��L������ze�n M���q��GRg�[R�� �$�;J�9v����V½/_b����L��"}��I���0��<:Y)X��9�c��]�t�����Rx��U\���V�W*�+�AEް����F�9��P%�gjʖ����;P4Y�y�}��y��C������2(�����,q\( ��s8J����?��� 7ѽ�舜�WX?���:o��i��t�����Mn�_�P���������0�c�kZ&����6���ь��y.�: 硜�r������feլS.W��k��P��@Oy����?�Le���P��Z��=�V��h��k2 �@�I�vmKpN����"�ɻ��!C g�H�-σ�3]�D'��/����'4����T��}#�<��E3c65��E~r[f�'�8�/��相W+t����M)�"�Í������F0�Ԡ����A ���i�g��V4�GT";�z���:{�ËJ=����MF��D>k���?�5�)Dۧyy��VX4�-q��i���Qg SJNU�v�X�rU����tHu�@-Y�F���I@0O��98�È�n 4� �v�hS�v[���z�4j�&z�)���aS��)mL��s3��+$��O�s�)\В�hd#�j��i����{�*{�dy�1�7H�eE�m�fC���+O��k�I��+�1�"(��O��Ŀ���;7�Չ� ��5��������*SX�@.C��_�BmQ�V+p�:�7';�w��Y�)s�ט�R��՚�|�-$2���L�C]=m�"�*������r`^3_�W�z�]��$�:0t���0k�q/�����6���`�]�Y�3�K�8�m�4P���$�|�((����U��jt��?�$)Qo���gG�w�]�V�F�w���,ގ���䧶�+�D+�b��pؑ�S+�!�>4�ֱs+�;l�ǭl�W/衱gV ��x�G`�8[�ϙ� �ҺF�Sb6`�U����T����A E�ۆ����9yM)&����5�#ܚtߵ�3m7�l뼪��v)6`����Y�)q�����k�ܗX�B���3�IzN3H�n�7#���tA�N�F�]�"�җ�{=9�Jt_o�|V��e���:pNP�������d�|���hQ��Og�����Z�=I_�O4��ꕔ)$ƇIۗݪ!|�# ��܃����W*�3~�%�d���w'?���K�k\���{Q��#�ϋ�B{�WF5����3�r��c�F��O���1)��S#W�9�n[\�����P.g�A�䵿�g�~�n�!]5��DŽ��j��Qr�ӄ��^�m���Oe�lo����m8Q]ljy��7ph�6�>ΩKO���� ��e�����B:v@Y�����!�=���R�%~_�W��8��KO�ѻ����OX�%Lf�L��k ���A)T�����à ��zS�*V��~��;���ۜc�� 0��,��^���5���Q��ϦH�#���}�){���7��#r��I��G4w��p\�v��ӏuy��/��0e0!�:�&Vo�eߙ����S���c�VT �9�ZC3�5��2{��.��.��z�-l.�����H m8��4��v��e���j3��K��߭?�Ev��P��;Q�T�v��(�6��iQ%�4����~�M2� p24��;n,< ֣��xQ��߃�$�ϕ�x������-$ ~*��vT��{8d[�ԭ$ņ��-�9"�Q�d�4��M� ��(���'(�\��a������/e�a�h�l�8l|�$j`#�!����ȸ��v���E���4��"���عr��fI\����&��>{�8�\�T+� Qa:��Rq�r�GA\��:ָ�P)�������%��N{�0cg����̪��������v.�T��8^��1أ���x&��Zۊ9��O�X���kO��W؎���V'�����=V= ����P����b�m+�w�8$ >C�.u��j��ͳ:��I����9�KH�mz��-B�e�:�T�*��]h�FP6��"��̃����Ok{��"6�?Rx�\��Jc�w<���s4j�-��x�� w�(;&:���ѿ���<I�BK��:�^Buw;�q!u��
Behavioral task
behavioral1
Sample
ff6fa590cc1eed5d063633aa49e84450_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff6fa590cc1eed5d063633aa49e84450_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ff6fa590cc1eed5d063633aa49e84450_JaffaCakes118
-
Size
1.3MB
-
MD5
ff6fa590cc1eed5d063633aa49e84450
-
SHA1
ed27fbcb8bf1ff5e1e500576a5b2e2fc905286ea
-
SHA256
bf97ebb9748c9211cc412b42e5c42015df13e4f28e500129a14f3006b68cf759
-
SHA512
415da95465e7c17c1f8402cf0efd30b14849e1f2d759f4e2740920283e390bb27db84c82f769f04735af3c9f43f935ca95e7af9de3a3bee4ea2b7154386ae4b8
-
SSDEEP
24576:oxdM3jNnaPy0+b7adTNcCxUZunPwulvcNiEheLgb8NgdjnVxr:imZaK0+b7a9NfIuUHhhjVB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff6fa590cc1eed5d063633aa49e84450_JaffaCakes118
Files
-
ff6fa590cc1eed5d063633aa49e84450_JaffaCakes118.exe windows:6 windows x64 arch:x64
b0ff07df74c5f96e4e088d33a26b89c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mfc140u
ord6320
kernel32
FlsSetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
advapi32
LookupPrivilegeValueW
vcruntime140
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 708B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ