&���z������jľ�B�j���a IZ$����o���'��Ω"���e���!���yO�J2@Ri|7��7��r=�˷�cZA���1�(�y��^x�HF.���L���*����e����O8�S�Q@�����!�3�A�܂�q�8��\/�*A+���Y��>���o~2�l��%���>h���ro@�g���5M�~B��˖���9���I��M��LM���<,���l(�]'O�ju�<$��P�����*.���I�JB!�v�.!4U]���Ă�$x������Cn2 � a,�K�;KtoGT}���\���`�C@YX��X�욙�,�]��s,���K�C9Q><��r^�}���\ֿK��;ج)�^�k��[C�r�� k�|�RP�y}�+a6�E� �ߣ3-�ӗ�_�æ&h#h���~�/�yf��� �F�l�sѼ+���*'�sa�f��ք����%{fߡF�^-���(��+G��S���_�)+�n�k/��g;���\�;r�� /�=�W������J��?:�F���cs������C�lâ�3ƕ��"�����5C�^xI�Z��p�s��eulK���f�&�aT�Ɖ��ֹ��(���p���7�� �jGPΦ�5��4\�6���X>�]L?� �l��L�j�����"�k��aU'4� ��|��n��y����� `�m_ނ��?�䗙̪�7�]j!~����:|���p�g0��/N=^��y�nؗ�谮 ��9�,�5�uQ�Zr)�i`붌��ŋ'�c�z3�≍�`h����T#� &6j�u�!���kC_����ѹBv��:�O,t��E�u��-/�k�����Ă�'P��w���-��:��#���}�C��e@�D ų����!i�ѩ�����������İu��C�u�e��@F��=6���*��*��L�5��@�Z4kC��6���q!����yF�� ��f��b/�3}�ȉ����t\)I�!�d`��v1�<�[���9V"��Po䭴��T�D�T� 1���F��G�xw#��C�|�7����QM��8��.� �\2�(�3�#���̷ØL������x_L����7�����p��+��y�O/��~����#��;^/��V�D��d.�����ncנf���G��|;ײҷj���#|k&���#�*V�>I���+n��ϨN�,)M5�v'`QGX�� �U);|�5����� $�<�\p+@�������^K0!8*%�7��Phv��_W��j����r_�\��E`BN�m��`���cL4���D�N�8V�e�L}u]��Z�����!�H�r��m��v<�ɬU���pE����>^��D+(��'���e+�R����5��1�1��$@a=�����M���CL@qo7��2G�����AT� {� g�Qs����W��\�>o!,aep5�$D��(�$�$���I<�b�1o��k ��muWg���?��Z���:T��<��h�"Y5�`�,��ș��Ys���s�����q��Y��G?�E��RJ����w��o{?���HQ�Y���dS��n���$À��C����&Y;�/��Է0�D6W�ܗ���|x��Qj�kr̭��� ��ݲ�G����(웢�X������4��_ef��OP� �M�LﲻS�uVf��^�8�QU�ɔQ��l��u��N>�����l)��Q!@�+͘�6 �n�)��:_�Y�A㷍�E�Zx;���� �۱�~d�׆(��kעx��8P��O����`�е�yA����\����:��)L�[K����(�*����K����L�j�y� sܢ�P,�p!�PPmƊ��i��"�q����ۚ�ԣ) P��ê�����-#�U��p<a4�п�aeij���l74�È(�(���dc���,h6]�_Bj�&s�8�uRP�;q]�]Gb"��G�[$#{�����);;��0��_:�EY�Ȣ���Z�¯���m1ιa\ ,볻�*O�"w�ZX�)�:\tJ���+�2��F��>������GJ݀���]�9�vxx&���m��} m���>\��i��lg\����u �Wx��8��yw �������b��B���9�����A���6����뗥�ش��nEq�G��������������5��`b��Ə��-������ߴ����M��"C�{��\����1L���K$� ���MrI��?���)Z��%3amM)�=4q4M4}�,�@�,O-5���k7�ֵ-w��=��'�_Ы�CԜDe�Ɓt�Q��]3&��L�ղ��c6�����7e�����Dj�F��h�F uת�(�L�J@�!��7\`�1���#�� JZ���4n~U�[)_%��@�Ѱ���¤���P.��PE���G�pѩ�y�-�5J_o]�X-���L�cs���(r�A���m�`���fh����|N�;��L3.D��� ����!ȼb �����x�)|�M�`vV����ћ�m�5��'��8ӽ�S��5J��W\/}�a%�ܝG�`{>��T+b�Yfv��� dU0� 1=��I�" gJJ���]+BM���U��a��w�����G�e?�LV���Y0�ٴ�����! `��4D48)��+�<<�����K�we��7}��_-�$������(��<�"�#�^d[�`B�ڇ�崲�����@{�;�)7L�&"ǹ�"0�f䩰MJ��UM�"^�ΈF) ��],i�!���I�!�:�㢯P����$z-W�3vL`�>/_Uu� 7�a�,�����i��hx?߸)b�`ք�^@����~���wZa��<gѴ�1_�.3�}�X3^�d��H\�b���R�!�|�;U[ֈ�1o�,'�e9����g�DK�G0@B���sLUi �gDy>{������2oщ���HX�D���YC��T�k?�� �&=D�͟�F� ����_�\e��5��S�6^k�%*t���������a_IV��ZE��
Behavioral task
behavioral1
Sample
0914200ab06bf3aa394fb615ebb9fce2_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0914200ab06bf3aa394fb615ebb9fce2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0914200ab06bf3aa394fb615ebb9fce2_JaffaCakes118
-
Size
132KB
-
MD5
0914200ab06bf3aa394fb615ebb9fce2
-
SHA1
abb12bebdcc560b9a61f0e93430f7fe5d589324d
-
SHA256
f08131cb75d7de33599258faad2c81c72015b4dd1444d37769835b05d89f94b0
-
SHA512
9502af3d97cbdf2af4c49c2a5e2b032337d7df172089f44d5aa5ab68643dbbe3c566c4dcc9ac406cf8795f3b02638533763c5a2a948834fe448805b1367d5575
-
SSDEEP
3072:5qt/pJ1H2k+mQHdNmRDe8l9bfrUFnGDVaKw2w5:5wxJZ3+mQ9NiDJ3bfrMnGDQr1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0914200ab06bf3aa394fb615ebb9fce2_JaffaCakes118
Files
-
0914200ab06bf3aa394fb615ebb9fce2_JaffaCakes118.exe windows:4 windows x86 arch:x86
d24669cc89e054bf8e58f33ab2990870
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
__getmainargs
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ