ןOf �Љ���-E1�����y���/Sl5��p���oa�w{3���!�:K�NXgS��&B�HV�u�7��t�j��:6⼅�_�Md����BTd�e��=**��a��˙� ���TH���g�D�P�$a�6�[�|d��jm1��ؗya�u��ϋ�eYAp��34�-b6ɉ��_�U��M�Wt���ձ�#����n�3��]��S�ݽ��筅��yc*s{L.����A��5�W^Lu��Bخ�?�i�\pl��C$�X��i=��,#֖��%ҡ��w�2�ysk��y��h��:j�����J<�8_�B.3l�@�k�l��r�4�֘�c|�W�)�"�$��Q���Ԃl@�[kƍ��*��؛�{�i�^���!�h�cQ�C2}<��?�Yo�`�e� �J��#�ә�)@����L�1Kz�7*|-�r� 6�F-���넚�&�2D���z��Ki1�������s Lڴ��y���9�D�EXIϝb�sHd�������<���f�Dp��;���/��t��ml��uH�Ɨ+\Ip����q+��?���A4V�o��v+�9���b&5��^����q�pA٦��i����y�E/I��(�_Ŗ���&4u���^d�����t{�!s[�}@�Cs���ňmv)���XF��Q���ݜ]��dž����%��w3��Ξ����iEt����m�N^��waLl#�^9#S��X�fL��w��j��&���=u�.}�v��3����Ε�f30���RlL��E�EXt8�ьC�Pq6��6B>Х�9]�~�$��'���C�;v p�È��ӖJ�4�O��XC2��yT�UХ�7�oh�ցO�������v��Ġ�:��p�E�J{h�${p������� ���K �+�l}L=^+I�J�$�c���- �x_0I:Ѯ�;}�������J̯�<�&ǧ�9x8�A=�p%������N�Q��Y�Eì�f�k� I����L- �� mwI�ʯ�}�q(�A���-��(�V��ڒ�����d� I������v� �biU Թ~)ģ;@�(ic��nyZ�1��3�1�M�О|�[y��֡SQ��S(��h��\�3�ِQ�2Օ*H 'X�݅F�zb)LM�ą 6������~Q+�coZ�U�l{��&OwḎ���o����9���{�v�:��ycp����%y�j�($��sjT%��;�]���`:�.C�CB�,�xOfh� 5�~�u�'Y G����ǿ�'�WMl�-s�eC�J �v�������h���������:���EiA^�Y>}�sNw�� )o�7e�2~�'�����S�����.t ��������!Ql[U=�"�K��? ��+Ef��ku����/׃�JYs��V#���1ӆ_;��du ��YY24v����߅��q�o.� B��4{�C��n6�Q����:,����m�3mJ��R���C4}C��yN��2����*��間�q<+3e��kjHmK�{��M�_��<�Re��T�$w�A z�1��$�`⮙>\��k���4�F��6Ij>�^s^i_�<\��vQc�]�+Z� �Y_~=q�9|�ȸy����0y�j��s�`�)[6�qu��gX��$�Ѫo�[�\m ����i��m�5�[��<q�UA�ho�S)J�������ZΉ�K�TW�i�k:�MvH�� �=O�`�.��~�F��ݹ�2�=����AlH3�\��ljಇ/��$�S��~!�'���$�g� .�ק�K(Z!K�Q#V�|�1** �'یy��nj��G{9�<��(�1�i� 1�� o^�S �-��F?~�~^@�[l8)�/ �c��X8��Т:A�"��C�����T�,��zb��I��qj��4u@�[�Y[+&�U�{�%I�ٵg�\i^�$8f��es���N6�0ϐրl:ܬ� אk�]R�SV�䈃gY_���E� Z��|;����k�Q�`��i�E��͑���<k�R9�w� _3��%e�ꡍ�N{W��2uZ�k�6�ۛg�������l;�M�g�*�H��L��Y{�>����c�#�8ދ �5� ;��XJ�"�D�٤+�("l���Ip���ꃛݛ��rkf����ǂg�2N5!=Th�6f����:$����6ȓ\�@v�y�E��O���d�x�7�cP�| +Y�X:,�f��mB!f��[1�W����E�&�l�L) E~Fk�{$䠖�I*��|aե���v]tۭ(�=��_o���SKW)+w��mv��Hyc{� �����FG�HČ'W�YC.��'�8 jI���0:���PC��xhᜤ��L�;���2��j��� �-l�4nsa�����9U�O�A�ТZ������h�B:��"L��s$�ON/=�n�(u��Kwq���(�Kᥭc?4���ثvV�(��01�SP l��N>"��N��������_)aa�XhS>?��~��+�9ܴ�b�Q����4ɇY^�����J��S(~�1�<J��[I��hb[����x�!4j�_�7 &��,+�K���j�1Dk��gژ*8$������"��%�����88?���E�k�|�yD��#�i�.p���?���k��#o�D�=#�Tn����]��<Ah����W����"�ӒWڜdPZ����%�L9�Q��H���-� #�H��o�6��0�nM�'�'�Ln����k98#����ϻ~���?�M��%6����U���ԇ��#������j(��>���^�c5���M�Lq�g`;��ڞ���L&����H+2�J�"\��.6�)�������ǜ�/?��>W `���nH�6�`6h��,�H�{��`����?E��Ǐw'B%�N4�E���-�]�Gl�F{W��1��D�b8�]l8�@�jԒcMMa�˦��M���}�kF'������j�[�'k��2��_˨�4$A��m19�uF�t�u�*8h6)�������S��@U& ۆ�G@%�����P~γ ������͘��)�y�y
Behavioral task
behavioral1
Sample
394cd0d1768d2bd339dbaa706fecd20a_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
394cd0d1768d2bd339dbaa706fecd20a_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
394cd0d1768d2bd339dbaa706fecd20a_JaffaCakes118
-
Size
5.3MB
-
MD5
394cd0d1768d2bd339dbaa706fecd20a
-
SHA1
76443441e41569c6ddf5f43d1051cc1eee473148
-
SHA256
e6eeded081cf80f91ca00b55ad3088c6a6550abaf84c16dd17d20bad5b946ed3
-
SHA512
1abe1c0938a179650caf8ce60b32174407ca6566975e24b79c2e427c024d2dfc90765c9c5c27a297dfabd755d3df5af9349c335bc792558636850ea5f6a4eb96
-
SSDEEP
98304:jDL2yWQlwHwPmiE+E+JIn/+W3i7ptP4jAJggEYKTud10ZuBhRbGa9AbY5:SfQlrmi++JC/y7p1qAph0+RbGa9Ac5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 394cd0d1768d2bd339dbaa706fecd20a_JaffaCakes118
Files
-
394cd0d1768d2bd339dbaa706fecd20a_JaffaCakes118.exe windows:6 windows x64 arch:x64
326e484787b83cab8a98fb3824d799de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
CreateThread
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyNameTextA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
QueryServiceStatusEx
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
winhttp
WinHttpReceiveResponse
imm32
ImmReleaseContext
xinput1_4
ord2
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__RTDynamicCast
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
powf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 453KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 491KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ