�,˼��xIu�#��^�X���d@�q��a~��8l�lXA�x��{��ɴ �TL��`cЙ�ؼ���{ �֒��~sE��m>�f�G�hq��R�QʦKN���$�=�3��*�;�����_( ��>R&ۮ$$��_ ([�&���t�"S*������;��H.bFβD�D��.�R�@��9��&ZͿ��Գ�����D7��:.��^F�C�CZ���c�j���I�[�i�G����s�DR������WX�1��Ԫ����^���vi|%fj����"���P�k���G��e�k!p�5�(�P�\7G8��iGB]�2�<�У�l�;s$v�K��:JWfMiQ�� 4#TFTy�ay�� 4�N��h���{2a,-/L2����56$"���*LŗІ�T��W��ib[ ��#,��$���~���î����x)U�>�Za��)ʏd��Έ�>k8�4~şU�C���Y2�Fժ������r{��������Ԙ�$D&�*�����ܠϘ�Ю�G>A�c u(f�[�g?r�h��·ZҨ�-�Yx���iA�c�D����%�?k�����`$�]�٤n��w�S 3�>���Œf8a����od>\D[ �:wt��9���|�^3�Y��g�tI�f�<��$´5��e���o����%�/�`��F�(D�Xg5zf�,)Գk���"x��x�[T8��M��6��i�8���*-�ϵ����odl=�nq\(�Wg��ߪ�΄r��h��"H8���˒��W�iY�18���ѩ�� ���G�T���\��?��%�o{4m�7R�&8����TX��N�N�n���£(��;E�!�� ��D.��}oBn,g�"zW�4�e���cZnd����ǻ�+QGd-���l��_#5[�B�1���/3��,��9��ك̠���� T�*�18��8}�0B�e�ݓ�j����f�aE����{����y���ȣ\1���B����8��稗�7�NO`n@�� ����:�pC�7ؑ��D�=Mj_�5.7�� *}wg4�= Z�x���-$K��\�5�u���K|��Z�b�x�T��A���|�]��^TF���z*]����i�1��_��i��� �����_R�<���ڹo'�w�A�Z=a]�,�X�2H���I�9,?9�T�D¢���\�֨��Z������. �����������t���L�����s�����Ɇ�Ryr�\&�n�!w2�����C�q���r����7U ��h���0�#qW/ T&/!'��J�^4u��GhM{�p+�ܢOh-��;�[�f;��5W)�Fa� i@#�IT1�g��"Ҍ� �P9�j�YU�B��D��ԟH�;'�z'U��� �4�g\�V����|���c�/bA�}>�T�T��8І��Q9�� &���R;e���#��R�8�[#÷z`������.X?e��/��� -Pb���UA��ً#L�cO G��E>�u�RS��)��b�-���q����3a���{��iJ���>������S���hׄ4O���J␓'>��N>��|e���b �Z$����˷�Y㦷��{u-�����|���ϋ܈�1�_� -��x���u}a�&��W��זq�ܘ�]���� Q�l3�̕��.ΞZ��Y��C�`Q�p�����Ur w"�$Erv |U�����;��V�����x�������*ϱ���袰��7�S{�=�>�%��R�)���,�|�@u~�In\�S��j���ǩI6��Mq����l���4�W��.�������Qr���S7֟��O�p��;c���q���mI\�i�p�;Ͳ��E7����?+���3ZKS�')�`�v���蒛����|��uZ>{���4ӕ<dd�Y�����ڌ�8�A��h?�x���i��^�_��ܚ��������K�K${�3դ��ᢅK���|&�y�!�?V����1��D�Ę�(B�-a���- ��ಥ[8�k� <���9S� �ZLG���B�|ǼU\'�I�DB���ѮL㳀���ܱ�]��2G���i���)���+>�D�6���b��?9��G�Q"��y�O�`d���rC\��4c])n��a;"���i�l�y�K6֙\��u��!��Tz�d��Z��J�!t��q���.PC�z��_�2�'oY�'����w|v��d*���z����<|@OZ72x��f���%%~?���*MG�����G���>p���T����N�Xӫ��@�����87�7������\��V�:��#9T|xN�tۓ�c�� �rFʀ�9��80ND}s��6cy?(�~���p��ur<?���QIz&�d��'d�����e��ټ���Q���� ��/#w�Ex�ѓ��Ӗݿd�C���y��ʖSnM�@!���c��C��������E�ac�L�{�Ӓ��'+�V_me}m��K����+%���~�⾰��[?dp��(��|W-3�;���|����Y��lMDu�/h���t��b!� ��i>��W5�Q��m�]�b�I�y1�\��#\Wr5��_��'����j��f����fُ�p�pO�}�RW�U��cufX�Q�;)�dWa����:gZ(�4#VY �!_s����+{����K)` E?�z��٤�d�L���+�U�����#����1�����;��+����B����1����&B<�*� �A�j�e��5�W�a��3mK�X��֎��*�����.�&�x��րz�������_]�e�ːn��)�?�hO�)�vzP>��"��?ZЗ��z&.�8��}<X\C�H�����؟�b��M�<NO��#!��y����|����ȭ n2FU̯t�����=�>���s�s�Ml���&b��i��,���]�/����?-��$~����=R����� ���W��Z��YB�vc�컭F����sH��_��m���0�[���Ph=�Y�I4�sn��Y����M��%�c�lp
Behavioral task
behavioral1
Sample
ǩ.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ǩ.exe
Resource
win10v2004-20240508-en
General
-
Target
973c61a9be0e1370b4eff46df370384a_JaffaCakes118
-
Size
2.1MB
-
MD5
973c61a9be0e1370b4eff46df370384a
-
SHA1
ec14c6105d501174285f91ef8659761642ecb1b1
-
SHA256
a186a6b2f2c13aee441ca1261a474b3183bf69f4add28cf7a076677ab6bf7c5f
-
SHA512
072122ae9909e27907591bb48d938c210ab141313c805cc72c61c562a11ddb1872e928621c38a9d321ed81063f96a7a39e2daa70020106862ca80954244d9050
-
SSDEEP
49152:nH0OgOMhm6Xs54OJ2pGr6oEl22UmIX6q7fWLKDOvvp3eaB3MbFrxCascVNgI:H0pJm0kvElthFXKSZeaG1CSP
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ǩ.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ǩ.exe
Files
-
973c61a9be0e1370b4eff46df370384a_JaffaCakes118.zip
-
ǩ.exe.exe windows:5 windows x86 arch:x86
a4fd09d76c54c954c03fb25ad25b7bfd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
sendto
kernel32
GetVersionExA
GetVersion
VirtualFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CheckMenuItem
gdi32
GetCurrentObject
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
SafeArrayGetUBound
comctl32
ImageList_Duplicate
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 833KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ