C�X�c,9if��'���!-\5�7Qc�Q~�ݔIn��_��<��瑡;uM#��4Me�����W�FJ2��f��n��x�x0J8��f��x��3|��ʋ������2,�ˁ��m��qM�0�'F`��^�w; �!i�'#��Q��>:9����s�X\AJ�X�$0|�r���/���W��m{����1�������p���@S|��7��\f�� �-!����,��f"�û6d{��f#K�� �eO%����}"�����.]�}��T�5����o⛟� ����c�a����\8��&9U8�k���k|�tA��s�1�u�!S���/[NS)D�T�� �S"E����M�������h��1Dܥ�L/ZO����EP��ڙ��T-RHc��l��w��,��k� $� $�# X;y���A�ޡn�0�����羶ˀ���d?1�d'�˘gx4FK���=9>����*y5�ʤ���P] [B4���F�g#M07d�,�#�_сZP�^����F_*��o�7�����a�6�IS��FHmqq]Y��qG�=gC���������3�]7' M'�<�KO�{n�@a��n�4Қ��PĦ���6���j���^d��8y���ẁo�4�H��l�ޭ�4n�g��гw Ւ��A��,2��:��p��ib�T\H�Mm�Rb���B��;����vExm]�|����C�b���`��)���N?�K��4a��8���O^���=��T�6�G�z�a�'[�(���9����.- A��|�9�i��x �LLeG ��G[�y�P�ӹs�,=ٳu����˧�3��j��=�kƀpz��Kt�^���}m���xT4�/dհ0�J����喻�\��/O�������e<�bg�qlQ�����GݢH�����ڿ�߫�K�w�K�Q:"ɤ�|�;�H�iO�k��3�����y�����A`�/�E�|A6%d�Ug�i�(�V���[z4YAÄ��(8핌9�u�Ҕ;���5��`r�k��F�9�ňR ��e�� �J_3�[�R���b�ڱ0���j�,��B~0����7 ��bvY�> [!�G㨐b�,9���� �[����^���gL>6��ՙ� Ae�EO�^7'���oMHT�c���7D�]Kp��П;7��D���ɥA�]��V�Eۢ��b͐- ��:�,���vrJ. H�r;��IX�=z� ���jگL �7"�����!묗ڪP2��`����*�Ma3R�����lC Y2xFeVo��YiQ �,ċ-�sR�3����#���~��h��c[mH�1�Zs�j�V��cR�eυ0���^q]�_�٢���_g(h�`Cva�M�G+k�&��z��y�+�.�W���[�MԼ�A��b���k��+V�2�� ^ӟM���j��������yΆ��I��V�̟i\�6�����-4<�犃�'��L�~��$B�9��x��č�0�`槶]I hVr�e*�e�l�� ��ǀ�tݧ$+AM�N��Ѷ�5�_���{es7'�#����}K��� ��[��YVƫ�o'6,R��r��v4#ҟe%6�>�輠��2�EYr�Dk��y/jJB�w��/C�ҏD�����l�4����S�a���,0�T��{�$�Q���XM����~#��*����I�w}/�+���X���:�(�������=�t�dz�3�%@�t4����E�mi��9u܉�/��'����x�E&f�v,V�a�J��X_$�\^@�&0:f������\^�XTb`�azH�ײ���cY��t����\η�E�QuM� :�����I����F6����k�{����v���� �(t9��W�vg�ba6�̐P��>~��?d�6d�<�+�Q�ܢ����光I ܵ ��z�����I�<�#��Vy�(p��U'�<���d\r��m�q��X�ݿ�I����h� ��p$ev[����1�bX=,������EQQ?�Q��ثW��`�mc�x}-?�|��/�R����]���)�$�.�r��t�=���_�*����ؘ-b �������sjf�7�l˸t<V���5�3֖uW�.⨇�:eL��AJW�%Lu�r��H�Hl�;���$�X��ٌ���˫��o��<4���>y�������%!�pi�;S+ =p�8�j!�Ii��Ǡ��8��]MFіq�؞�c6��$}I������q�m ��h1�z� �j��|7^��������S ��N���e�f6� rB�VY\�uՑx&����q�{�G��_k���É��\��@��uk�BqZ��T]|*�T�+wcd-��)��̾������Y�"��{���Sl��������e�^F�K@8s�ك|�sYe �`Y~��2m�c��ާE.NH���9q��t ��!2����P��c{��#X����|Z�T55��l�ƥ�O�p��e� �hԷ��@�1�__���%��"cW�#�Rm.fp7��VX�&ۄ'5����(v�Ӂ�b8I*�QH;~#ߝzmt5 aM��,{�ehmq�z�TR#�-�B��ACq��*T�S}h֔4��n�<� �O"l�Cf>��<����Y��4 2�@ejNl�R�˯r5 r��hNC?�j$�Dw��+و�\��1���AK�e�x74j��30*���,�Ģy>��nnj��L6�O�����TW�����ޙWj�ԯ��%��٭e���� �vd5F��tҷ4�����e���o�!��B+�N���p.��-����i�n���oŭ ���\f���[O'�����As���@�_6!�E����X��/�iT���:�|⇭�^�E����W��眄���r|fcz�����<���Up��)�riV�AE��O"����6&r�C����6=�x� ~T���[)Ӿ��qYM�^@֍[�c��B��I�4��8TG]��jֲdz�mi3�&��dl���Zr���)��X�\�H"iضbX�sM���+6Q�
Behavioral task
behavioral1
Sample
183ed59099f8643aa1850e0094c26b02_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
183ed59099f8643aa1850e0094c26b02_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
183ed59099f8643aa1850e0094c26b02_JaffaCakes118
-
Size
7.9MB
-
MD5
183ed59099f8643aa1850e0094c26b02
-
SHA1
ccf54c0945d1ff22d0fb469ff3e23fc4ebd1f670
-
SHA256
2eecb59f79775950a351d2adae88e7fa84b748b23a0f33170a340dddca8d4703
-
SHA512
f4445eb3a173ec1e21787fe3401e2f36ca498d8674c624f870a405d31ec87d8fdd46591f024cc633046a0b56862943138aa8b8be180b519bd8be15e3cae904e4
-
SSDEEP
196608:18aRyWWlff+m3EF/5REgACpLn8ctb0j6j+:uaRyW8EF/v/tpLjY2j+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 183ed59099f8643aa1850e0094c26b02_JaffaCakes118
Files
-
183ed59099f8643aa1850e0094c26b02_JaffaCakes118.exe windows:6 windows x64 arch:x64
728ea76308ec4c0ba41fe406723d0ce2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
shell32
ShellExecuteA
xinput1_3
ord2
imm32
ImmSetCompositionWindow
d3d9
Direct3DCreate9Ex
dwmapi
DwmExtendFrameIntoClientArea
version
GetFileVersionInfoSizeExW
ws2_32
ntohs
wldap32
ord41
crypt32
CertOpenStore
ntdll
RtlUnwind
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ