�'���)�H^,��'CvT��f�5 /CM?�:��j���V��CVr���R6:]��2eYg�|E����M.-��8�p�v�5+����I��5R�^��u�n�֢�^F^Dƥр���^×~g���Ƒ�����h��dƳ���,���-�l\�|��pM��@�ygN�m]د�ـ�nYC�xH'"[B�����qٻ����p�\�z�>i�K�~���.��Fא�"�ն�y∐@X����{�f��_|^�/�"��R����A� ��[q�Ipz/�:8���HkJ�5�5�cY�~^C{6�#��������zTgWc�uՈ�c�i���y���T��r�8sj��l��E���:�W�l� ��O�>u�C�`��g�D��k������9 ߲�0b|���c����54˒��c��5<�����S �_��f[�g8��w�H�f�\����ںñ�������6ݴE�kC��cc�������X.��4��W��͏j?���o��1uO�KkI����w�nM[���3������w�L�|.?��4��a�<l@�g^�r,eD=�{�$�q� 4�*�;�_֍�.����u���t�l>:@��m=zc�(����v��.���c,���o��ikz�3R�`�#���YyS���3�0(z&gkm�WI�/�B���r�u���>G�(�&_]L��ټ{U��J�i M �9k��=6t��r@����]��"�8�؈?�-��j�|�e�&\{�x+��2R�(eF)�M���]���:>�4 ����< =_�crGS�����(�nI�\����ٿ�B�`]�%UjxR����9K�^�����W���x��Y��C���t|���8��a��Sx�P���K�-��;�����Q�"7�&�n��Ʒ]�����]9����2V��S<}���O��U�k�e��eY�urv�h�x{�R^4D��IbOK����hwIv#o�G����e�%V���2��2"�}9��`�`��>U�Ըڱ�s5ҥS���\���N��yL��}FU�6���q��}V��l������� �_��/r@v�ʶC#L%b���� 5��p��Ef�����%� �����]��!ӵ[���C�5!�k�%��n�$(�%u�bsoPY��I\,I�}Ѣg ��'���#t��O��.x�Sa��&�a�u�5uAV'�����F���VnL!��q�wo�Ct�iޗ�B���"qi�Ӵ��O�㡖ኵU���|���5r]��0HA#Q�ϳ�&�څٱ�K�;6t��A�>���MDS� �0e^�H4�FP$"�zi �o�;���(rc��x��.�Gk����Y����gvL��b�k,� �ȼ|m\��|�D�=�n��V��cU)��d���o�=�H�</�f;��Ae>�� � ꢮ0���O��1Ot�� �J7���C>��c�DX�� �Uj�U5�)��z�0���z�w>�g�|9R�/jNbH� Z��f���8y��h@�N�����k��'Ti�G���X�9 v����C��k��{����F�#�D�T�v���`M�.�L�#w£��-U�S2!n�c^���-'�x���}�7&����>���4K����Oӷ���Y�%X����F�4�W����=�����T9W�X#�U����換�:Qew��/=96��A� ���X|m��(�] �/����N�2�*s��`hY��;��{Ǜr�Ży��}���-�z�h�����ܤ�]F�9�!�:`3L?Bp6:SD8���5v��Rяi�m��<��+t1JV��� t�twB6�bu#e��~S3g �[e_m*Q�*��&:��0vȡFvN�����\�V8��,㊵:�|w&k����ԣF^�������OI��Q��sP��#j��4,= ��L������yJ��V*�F�Jn����cuX�/�\q�F)��ڸ�C��,���T��kD�|��syKZ�-2�c�������Z�+Mq��;��QB|�4!���6ӆL`�TY8LJ���N����@�*9_�q�Ob��) �JWw�����+0U�.��C����pq]~X�x���aw�J���1H�7Zy?��W�RH�u��2�w����ExDp����X;����-��-����*3�l�B-�yl�'��P�a� FK1���B�U�J��;c�ĺQ7�V�C+��d;���Y�ހ厒P3y�����ex��~r�ci����{M(��w"��?�WO���k�y�>2t�Q��Ֆ'�}��=���o�����$�z�r��:5'��}Y ЯG�3iv�bM���:(Q6 �|*���7�6)6���W��<�-$rH9���x4��0��ݔ�� ���EoSӅ!͵�&�,�K��Z;�Fc�5��W��%�L���X� ������e���Zd�I�%�>U���H�_��r�` K��t�"�M��@�X�8��<��Y9�9-Qe��3==З ����w��x1��4�i�~JH۬bR����(���.���=L�ߖny��`5�� u��B�v#�1������-��hP��k�XT�rˎI�fL'�� �3�kI���0�)Z��PG@�m�q���i2��cx���B�������&R5�q��1�v@ e���j��,e��n�w��"*e���٘��bJ%�j��,�w'�8?�r�\��*-z�Q�TO9��9�7n_ �ф�g,�P�_)��&�kꗯ�����;����jj0��p�[-��\�0R�)� �z�a��e�|�'�Ⱥ�����9+��c��|C�̕��(NW��%�gSQɀ]4!��:~˭�F��5�h�s��q��2�A�w��*�p�G�g08���G? ��TDɰ/i]cO����e�GBlNdv�O��[����8�1�*_��яȡ����t���r�%T�-vL8#������|t$�=-&(Bf�x���,_�� �{+K2bh��G]N-�݆7�G���;�E����i�[8�,Q�8�]�a����]^�fy%��#��u)���w{����W3��$��|DP�a`#7F8���b�qNj#ݿ��.��ު���Q3Zk��e��_�w�
Behavioral task
behavioral1
Sample
07e4275684b464807d2e11816dfec4d8_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
07e4275684b464807d2e11816dfec4d8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
07e4275684b464807d2e11816dfec4d8_JaffaCakes118
-
Size
312KB
-
MD5
07e4275684b464807d2e11816dfec4d8
-
SHA1
8f3c4f92411be32690a0cecc8c9116f92f5be914
-
SHA256
f846aaef001bc454b8cd6e5418e434a83db3564dd2e5725d8a4d776a392daae2
-
SHA512
e2e3737537d835114cb4061da7214a12fcd44620b7a5e4c6c2d827c0143fa27a86f16828c432bd8f04e2e88b0822dc71e81794eaf75e3cb2d55d9825303c3af0
-
SSDEEP
3072:TqBnZ4iKAgyXLXowLobsCnh+qGr4f/EHVf9sFBSrWk4ss9XWDeKwuRh:TAZ35b4w0bsCkyfcoSnnaK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07e4275684b464807d2e11816dfec4d8_JaffaCakes118
Files
-
07e4275684b464807d2e11816dfec4d8_JaffaCakes118.exe windows:4 windows x86 arch:x86
d24669cc89e054bf8e58f33ab2990870
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
__getmainargs
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc0 Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ