�5R��ↁ�[�(��a����ݔ6��������n��d��R��p7���d�>�@i���E�ul�ٲ>�0���l�b����3#�-��q��nv�\1,�M��@��t��kg98�[��67��>�#��������q~c��S������(�c:��� ڔ��K��M��q�A��1:x�T?���G1:6�z�X@_3U�O(d%f��b��Ȅcq�g#XA_`�y�M��sF[2�X%�̒��V��F��l���H�S@�kZ4D��?/�I0{Ԇ�{�f�5:����)~�4��ڦ��Yf!�p�p�9a�7@�����g#8�$�{�%O��䞠.�&V9������h���m��v���><lV �j��wJ�'e�kg�-{�b��t����f���=�x�X���Q�je4�mc��1��اO5XdU�Z�#�h�+\ͦ����`EQa��!�# x̗�����l]��08-��2��Á�U處=�^��,�n8�z��h!������DUZ��M¡gGE'obzW���� ���m��C��jU��=�_�Ǹ~3�jv_c>���\�}�95Tk�'�}<�V��T;�2�.��r���j8]��Z�z���^����GU�M�{�3���p*�.�����fZ�vH�k��OO;����o�>���ɦ�$Qmx-�*̫8T�^�%˿�p�᪁BY��52�3�N��F�3�i��5�:>ˤl��}9w��65��M��l��{v����/�LDS,�}YK+��B�*��Z�'2x�0Bl]�@`nETj�K8�S�*#�j�����gp��ɶ5���7������b�����p�6k!u Cێk}r��G�� ��Z�/ڑ����v��Gq�l��U"���!��w�#r�iH�l׃{��`&Ϸ �38��淖3k���O�ncX/�6h|o�;7�v�.�+ܡ���5��|g��An�MA����k87��ü�3m�:�̖H����LGl�*�����kc���"ҶE�§���Ne8�c��mo�Kf�%>1؈&T�{�&����~���I��c�]Nȱވq��»�4h�z5�t�X#�V�w��bѾC"������e�9Y�Hl��zi�U���^=����tj�D�Q� ��e�������c��/�2ι'����x��3�G�L�h1q� ^� �Wd1[�H� �|�cOl#>,������WY�趜�8��~$����¾�d���cR�~��p$B� ��>�%�r��'&�j�T�^�Z��{��L���HH/�$�j��B����������h/b8 Nk۱����Z��넊�3��\ğ$���D¨������m+�S �|-�אfq1��>�[z��K�E���>!�(X��l��g�C ���yC��k^�i��r��vQ�c���Jo-`R����3��������3h-��|���&e�d낤�xZJ3���7x��:.�ik��@P�)��X�3�%�w�RX�L1"��MS(���z�l��^'e���3_��!�N�,�`��B����b�٭ͳ�G^0��qq�S�����g�(�MZ�MɏPū'���9A����K���"����E*^(����U�R�]_��!NN�J9p����5D��j�b�|HC2�,��ԣT PG$%��6����U��!��.����h�pUAk� �%#g�0��K����kE�\�'�0��!lDV��k:�a#�,י;�. l#i��g _���`MU�\c�(7G�'��r=?�������+��(�6��� mu��u{Rg��pZ�W�f��K�K�8Jfj-*�E��̓���1dl,��U�N(�eP�r���"+:][��7�,� O��V f��ݬ�����Q�MV&�3�k� ��+�Tֻ��i��^t������M��E�9u�S){�?���ke\=Gb��, h� �>s��t��r�̃V v0x�`ѻ� �Ѿ�����Z��gе� t�!�/c����E�(Ĵ����ki����o/~����ӿR9 !0���) �v�i^da�w�~�K�H�nZ>��]T�˴d��*0�uG��}K�b �Z�������Z{nU�AS�n����cѹ�,jB�+�m�TL��E�t�b���� 4 �{owC8��36%�lO�˞I'w����o��3;.xP�':'�� \�&�R@.�z`�`{Ï�YDk\���? �Lg彛�^���/����������N��NʥQR��`I�N��0�Ŭ%�W�����8��3t8�"�� q��e�>_��x-��mZ7}��:�C��F����2'��0��E�iz��YP��> w�&��٦}�ឦa�e�O؎��<���Iך���a�-%0�g�����!vP�G��<-8�����_�+�бW��9��� ò��I�_�t�Va�RE��L��oz�v�����۪&�����iy2��%<Q��@�^��ۏ)�u�8����:k�"���d�z-\��y8��&ƫ��HC�` �W}�4�[9�e_7w��<�� �L��Εs`���T�����[��E �hh���6��lzm�Z���ru>�ז��#"8�o�܂�n�7��%��ŵ�3r}Z9�dЪ�b�����FNٞj��K}�����D��~�[O2lVFf��d�ȓ��JƂ�fX����+��g�.�'=�����b�:��4.b���}<T�n����:���c+A�������)�ş�{� .�K@CdL�)�u�N)�=O��_V%|����J���,�� T*J��Ls3��������a�UR�ң�8N��V���(���ת����b�L�n-�9�m3o��4���E�I~m a�����ʣ�J���TW�!wi>W�?uZY�.Dƪ�x�X����� �X���� 1|\Z�W\g���a/�D���?{�|Bv����+� J�����a7{����#�a6z�X�ݵ���F`��/~0�n��3��:�x�$�x�e9z �4��$��m#�J�x�h��G��QN�X��|�4��%�������W�É�M7�F��H�֠9.� g���v
Behavioral task
behavioral1
Sample
b88050cddc241584a08c06f13a3ae2db_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b88050cddc241584a08c06f13a3ae2db_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
b88050cddc241584a08c06f13a3ae2db_JaffaCakes118
-
Size
6.2MB
-
MD5
b88050cddc241584a08c06f13a3ae2db
-
SHA1
b6c2ca2dd21d385160a104b9d3721a64b36f4277
-
SHA256
9c6d896008af6492681d8992991dd8f36363624fcc2add83ca8f2f96b45af7a4
-
SHA512
7d4af4327608ee2db649d677635be7d4014849484e3e552a7017ff7bed0de6d65f40056be94d2bea9a3cfcae245d30c894354dcc21ca1fcf7073fd440169e258
-
SSDEEP
98304:XZh5+affDSyWcXIHEDmxIEUkgly0h4rXhK7cctQqbSg1FO2z+LRlrCvU/4:tx4kl9lyI4rXc77JTO2zCCvU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b88050cddc241584a08c06f13a3ae2db_JaffaCakes118
Files
-
b88050cddc241584a08c06f13a3ae2db_JaffaCakes118.exe windows:6 windows x86 arch:x86
e01fe5f15a049699601b0148a4c425cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
wininet
InternetReadFile
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ