Wɗ�a!Ϸ�{4�+u���b����gedz�� �U�Z�~J���t=!�f��p}���������Y/N��mm;�d^|�'}T ��� ����w<ӆT�$ucG_3�~��eP��jZ>��!u�4~SD@AqO����ߘ�tL"jѽ(wQC/�8����߯�1�;|����v��y��H����R�\���=�0ל{��XHϽ���s4�Q��Z��l��Pri;/�U�����ʜ}�W��*6e�m��a���:EE��8�'ךY�LK\{��g��IJUa���_�+���!�W��%D5�nfn��T��'���0����t9�p����ɗ���mn{1i>Tr���SR�(�To��G_��� �"T1 ���䮨�S��QL�����dU�Q���˟�gc,�?�,^�;��I��,I'�Ϧ�\�Y-1ƍ�p�PH;�%���-0�4�̞iƽi��ߣ�![N!��<�JL[��Q��Z�����q�e�����sE�N���4��h�� �oI�lbI.��9�=J!�x�Ӌ�0<=�y!?��,c��+�% �MK�g�'�!��"ٞlh�B���x��������|��� ����$����{����;����xF��]q��sgke��G�8�1�s�iEѳ�a���t"υḧ�$���}Y�!�w�W������3jP�Cn�ը�y���*�l��=$]�?���F�� a��,����O�@�N�@tjX0F(_��\8/�7�x�o5��,��Z�yB��_����bW��k��%�.��O�â�S��T��F�`��b:Kz;F��߶#�>����_H�=��"�m8�f� {��9�~UŖႯ{(n3�"�5�yi ;���7�]�6a<a�%��V�qJ�"6���m�g�I39K.�M�9V#�]�|U���!)���s�I ;�}�'D�#�EO'�*��Zk��x��+����aTq �B�.���m��9�to�⼜�G����yy\��=��)f��9������̟͜m)�UGG�Ĉ��]��~��d|���K�V]Cv�Rpr�4z���(Q.���=s4NGH���ުG7z�\��E���- ��R�����!���V���(sr�)�l�9��Z)I�Dߪk�A����(6z�j$��Frk�=�T�L��-���v���M��U~���Үc'BS�x���:v���VnF�v�F��E�"��i��T���j�@ײ�� 5�0��Bb-��<L��� y.����c9��ʞ�xn��Y���Cc���������l�Ւ����f&į ٫���s��ȋs�NABo��g�gz 1�'="�/2�4��̒����ĉ~�J� ��`evL��B�C�tm��-!��7�n�V0S4Y_�}�4���k�ׇ4c5\�jx�.�[lZLG䩧�X����X�R�����O9�L&"�GE> �K�Ke�<��7�'g�U�\ �y��b�SL�g+��� �Y{ ���)q���U�� ���U^� sRT(<F.��<��4 _�;�����UO���@�쨟�.��4���^UN?5%ѱ.JU ";~ 4ȼ>�/�����k�8_�@�ߤ�FŐ���Z���Zg*Q��A)èk��4;� Ym �S�f��~�qdw�����w!��¬k��"f HD�C�ؖa��wtZ���m_�����Cm�P�]����R�����4��>�v]��b�����J�^E`��d���'LA�m"N]�Ⱦ;�1�^"�g���@0��J/��5������?˺�Ja0�x�WC�S�A5M��TU� ���f����7O�A���<i4H���6%g���(8��+��Js�@�+ �2ld.�����O��0��Y�i�_� ��"d�+�F���Űy?e��f}���V�.[��H�8�D�q�u���ǟ���9 z�����Z���0�eϹH��z�f�\��ۉ�X�����M�e�7��L��y�7Tw��������R{^'0�P�ǹ��y�;%D2�r5�Kuf$Ҁ*���H��scZ�o.������o����q<u\D��_%<�J���� ���"H �֑�0T��!������Y�@f,���r�j��u�wvuA��ϩMs�Q� 0*�gY)�e�r��9�U�9S����O��qK@:L#ր��k��U���+( ����\���w�8-o���~�15�E*����ؒ��yM���P-f��~�����3�H�95)���~��A�U���F<'#Wiu�͝N��s�gP�DQ���=ԩ_�+k��зb�إɜ����76�4�<��(E2����o0L4�i)�X,�K����=��_|�4f������o �����?���_K�l���X��{5%Y�ٰ�8d��;���{N+*r�x|s"��~�FZR�v�,��`B�ܼ?�/��K��"�9X �I�d��\̈́h{H<Ebo6����ǀr�~.���.0Q�4LS�a�9�#�w��P�k �D��a�|$��Y7J���0�+Y �r�����$�v +F8Nxc��ǔ��`������o��+8�e��ִ�4DRh�I�HE8g,�� �������怬�����U�<��R�Z�����u(�%��G��F���v�/ĸ~���2z�Q� �mg>]}�_k�9!�-����lV R��x��Z�����n���T1���yj"�Y.oS@��}[m�S.t�����F06'���<�8��Ѐ�^�9\���y�2'B�8 �:���8����s�p-��m����q�c���76;_�~��fXJ�O��q�� Ik�����f+�OK]"Y8=z�+p'��r����K]bK䬟��"_�ђjpc����[�rM�z��.q����-� �R�l�E9���.�4�盃�A �`��G&�5��t�� h�i�PP�d��z��gS��8[ʙԫ�|�Wl�6X���as?��2Ξ�Kl#��b"��s;�F/��O�K�*/���d����eP�D�z4�]ƈ���ToƬ��'�
Behavioral task
behavioral1
Sample
178bef5e8aa29a1f460e0edb247f3892_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
178bef5e8aa29a1f460e0edb247f3892_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
178bef5e8aa29a1f460e0edb247f3892_JaffaCakes118
-
Size
5.3MB
-
MD5
178bef5e8aa29a1f460e0edb247f3892
-
SHA1
c5b578ad16109aebbc99dd72a551b734b0fa8e9d
-
SHA256
b405cf6980abcbe77158ac9c5feb60df7bb27e054f860ebb20945b8ec5046506
-
SHA512
ff0c440073be426501816b116f460f22d9a7a02ababd7be018949a77bf11cbbe634a62342217fd35f01f53e6d594b1f97da53fabb3946ec6c9283b9e3cc37c54
-
SSDEEP
98304:dRM8Y1Qz4HNa2bG2tUMj0MDdtBGrBT5/GdEM1HFCXM12umMAVK:+O4HImfttxJvGV5edZvCS2rM4K
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 178bef5e8aa29a1f460e0edb247f3892_JaffaCakes118
Files
-
178bef5e8aa29a1f460e0edb247f3892_JaffaCakes118.exe windows:6 windows x86 arch:x86
711951fcb88a8f150296d21e06600140
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentDirectoryA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteW
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
urlmon
URLDownloadToFileW
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ