�MU�X_�MII�H��p(���Dp�{w�m���r'���릉����Q�`��1�^�^o\����u��H:��E5���-�<2��k���ˣ�l�7��q�t��@�J�x'Mz�����"X��%V�����<2U<6NsCb�T���V����{h�y�f*����^�v��Ɇ /D6�RbZ�Վ��|-1�$�Qb%ĚXP̔��� W��7#~2#m�� �X�/�"ٔ���n���\�2Q�����Gf�5�ϼ��g�<�i{T��YT�!�s��)n�;��N���Ds�+4���ۊ3 �Ŭ�Ӹv��g ��:cp� f�������G��d{���ɦ���T�=$�D�E�bs�f��4� /�r�[`J'��>;4�����~#i�.��+\<��Y�8�S�OhH�X��L�]� n*��m�h�K1�⠐��P1�b�F[l��,��rT�_h���k��9��H^ 4��L���5t��8@�H� �8��)��9(bZ�|����O�09��t�(zG��@#&�>�����Q1O[Oz�h�h|Y$Ŷ�@����Ӆ��%Ԕ�4DV�0��8��D�5d ����k���#�T��y}{kT�<UO�G�c�_����,I�HF��Y��!F:Ӂ���Ui���T���ٱ��(�v���M��-��E�2��r m}U9i�>���ܗ4�������{Ñ���k��� ��?��� b�̻]�����\L!0�t]{��@����f�Mn|"��R'���Z���ƿ���DlN��l�����7�$I*��tvB?x�J��n�KA�f`墨Q�O3��|�J��� �zx<�� �P7�n\���N����|��yB9CЮxчi$�i�af2��Bj��� �VzW��ov^n*K�F�_^̊���t���K]��]����;��}�� h��-��n���#��g����0���=�<r}s qU��Q'��^p���v��ޘl3�^�]FV�G�ZW7+�����q$T�Vķ3��0��?^K�Qa/��˿L{ �Y�"��>��5����p�70��&��������k���6�.4�c���a"��b�vrm��pp0~�QžpSS��Oes��D�����C�u��ytdb�����ď�nR�`�Ş�?:��ף%8´��Ђ˯����[)豧.+R���,&���T����3��>7����g�ø��h�He$Z�K�"��a��/���aW���^^�!m A����D� V�!�A��w)(��F�I�{]������m���>{�Q:�:.v����Qnڛ�r�T�a5��3�4��i��"�Q���d0,J�ɑ{���+0UBD���uB�w�-�x��x�jeF��i�8E��������������d6�r�ʛ��KM�d���g����SJe���� Hׅ�\���m�7/Q�]>�v����(�v����㠤��X��~�'���ǃo�qx�JCN}��}�~�4u�5�$%���p?J�F���P�=�\���ۅ������r�n�N6A{�F�a��iϜ��i�aa|�.�Q��v��u�����l�>��_����y��a��j��j�t��.�{_dm@@��T��z��� ���O��ʨ��ij#���u"(��2R��{ͩ+�6�Ml��G�=k�T�s�a���!#y�ᘎ ��r��bs��� �*�p�H��/�*�)����6>1���;��h���JH�����;x��tI+fĖ��1����o�cH�XNq�_�(OZ����K�v�18�~����a}�L��m�����~u�fo3���Lwۊ�O��� �"ĊNxBq�"J�l����������Le�j��w�Q ����=�1�1d?"}���9�`Iگ���ܔM�� G4�a�;���mҟ�SK�������~ԫcA�VZj�u揪�l{����՛��T�QV%X�xw��c��F>�zf�"��Qt�������y%Pr/>@W���:�η�ٕ��?��"�zV��a'�q)����}�Xf�c�xѐ� ��3,~\x���~p1 w/G�M'�}�����,#W8!�n?IO����M�;��_aP����g{,��d�;�+`> ��rp>�~2ᬩ~-�������Vʑ$�ya�ۍ���s��«�l(�Q��E?��\�=A���b������2Z���&�F���*��Mov)�o=D*�n7��V��˯4���� ���'t:qV��#�LiT>�w+�A�|������c��]��� �U�V��3gW��p���C�� eX��L����! X�b,C� �ådȹ"��G]����Ϋ8f�w���N�� �@���Qw����KX]�{kq���ܘ�ϫ)OP&���|�`�TU-m���^g�]�J�����-��v$��c%�s!t���� ,�e�FƉڨ\��:�V8��}':���N��D/h��Y�z�mE"� ˑ��y�mt�.�ު�U�A�dz�<��6��{�n�i�Y����i��^����@w�?��^�5KW�Ӕy�)�"od��Q���OE�xU�bzp"s�a[���zݙ5��VI��D�����*R�2N���ß�<ϙ���%ZۮW��x���>���MÌ�5;�,YA�j���Z��W���;�*��E�c(Ia=�L�����m�7�$�Kؕ��:@���1Z;�,Gz�ˠ�e��.1џ{��X�SC4�2A5j��m��E�w:�Ј�vu1���"x��36�� ���@�QB�5o͛�{�[�D3n��Dw�ݜ�^��;88��U��&x zW������,�ۋ�ntC�~u��y��p�ܴ�����l~���=`N���c�ͧ���6KC�s��� ��!I��bB�n�{7C�L�d�(�K/�n��8���G̈́��{r�Pú������xsIm�T�+<��v�d��!��:��ah���s/jK�Ǭ�5Dk`Ί��luP� 6Ϝ��(_�bфmY��+h��+�i㶘T���&^>ME��8��O�~X���\�Da���C�6��� � �ܯ/݊3;�
Behavioral task
behavioral1
Sample
09ac272e9ae8de47414a37417d9f9865_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
09ac272e9ae8de47414a37417d9f9865_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
09ac272e9ae8de47414a37417d9f9865_JaffaCakes118
-
Size
144KB
-
MD5
09ac272e9ae8de47414a37417d9f9865
-
SHA1
c47f2e06a5ba83c62aa7421ddfd6df823a96010a
-
SHA256
af177262f62ec522afb54f854c29de44137b29edec90d8279a83d116d3688922
-
SHA512
b774f9555003b55b491f1a8a18e95cb835505ed0235bbd726809a5624b45494ac9ee2680f5633b854fafcf83823c6dd04572e5f6c806eb89a9f22308b209d4c6
-
SSDEEP
1536:gZXr4pBJffF7ZhJ+b47aAEYzDfkTUcEXogacrCjeIn2XRWBuPyWfM2hxSY+vRMef:gNUBJH/+mREYzYTZEXoAwkPH0HvFctS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09ac272e9ae8de47414a37417d9f9865_JaffaCakes118
Files
-
09ac272e9ae8de47414a37417d9f9865_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd9e5dab255ac7648d47f00925c6ce6e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
PostThreadMessageA
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
mfc42
ord800
msvcrt
strrchr
urlmon
URLDownloadToFileA
msvcp60
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
shlwapi
StrCmpNIA
psapi
EnumProcessModules
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 124KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 400B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ