1�������Id�W ��(��d�ѭ��{f�ޏ�Y� �A�"ߥ(ܟo����\��ܕ%����l�Xz�'���Le:�x��D���~)? ju�� �)8���d Vu)/ME8��)��� ư�۶ks4c(p�� #����z^�(�g��+�h���ζ���6E|�D%M;jHF�v����'�Ë�`�����H�N��f48�T��tV|zK�.Q(�ޜ�F���|s��<��D��"m�.J�ft� �뮠��xj)�Ҧ��N ���&�E�{Ɉk��S4i7�Ď��;t��RWj�{��MV.�O��%.[�k�$۟��pB}j���X_����=��B�O�L����.g��n$n�'�vGv�$MEJNi0b����)�}�����XI�b�@��=��<�߸i�&߰�/}e��D���Tzu�Jb-�ܦ�z ( ��*��2���Ӆ�؇�`Co��hW��@��f;� ���j�ѷ�^��k��k�wA�@�'�kl�A�ʴ��6V��@x,���8 ������Kw>�w�����t�s���z��!pz���5��mi�u�/ l�yE~�/�ۺ<���蝃a��?`5���FMk�T�?�F�ܗD��]�Ц��t����9��J�H6D�x1��B�j>��)��؎g����6���y�M�X��R�6�'�.�8%���߽�q.�����y��?��o�S�*��H���QG�Z������R�'�S"O�xg�Ge�7��/u�DJ�ڣ��~Z��ќft��ң�ڼ#���v�<ʇ���f�8����R�ծ�����d�%s��=�@�'1��YH9����� r�A�����:����6qڏo2�X�e�9x���L�������:?�Y���ҍ���) �"�N{tdZ6�vP+x�K!m!G'D�U�U;��^D&'���i� �إ�`���}�AV���|�vN\WU�n��.)�[��?�퇡Y�C3z�?�A�e2���O�H������L���%�-[�F"-�c�H��6��iТ�����j<y� � �MjA'�Il��}�[�@h�Q�H��4\��� ���7H����mAߟ���*k�7��!�.�3o�AAX�S�v 1d���MJ{��&�������iRG>P�PB�O�����>Oۭ<K�iG���D���=���o�j�i��J����J(FB�b~��傰m���VK�0�����FC�b�A�5�<�'[�zh~,�c��um�'���$T���Km\T��v�p��P��l�������?�Jv�Ӗ!z�py�?J���FܕC�9���#��~zi���(#�-�<N7|��h�bYd#�'M<�ySHa��hb���̜�|[�T���ѝ����K�2�v�����1��'g�Y�Jo:�/���������}�P��z�o���?r��������N"�ϋr����Xel.�bZ�DpL�R65��z���\4��0�h�b�0O �ȁ����sOף�"�V��vyک�5����0/�f��֢��˒��on5|1�Z��IXpLԠ!:{�}?��Uc���N<)N�9Nl���͈�I eV��t�l�(9V+x�*�D�?W�|`k��fr?�[*y�vC ����8� F�J���T@��� R��?�1链�) O�>�o,��ye�'9]5IQ�� |�V�.}�y�I�)�BJ�}�V��R�-����=e��q+�g�._� aQĄ��Xc�p�j�""[ƨ��~R��B�J�~A=�x��2O{ɿZ�2FB[�[��Y��YJ�����J�% <�#&x5)X&~m�U }w������'�ԩ �z��|�`W�]�{���j��Vd�F�Gf&�d%����6@�8�P�ފ_�C��F�7}���?/L8��y�5�8���_*D�P�;L�e���:�K��2UB��7��0Vz."~u��-hC,j;R�OE���v�߆�G��!/��$taM��u2 N6���f��h=�=��y7F�D�9�����cj��@u�o��X�Έc&a^���m�$\���\n����Kd�����B�,0��QH�{��Ӈ�n2��dd�GEI�j|�>��dL��&DbPA{������/璆�����wk�?��A�KK�B�k��RAK�X�Y���g�(Zs[�:ƃ�K��P�>�yz��A�w0sћ ����dʍ��) ڭp��z�ȷ)�o���L���`�����ܫ5�x�ʫ�c��ƧSx"�L�ú.�WW�6�q1ф��ذ���-��3�V�i��==E�iw|��5�����l|�����/�m���{=���%�;���]q��`��?A�,� �3�����`�$Ԣ� �%x[r�I��� |�W��HoC��;�b�+RP��AO41(�N�t4���!.㋠��/ B�|����;�5p2Xv|��8�����ެ���0Ӕ������9�, ��^� ;?/�������X��&��3�!/��K!�|4�F\��z$$�c�ͻ�X|{�W��=�W�K��M�)��@����y�c �d_�s1q��;dcbBn8���������wb��ʬ�e���2*3@e�f��)җ�'���L��9Xg���ӛ���(�t�9�� ��J�D�T�/u:�}j�\~`Tc;�Ka���J"M��se�VazGH�p6��|6�=uR� ��rݐ�(���j�~ dd� C�!�@�&��jf^Sq�,JJ�����B��t���E��jtYze���Qe�V��OKL��0q�k#���h��0to;�r�-�61x��u�*;Տ0WR0 � o�;���&���!���j�ۊiVh���N�V���:N��Q���ߞC'�h�oA.!�N�D��$@�؉lq��P�tahKcQp������ ����9�Qs�U ����fN��.4_��U�^@��%����`,v{t?��O��kt�3�$,G��i��\l�-]UA���3�aP��k��N��n*x�����!�s�"0P3���6"A���\SY�Zs0�ٵd�tl��Z��u��u����߿����_p�hb�5}G�t�]�j
Behavioral task
behavioral1
Sample
0997a41c4f490624101c6715754843dc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0997a41c4f490624101c6715754843dc_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
0997a41c4f490624101c6715754843dc_JaffaCakes118
-
Size
1.3MB
-
MD5
0997a41c4f490624101c6715754843dc
-
SHA1
e098d7a93e29424fa904960d599002e360bb83fa
-
SHA256
04c440fdbf44b98b8f5d211d5fe9b28b58dc956126b67cecb9a145522aa3f86e
-
SHA512
76a267440d55dbd6d52a443952081af7cdb9fdd6dd74d789cfa200a436fef9d45154d8ea8299affb8255683fc39556bd3012c17811d8f12e4050bc4476445f13
-
SSDEEP
24576:n5IGnBE/ErjP1xsukSsf2jRuhBo54wQqHDtVPdJszF/+HEQcaR2z/VB:5IGesrzwDtfo54Z8D3dJsx/yhcaRkD
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0997a41c4f490624101c6715754843dc_JaffaCakes118
Files
-
0997a41c4f490624101c6715754843dc_JaffaCakes118.exe windows:5 windows x86 arch:x86
8e13e1dea397ab5c5826473c08f19e0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ