� ׳9Ch5F������{=]jj��z��2�7遙����ۼ���e�A��Ӗ�ͫ�Q���eb��\"��B���EW��H��c�w�%�T7 R^�Ƚ��ǐ_�qZ�wsBh��_����|}�n*�)q<DJ�Qf)��KG<)'3:���^Tѕ�^���R�d�f���?��PO���frq�k��?"6���8X�j����#�T�YȕYO+�W�lT��g� ��9�:4��AO��3��Џ-ˮ%�����S"{PܷX!҂5lI��#�s��H�Q}�c�<%8���������KfA�;����dY�d]����*����Qc��?\}'���������ȸ�R���xW\�{�kEyi�ŷ2��97ãcrL�2��<�|O�I�4p��=�-H<t*_/YTnLd�@k��(��#2�F=���:������ʷ��i�A���9�P>����Vnԇ8_�5���s��Sfqw�O�Ì�Hij�X!�9���>;�OsLĕ�_�V�Q ^�~gM��@�TNJ˱�c��߽,8N;��)@�iZ=���iT2����%+������·�e�=�u9����o���U®Ng�k��ѧ'"��Ǎs���%]�Ủ@#:P��f� �����Gl��L��B����U��@?����zN��̃��dX��r��"���Fap&�|�|�s����r��z�(�� ����RU,昨WA�9 ��V ɵ�Ql�UP4��6)������>����>�<�7��b7c�Tm+� ϕ��~�'���^�]�d'�DKJŇ��!0�����>%OB��c���:���X�'F������Z��T����v�og?G���$a�"���C�:x�k��l:Ծ�{�m�B@�%�U��:u� >�ޟK�c�J_�_([��N��7�86�_0�1�i��oY,�K�h�yh�_|8� �� �6D�!��mAB�m�/��'s���P2�K��� �'��ך�W j*�L���B7є����fk(qxSq�f���]�c�9)re�1�J�6���W��l�vE��%pj��T���! V���ݍy8 .�����L�D|0��C����qI6,��<xū٤'�Gq�-����,����4�e9��F}����8T�R._^D�9W���飷��̏�n7_�-���Z��1Jyq�d���}�K*ڷ�R���]��E���[�s�\�N�U0��8���)�`�Xtd�YV�s����q��<֙S��+l�ڨN�A;5��G� ����ˡ����ڀ>k����3Q�A�t��I�^��Iu�SL�E��o+x���w/��c�q�zA ��^�/�m;4h���ԋQ���^f_j/�<����[���swU�\i�Z�%���Uu~^��n�i�U!̈��({_���R� �4�T��}�'����a�cΞ�2\g�8���*ٌ�߸L�4��5����i��`��AjK� ��=E�Ә]��^�4��%�&����Sr��b�b+Y.X^����l2C��ܴ�4��5]��V��L�T���N��,��խs����b{����u?I����P�I���ӹBNv������x��{��b����H�e��ߡ��>��tɛ�U^1���v���R+�e�@QfI��œs�1 ��(L�����po���Z�ω�ɿ�0غ���)Y��z�Sޑ�#cI�"[�����+ŀ�Bt�����2}"s�s[��䠎�4�ܣ�=��{�����iQ��s �/�d�� ��X�.�=ϢL�-�����J�d�����]ٵH��j� ��d���ħ(/���p�pp� ��fG����UN���E��}�n�]8�5ؔ�羢����mY����we���Ww�tM�Pz����:��[����2Yc ���~��˛3���g�e��]���C͟'��d��w� �V��ߒ��|B3Z~��K����|]�����F��%��^�8���x"H��M$6��Ʌ9+��2���F�M�r�ķ��Q@�l�ң���O �P��r��ɔ&wҍ�E[y�w�&T��BM\�ؗ)��B� ��$�j��e��Ġ)a4�g�J-g���AHv�DBKe]���E,��a���SI"�ob�_b�>n�6���Z�Z��DV��Q��j �7���S,���f�D��PJ�:�%nI�Q���lFxt=�N�������ZJb���5) �2lN�sJH��7/�L���m~��UTZcӆ#3����܌� /�:�ڃ�������cL��^V.����Ӄ��������K~��|�tA��@d�<N+���L���OG_�k`*�&�b��N���0�j;��6��t S���2��H{�A�����m"��wV��8�J��D�.�ű������c�_��7�"RO�?"���I�|G�������E(�$��WVJ�s�`&���L].�$���40�!�����̛� ��3�j�G(,i�#��V�W� NTq�+Ƅa�}�<�ۂ��1M �� �ǝ���>\6�K8q.ح�(T�EE$ܭ�?����:��A"��!HG�V������.�ZHvy�u6tW%�\"ț�o��O�\���_�_?�<�x�_+���:��?Z״K|�N�<��~�۔����+�y_��0���P�� �ꤖx^Hמ�N��D@'v'���8���@��<c�(f>[��B�W���\���p�cUt8;k�e��G�fؽ$K7��n��>�0阩�|v�O�n�{@2ŗI��盱'�����_ }��E��͢�7��tް1���o����Ar��t��k� 4:�{�m��� �C�o������6U �{m5�F�i�HX��c����}-D�8%W�iFUè+��<5�с��m���Mk>!�7'��(��`��R��E�4��FR�ݡͦuc��G7�1��^\V�}�7V�S�ēP��M�d7��P�Y���:����g���69��X�!3�����(UcI�2�L�z���� h%��
Behavioral task
behavioral1
Sample
40f49c04ebfb0d8f31bad78315071a23_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
40f49c04ebfb0d8f31bad78315071a23_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
40f49c04ebfb0d8f31bad78315071a23_JaffaCakes118
-
Size
4.8MB
-
MD5
40f49c04ebfb0d8f31bad78315071a23
-
SHA1
3311979c72035f3cc5c4c18b8d29ff119cbcd7d3
-
SHA256
a9a1ec2736597311a486602fdac450ea79eaff9f5002158958459b6dd3c9a156
-
SHA512
b47a2830d24e3fe3430a082da5f6e1fe10612288038faf08d809c2b87595a7473c81d1e01f5e0f67e95b69e6bb5ef06e880f2b56a826369ce89e0215feeb86b7
-
SSDEEP
98304:tS6XL2AMOV7CAQvCA9YNoRu3Z7mWJX2hMlT4Q5vVjyy:46XL2AMOiv72gI52CGCtyy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 40f49c04ebfb0d8f31bad78315071a23_JaffaCakes118
Files
-
40f49c04ebfb0d8f31bad78315071a23_JaffaCakes118.exe windows:6 windows x64 arch:x64
a323b9908f20577d71257a4afd39e33b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlLookupFunctionEntry
kernel32
SetUnhandledExceptionFilter
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoCreateGuid
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
urlmon
URLDownloadToFileW
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ