a[9�ɗᑙ"7h�,Ѧ�Hu��n�����v��)��Z��E>}ĄV@�=�M�����X�����{w\�ff����*�ٛ~wk��qJP�:Cz�Bip��ۇZ��z�(�[�]d��v?z�&;v�}�ݪ�o� $z��R����K��i@�aL��V1a����R�kQ�rd������m�-������L+by���LD]Ԍ��|XK���]tg+�]�e^����EW�6������ȿ3I�1���ɛ�W���I>�6>��c���i���Mg�N$�\���� /=�93�a���y�{�a.~�q��h*}3ZM)�O|$�B���] �4t�BOh1O,�=�S����e��e�>�A�����$eba1:�+7����9@T�5/�X��埒̿9�*���o@G���?b2�X��D����ML�n��L�|�pk��.6��u����Lo�g^��p鑙�����,~�Uf���L.��za���B�U��%���~B���LW;�C@�e>�e��+�e�i���%Ci��8*��l�ƃ�5;�"6�sְ���3�ZE0{� 3� ۑ^w�s Êޘ�%a+��S��.��V|�r>���w���al�6�C�� Xt�o���s:)i�2����HKJd ѷF>�͐x�R���k�������~<�t(/Z���~ �;�2���A4[�E�� �)n�uWb��qa*��AV�q���-��~�u�}P�B<��(~��_��&P^~�L ֥�um����>�*��>����=��嵼pA�=<�����H�������ޮVKԦ�l�Þi�%OL���$�/\����mk���܂�ܵRw����Ľ��Ȓ�����_�_.tW.c��),�p���c0jK����sx�LB ��)�� ��_��7�������Ɠ#T�$���BZ��_�0y���( T� �R���AC�$n�m����@�h������M�r�/��8E�/�:dp�7��Κ-�T�L�Rj?��ML��P�� �Q'�ߐ/��+9=U���n� �I6�oKD�0�>!�<4 X1r�8-�V�T��r���l��u����tUjC�9aF��)��uɄng��9tݵ|�c��G-/d�Z������]��2[>�eY�j��SX�0����ϱ+S��R�c���t�������T�N���h;8D��g̺{��f�}��!���˝�)a�$�|�{�~z�U g��O/��#J�~[����������0e�j��--_e�Ҟ僬ّ��=B��e����)`*�����j�v�Gq�>����A�.7z@�����J�w����� ��O�����rѡuG�T\�E����eM�O�D֗������l*�mfʃq���'�7��sJ��������/%���֗�TI�"� ������9�@՞�ۏ �u64M��!�r"$ǎ��M����t�LTy��e��+L��u��z�̭фt�v`�� K�h_�!G��Q ��� *m)� s�;Qm]!�_K��S)��`5�Rl��Z����Z��훜�<�>�t@A!hhVW"���4���PN��7G�t��y�p����P0�1���N�jB��yAs�a�F��IJ�h�H@*מ�<��u@�r��(Ev��0p#�[�o�����J��؎;N��O��r#�X��ZQT�(d�MZ��/�4ET3z�wd�T sꠕ{���e�M�ܼ5����%��2�&�����c�I; �"��_T�M�%$l0�x��ܺ�fA��Fa�R���a��\�8���]͇�,��~�/�G�s (�m�5�p���:4�; ���L�\I�VQ���y�k�)'UZ7��J.�Y�D��,����Y^��>D�n!����冐 �����Oa�T�q�z����)�S��z�L3�mC� 'Wͱ��$���m8���0�ᩓ%�!R5��j��{�p���v��4��4�#�5���fΧ�WO�6J����qS�ĝ��6�������v�j�:늣�����V�ʃ�@D�E̴��:���97�Uu��&����"��l�4�P K�� &��AsXU?CCG��+n��u���¾XD���!���o$b�Y�������6B=ȱ��|�_z���tM�����\�>�]\�Pi�a�c]g}i�?�c�#�ΐjk4֤b�H��1�{���-TMޝ�֠9n�N�y96:s��W2���j$9�~6. 7��0�ލ�x㖉� ���j�D�%E�ĞA����l��2�v��p��ez0�M�'��G��]��.��JI45R�l�������ӈւh��s�Rܼ�$�(�W�N�A2I,�#y,���N�`=�+ㅴ��'+�)��UU�m��v���f�F�UF�%�8,Wn�] /.��u++�0�.mAk'��ڤ1����������6 ����E���&'�����\� ����z��}��FȘk���V���q���o�Z���VK��U���{��/�3���}�)��@���=w[���=[�;e��Q��Hq�5�]�(�w�&<�\��9���B=��~H���PV�9}q?�f����8�g@6����q�My�����w����, Lɾ����d�R6�o�>��M���>��7� �Ģ<J~1(X}G}$�'%����?��_�U����GҔp ����T�C��7N��S�q/�/�%��Q�`�{�t��O W�����b[�J"�#Ɯ�4���������:;�Q%s�dQ[�Ւ$/������Yg�U ��W9{�[��-��Vq�j�LT^%�P�Jn�?�6���Z�����.*q��U�E��-��,�w҄dN���!J�����l�d� �i��\<��y���\Ms |�}UMA �լU�;��W����l�P�eP�|���C]|2����ؑˠ��+7іY+*�y��M8H,�����#)����=�*��4���O��=���~��%�S�G�a�(�P]~ _�w��8͕�y�ۻ� �>���-x$M��P1��pB��b#�s����~*{%���.��0P[{��0���bM�
Behavioral task
behavioral1
Sample
3558986122c8758d539f230d9258562a_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3558986122c8758d539f230d9258562a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
3558986122c8758d539f230d9258562a_JaffaCakes118
-
Size
2.2MB
-
MD5
3558986122c8758d539f230d9258562a
-
SHA1
6de9710aa690b020c40c945901ff0e4c409e12e2
-
SHA256
baac1803ede2d2601ff58a603916e0e55a23c12b2358c49afbb8a13cb100ffa1
-
SHA512
86aaae73a2ffe83e96250ce9597acad6d8f5a728108ef4c1d8ed6338a29725aca1acb0909a1057d207e73a66e8e591d58a3c9a37b367ed9d12d2efbbe332ebdc
-
SSDEEP
49152:o+4InJLeXR3vtrE9K/3RmnQtSyjK0s3nd7vURw/Iu:J4IJLC4w/hmnNt7vx/t
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3558986122c8758d539f230d9258562a_JaffaCakes118
Files
-
3558986122c8758d539f230d9258562a_JaffaCakes118.exe windows:6 windows x86 arch:x86
bc02dccc60c4d5bd2f27df5656abd670
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
CharUpperBuffW
msvcp140
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
vcruntime140
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 925KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ