��6s�A�=�$j������D�" ��w�]��膧�(���@��*�k�s��F�IR4 ��GQS�wYN������cxh��Z]($X��m5�B��z����KZ l���ɏ�n��?,:���A'(�������H_����)[�� N�S� ���+��I��\#������s)�[hc:�؈�����u�M�8fI��aԭ���1��9�%Y��y|j;�D���p�A«�S�3�f�F�#)K�� 4А`�`��J�-xY@�EB4�3�p����Q��,��$F�!_���>I�]]J��������k^����ܫ:1NE��S�H|uh�f�U�Gj�>M���]#�]A?�(��#�Y��;��rѓ^���T�lk��^%K�POB�-�fG�����X�2M��fG5�b|dNs����W�����M�F���!�0}^�� t�X�n�j6:A���.bMq���9$��%�S6��X�օ Y���)�ZwDq�6��ݻ.�O��{�xƝL�m@�.�]������p7�za���L �a<�VQkiS����Qs��>��s�āt��aӯ�/)A���}��Wv�M����iW_98A����Ц�x䒩�{?I�i����C�i�O��I ���x6߸d������^�7n�7�����Ȓ���k}������Pgq.�d�K`�W�Ν���@�®���<\�عL(�ORS��"m�Xx]�� L��y�㿌�'�d��Q3p�O�W0k5JϏ�������Orm ��sJ�jsOI����~��~�p ���+�Q/�[��e6��y쯐�ud�fw�9EFݠ����y�z{CU� r���^�� +%�9&� q���c�������d�酹!W��P/�a/��x�X�=�+1���->WW�w���v��iG�5� �V�<y���wAz��B���0���tA�^-��5�t<��Yi�q��3`0??�_�{t�F�k�q�О���@d���0x�>="xuç��rL'���ө�}[Ƙw�� �C��*�pM%8�k�ˉLX��6�i�Ǒ��4~,?xO���q�IR��]! ;/$Y>��� N�!%�`����4�T��[���'?��;9�9��[.JE��'^k�8v�5���jy����C�����j�ND!�x���9'���[H%�3�Q���ڔ.N->����k�,w�4��~�� ��F��������A</5 ��@�����Q�b Y�im�'M^6���'��b;�hH���X��c�o����?P�l7{U����#�������*�K�2�J��%<�|�<k�͛�\� ���y��XW�����V©f3�Ney�� �o.� =|1�=���e�[ư���z�G�����1u}�j�^���G��kH���W4{�Y_,�w�J$��T����2�v;��������Y��Fp~��Ѭk��s����|�"d����/"�ς�I[�E`��l���O���g�ߛ ��ni�re@����!O�0�P���b2�Rg~��,4UYZj5�ی�= �W��ÔF����E���Xv��z���X���.V�>�vH\��?)��n����3�A1�:������ �w��������W}_B=;�Q�U~��B�ɾ�3p�k�l�N������OP&l��?��p?����qiy��&`��@Y0J�:������e��߆j�]��V�5q����{��컳t%<̦�\�wbj0������ ��đx6���a�W�����`:b8h#�o���D�ix�+��b(�qo�oY�;Dhu�ũ�8���(7˒4��?75�?U`E�t��i���f�"��T?�z��>��|G̍&��T�<�����%ƼBRa�%��q�\Rd~n\�����%:.���c�HD�o�;ejt��I����2�h��/���E� �9r#_L���E,��%��4ΜO"�cb{��T��.����1ޘ�;��Z��r¦�i���.��j�N�K��a9M&(�٢�s����g��� �7}�9�2S�����Ѿ��m1�q�Y��)3��|切����V��UQ�bB@�l��T�)����%< ��i����PGh�`�����!aw� I����8�!�Gx��{I��ι ���]�[93|0w!r�H�>i�՝�(S�%z��'�t��n�oF��VTW�EF��6=G��^qC�*���6��.����%���ǚ�>��-��7e�8���9�t�{�k:����qYSQ1�n��u��՚R�����L�%���,_��_{���-8 5�w�(Ĉ���+.6З�m5����h��t���o"C��%UL�K�`9i�r�AQ�ưE�`@Q�ӉF�mh�=%���(�]��8B�ʕ��<(܆�N��h������1W0+S=����\��&�Vc��?����QO龓=%�ԡ?C�#���������h[�e9��L,�����7�X��s����̥��a�xE^C:R:�b�/=*�����#{⼯MR 義�y��g9�����s7�*�LRc�ALZ8�2�qiy���;�?i⇀m��0����L>yπE��?l���G�ӭ�xS�a=�@�#xT�h��vS?8 {�`7x��suEeO��ʼr��<Jz5С�s+9EE�vN�2����m&�C��PXF�P���p��H�m�`��ax��5=�L�]y����%�x��<��٩;h�c�S�T���ْ��Br�pw k��KQ�����a��V�,�*��njS��(�ɖ�BL�D6. T/pR�=`�s9`�*�*|�)�rf�Ppߊp1���q�C��q�ß����cPg�?��O�4m�'=¿B3�h|�T(@���}�ף��@o�e��Y��ue��r�Z�T_��h:���u�/�l�p��.A�rIż�r�wA_^=���D���k^tAcٵ�[�`�=n�N¿!�O����*©��_���4��Œ�ǘ;�}} �/�����c�,M�| �sq�h+�����8�ɜڭ�W�}(���r~�3*pxt�B$,A��`oA v�|���O���qY �i�j<f�LԪH_�M�a�ͳ��r
Behavioral task
behavioral1
Sample
4ac94b06e380b577f7d4316481332d8d_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
4ac94b06e380b577f7d4316481332d8d_JaffaCakes118
-
Size
3.9MB
-
MD5
4ac94b06e380b577f7d4316481332d8d
-
SHA1
85c6ad1f0e2c6247c3186f1b478960b912001776
-
SHA256
31de76521568c29c32f5c5b31b4ee789f0739f6851d6ebcd54160c0b58f28a3f
-
SHA512
8f72fe441d47bd3b480d105b51d6b3e66d7844017a1e7d2d0d94d6517547aff8a2bf27de79a302b910407f6120b3e9b1a541ac7eee37a2a5ba08d9752edfb463
-
SSDEEP
98304:udyEYOmuG1y9gYJBY5+e7yJMGo486P+ftBkdiVCwYqyQud:ucrM9gI+5+0yJLD2tBkdihwd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ac94b06e380b577f7d4316481332d8d_JaffaCakes118
Files
-
4ac94b06e380b577f7d4316481332d8d_JaffaCakes118.exe windows:5 windows x86 arch:x86
57d149715fffa6065670a7fd48281ad5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
waveOutUnprepareHeader
ws2_32
recvfrom
kernel32
GetVersionExA
GetVersion
GlobalFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetPropA
gdi32
StartDocA
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
LoadTypeLi
comctl32
ImageList_DragShowNolock
wininet
HttpSendRequestA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 907KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 529KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.9MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ