� f��r7��������{�g�Lg�"��.�.n`U��$�:f´�$��_�ɗ��[�n��U~���Vd$��n���:�L:�KhQ+$����g�X��w3c�����(�Ý9*��,鶦hy��=VP6/����?���2-&�1�R����(�6&n��YI}�']�g��X��T�6b���`V �.O��@�20�6�=j�>���Ĺn�~މ�&I8ƨA<�� bd��u�@���I�i�X�����E����9��>�lM��K��3E���aqs��*m]�ɼSg]��:m���J��F��б��掊�C�Q�{��Jӟ���OH��۫C��n��5�jb���>���'�Շ�R�F��B�5{<�@�.��5�(�v��T^C>z��t�B��?5�^�?��g�d���VIo)����!����4il�^L=�wQIX���@X{���{P�=�Vr��g���;h� ����j��6��x�a�}�:��dZBX�Qv���a���a��4��Y��� ��(��?��E�d��~p ��k=��"8L�� �=W/��N ����2��$��FM �@��4�ݲ������4e��"��R�U�\�7a��{�8�T�r�^MƦ��\r��F_�*Z���b/�k��IP��3�u�?�������rǍ u=���?�;��g'���h%���.���h��^���ժ>8���5�B{Z��=��*�Y���5�oVȼ�/�J*%$ċ(wX�z�)+��5� [�Q4��v�t�s��x婋*Z����m1������� U���mn!{��@A�Y�R/p�`� �W�g��@�����<��������W������Qj��s�a}8ޚ��N�ըD����)�R�e�Ω������!�w#>O�&GA��u'���85�L��~^��t͌L�"��XB!��X35^_�U�@RYv�oZ��1��I;q�^L��� pB/z:�]8�u(<֫y�ݥ�WI�w�CP�ɗ��̋�i���b��� ��VdZ����͟-����G�������8��"���� q6 ����9�H�?7-�7�븿l5�Q��*Y�Au��+ Qo��!�N�����VE&�t7�6���X�!xB5�p�U,�ˠ�S��'�-3��m�@R3�g�1�(ĉKt�V���b�!QR��'�8��̃�c�-S�0��j�X��X�� ���[��&�|(��!&]"�=�����`��k�G�4ͼ��� u� ϓC���e�{H����N��n6_V��:X�7kV����,�G�0�����Jj�_~Q�WO �.�=x SA���K6!Y-�e�j�~����M�*�������0�t[M��n��U����Zxg�Q= ]��3��#��_}�T�����1�x���*�&ۛI�ՔJhdz���>����6�2Vh��fћ�2�Wd�'�23�PH#��k���������>up��B��}F3R��V�}..�l��ܿؓ0 ?��l�N��^zc(oQ^g�c�����cU~��|�����F�f������c#�5+��`C#�8�d�������)w�hḽ�)��:��h���Zr�Aa��'ȓy�ބ�D�BƗ��oxW6-;�/hZ8%0�^��`�Uh��� m����A������3�\Ȇ �G�쭩�ေ�J`k�ihR���c�ֺԬ��x�}��s��UR����#%���-���V���@qJh��5x��Oҽ��a��d�g��С�O���zs���L�c�Z,�{��x�+L� v�� J���e�([���\<�G���Qv\Y�N.�����+]�U�X��M.�5�:G`��J9=��;�,�au-y�P�./ �(oHS���V�<�ܭ����A��xzbvYF�0!�ˀl���=��O���ߡ��K''��Σ5G �-wf3;i�&y���0��$*�ZBݻ�wN1>���JF�MU�������Sr0M�g<����I�A&{G��vf�_�K�:���pW5�O¼mf����s& ���$��?���}.��4�8����x�Q�F��!TX��S���?�y��CZd�1���"�� ��w�Q5��ܹeԺw�IC1Dޗ���ᗪ�����v�K��{n��a�=.�����S%��Z����֬������J7�azp��S/D�3d���S�y���[@��]9��Oi�, ������2m� �$͟n��%|�+W�7�Y�U"50���ׯ��_�VE�"���]�j�PC(�S�y���l�\' S�R��ȣ�$֛e�����VR�T=�к��q��t���.{�6��Z7=�`�}�ȇ""�����G�k��i��v߮a�?M��m��,E��!�����W<R�r���:��^�u�Q�N��%k�Aϓ��)-���ᶜ���xLL{��7搹#�ڡ �ƅvխ�btYM�p��=,9)i�eA�!�Tģ)ލh���K�,��ԗ6YR42��\���5"��C"��u����~����K�Y0߳J�בe[s@:4�C"��_�X������+B��|�#Y$��-�2��l���4���L�1�4n�5��8�!AϞ���-��`8�z�(U=7�o&�@I��䐔$��~�P�cn)�L�I+x�� A���)�����Lr�Gz�ݚC$� ���Q��H���[�.�l#�ی���34���?�4Ҿ�Bv����I��E�)L��Ȓ����du��lW��\l�� Â���G�=shA�c����>kNP˞JGN�I��~߫M.�� ����ؠ��&1��η H��5{8�Q�A|�G0^��{���H�z�r��x�����o�\���s?��֙�!R�5�XN��̂{��H2X�Ik��[�Bq�]%��>�Ш�s<�ow����2b�z�m?�����$7�0����>MA����J�������,����8K�p>�G�[I{E�J��t��.O��I6_�{� 4���b�'!R��1�{������<p�:���a{�3kUWc�:����ޜC���!\�B��g��d�$ h���$�
Behavioral task
behavioral1
Sample
22483b106e5dcf0429f0872a34e808ee_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
22483b106e5dcf0429f0872a34e808ee_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
22483b106e5dcf0429f0872a34e808ee_JaffaCakes118
-
Size
2.0MB
-
MD5
22483b106e5dcf0429f0872a34e808ee
-
SHA1
86642b0ff8e9f8a1f5c905122f9e50f827762125
-
SHA256
fcf4582fc6eaef250d2a802906b3cab6536d35bd99b6df5ad726dcb512fd82c0
-
SHA512
f06d95e52ea6b1ec29b8ed72daec4a53286bd0a3d4c5f0ade9ae0276a105f211cbf8795142ba6cd55ffa96aac0dd356c95199f6a3ee39471bc0ec8dbcc0c9b6e
-
SSDEEP
49152:8fzJ4ZT1HkLk1b2HiSCokX9rBNKLCQonWd1VhOI2plNof:86ZRCkxkiSxkXh2xvhPGlOf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22483b106e5dcf0429f0872a34e808ee_JaffaCakes118
Files
-
22483b106e5dcf0429f0872a34e808ee_JaffaCakes118.exe windows:6 windows x86 arch:x86
0ffe86cfca688a649b99611cd181861f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
CharUpperBuffW
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ