��t���J��,oL%g>�-�4�� ������\��t�概�?���m :�!X��N��?��>El���[���,�%�W���ޟ��HA���g�A`��qrW�4* 5+��҆�S���x���yo��y�~w���.����Xjt_)�v������%�(�a���=_����� ;�4��=t��R�Hŷ'��[�I��6(Ӑkɫ����,.T��e<xs����C�*�h�Z[���A�������d3W�N���W�_�!��On1=?)�`ej����X�7����s<� i���.�6�t)x^���� � ��I���h�e\O�Vp�`DZд�Ǽ�s'�>��� 5uYd;����$���[�91r"�yqW����ޥ�E[h�����wq��x��}��v��zW�F0t+�6�V2G�k-�s����H|��vc�SV��d�}8D�MF^����|��+�.XI�߀�Ȓ��*>�^r��M��4�����V\�2ح1X�X�Exi���/��K�:Q#�ry��t/�.A�����w-��\� �����"�Է{�eV`K�����q� ��_�����]2��Y�M9��'���k�2����E���E�;�jDfI�x<}y�A��U����cO�;Ȅ5�0��b9P��&��i�1���3�/�i:�)�_)b���L�)\�����B�߭�U�6 a}�����,�_��6��9���3o���ay�������N�%����:�����M��#7-��1����W$�����=r����#xd+�3{-GH���tV�:J��р��DM�U!j�2X��!Pv��f���R��T��^�l��=���(��-�i����(�.t'4J���>�Jk7*�=<�k���c�@/������J��8tD]���!K;�|��왘�G�iv8�AO����ȼ��Rt�'��-��z��dظL=WG�14=/�z�1@/W�n0�� 5M�z��p�s)���p�;�����iݵQߙ@��ga��f�d_�:��u�RF)x��{�3Q����D 19n�DTE�s=���Fwq��_����G�.06����6yG/5��:|w��5Kf��z ��ƁجM�"���b;��CO ����*|DD����".u����>� kI(�� �[�x<���5s������-��^o�)�ͫ.4#Z$�%s]�� B_%⊒F.�@Eo6w 9�0��i��a�Ӄ��c��d���8y|�Y���-#�}���א���f�8Hr�i��A2�z�kBԲ}Ʋo�n��=ݬR�����5Y�5�gw�'*�*쾜q�n��s�w���_��ƍȚ�I&?��ʝ��e0Ʈ+kFd�a���\ ��NPfq�"V)_w�Q�pBL��8�1�L.����1TU�|@���=�q��<� �F亯����1e���!|G%�"���%�7=KV���o]���7?1έ��3�!��{��&lˬ}��3�|�l��_'�ăn�L�L�0\�����(#��04"�V8K�ߡ��D!+�P�"E�ͳ���A�"w��V�H���o�� 0B��ރn8��N�Ah!y�0�\���.���$#����w��:K��hs�AX;�&Y]���[�U�ㄌ�^��'J���QX���y�w�?��d��K�������`��!���_�D���9��C!j���(�l�qG����H�ˊ8��V֛��);��x�cV�-�i��ů��oXr�*�����6Mb��͇���g���)�M3�A�M c7*�}��_�}�;Mh�������]�Z�$p�6y��M��X��ؐ�7�n(�Y6.��,A��b����K����εGDYI:�;�䧸�z�~*�B��� ���eo6&�Q� ![��u��K@,Ո6��L�:I��]�z��P�����L{����E���1-�$d[�7�A����fj���1Ko9�!�`l���e`F��� �����혷������R�F���!?D�H¾0y&���O��G�������w ���(8����:������W��}K¹o�@+7'�Sr�j��Jv��s���I{�R1�j���P���PN� -�}p�,�2�;4��O�Z��u[~���<U�pe�� m Jq���c ļ�X۪K�~L����m&��ZI�-���U�~�������[�˅�L�(ʾ"�:z�̢�������o،�\�$Ox�i� |P������q����!��� ܦ����Te��ua�@1Zr�����K����aF���d�ҿ7�0�e�_���ȫ�,x��kLù��O�TS�\��З���#Ò��1'ż�C x��/��@}��6�J�з���s�{�d��e� ex"rnr|�W�HOH�]�/}H�hH�����ؕh$4�f�M�m�x��.G���Zi�����G��ɔ���BK��a'��qMҊ���C�/ ��6��%��5|C��Fasy?����ظ��P�����1sm�ӷ��lc�pa@��%=j��ך�*/��V�O)�Ej�������m�AI�ɮǿs�aM�I�b��vc��v���=l�+����~X}��z~��T���=�}��~���*�P+1�N�(\?B�p�5�$�mL� ��'o��)���U�?���ܭ�s�����h�tE��q ��l��9 נ���Wj���Q� �����Mj`��f��JyC�r>��%��O�T��4���T �wz{��CkV�����.ލ������'֥߫+��oz��T��{s}j��f���9{/���s�^� t�&� 8? ��X7I�1�y�tE+��@c�| ��*Uh�|[-a�b|�+��zKZ/Vm_���������X��XJ�����N�>����0H=���*���R���'�"*7l��W���S֝8C��xgh>��C��j��*���k'L�������������8.�4i���-�s^��c��a�!��+eXUO�85wy �W�|4��JϢ�Ǩ�F���M����KɅ��Ň�BD9,W�|�k�H_��!#��[�Dp�^�w�arf�K��W(�
Behavioral task
behavioral1
Sample
457d29963b6b3f2e040dea65d10836ff_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
457d29963b6b3f2e040dea65d10836ff_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
457d29963b6b3f2e040dea65d10836ff_JaffaCakes118
-
Size
7.1MB
-
MD5
457d29963b6b3f2e040dea65d10836ff
-
SHA1
ec22e2699fd9d761daa838d5a8a21475bc081387
-
SHA256
917f6f37b9cb8495161595a44b1ec2fe35053b9f734ddefd78d9cfe5a50b86f2
-
SHA512
c6d77d6acba798b85c7ac9414b06d61b4c9234236e57e1c71030619b1e7e469f6ea0bdadd7ef9abc7be8cff1aec2fdba184f7290a1e83c5738ecd9ef7be3b828
-
SSDEEP
196608:PTGTaan4MQuQwOqUY3qMqEW8H6OvT7zYbAxycfHxtvj+jBh:PymC4MQVHYnHjvH2jcfHxtvCjBh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 457d29963b6b3f2e040dea65d10836ff_JaffaCakes118
Files
-
457d29963b6b3f2e040dea65d10836ff_JaffaCakes118.exe windows:6 windows x64 arch:x64
ca749c8cd75c2d734258f68093b18b08
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9Ex
kernel32
VirtualProtectEx
WriteProcessMemory
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32EnumDeviceDrivers
K32GetDeviceDriverBaseNameA
SearchPathW
LoadResource
LockResource
SizeofResource
FindResourceA
GetProcAddress
LoadLibraryA
Sleep
ReadProcessMemory
K32EnumProcessModulesEx
K32GetModuleBaseNameA
K32GetModuleInformation
DecodePointer
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetVolumeInformationA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryA
GetPrivateProfileStructA
WritePrivateProfileStructA
GetTempPathA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentDirectoryW
DeleteFileA
CreateThread
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetConsoleWindow
GetCurrentProcess
CreateRemoteThread
VirtualAlloc
VirtualAllocEx
GetConsoleCP
SetFilePointerEx
ReadConsoleW
OpenProcess
EnumSystemLocalesW
GetUserDefaultLCID
ResumeThread
GetACP
WriteFile
MoveFileExW
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
CreateFileW
ReadFile
LoadLibraryExW
FreeLibrary
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
InitializeSListHead
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcessId
WaitForSingleObject
DeviceIoControl
GetLastError
SetEndOfFile
CloseHandle
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
IsDebuggerPresent
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
GetConsoleMode
CreateProcessW
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
GetTempPathW
CreateFileA
GetFullPathNameW
IsValidLocale
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
LeaveCriticalSection
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
FlsSetValue
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
FreeLibrary
TerminateProcess
GetCurrentProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsChild
OpenClipboard
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
GetClientRect
SetCursorPos
UnregisterClassA
MessageBoxA
GetKeyState
GetDesktopWindow
GetWindowRect
SetActiveWindow
UpdateWindow
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassExA
PostQuitMessage
DefWindowProcA
PeekMessageA
DispatchMessageA
TranslateMessage
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExA
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegCloseKey
shell32
ShellExecuteA
ShellExecuteExW
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtDeleteFile
NtCreateFile
NtFlushBuffersFile
NtWriteFile
NtQuerySystemInformation
NtQueryDirectoryObject
NtOpenDirectoryObject
NtClose
RtlDosPathNameToNtPathName_U
RtlFreeHeap
RtlAllocateHeap
RtlInitUnicodeString
LdrFindResource_U
LdrAccessResource
RtlFreeUnicodeString
iphlpapi
GetAdaptersInfo
winhttp
WinHttpOpenRequest
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpReceiveResponse
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
xinput1_3
ord2
ord4
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 587KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 548KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 113KB - Virtual size: 11.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ