7��Q��� ɡG<����OCh����5`�&���l&y:[��1V��3����r^^��@!� �o�/`L�%���P?3*�܅iU��6�:��zzT��h S��H��(5P���Lyùߓmw*���9��H� @�M�nW@+�j��;�Q'Y�0���m��᰷�W3mmgUIc�]n�D�p��B���d,v��8wHmCJ@>�Y@0������j�4A(�x��(��.���O#Zҍ�3��f�����[��u \JKNȻ#�F�MO۬�R`Af��ͷ�������H����^C��a1d y�I�b2*qd�b�/�0���D��0tH�6h[cm�pIN�TKoV��A�~�G ���[g6�>tEر��78�I ���RR���y��5�����#@��oJ]���4���&����c.�������Uн�IQ�+%����Ei����p�iqy��9�fZ�2��h����=k�}&�";v<�&�T����p������������%e,������!�Ū,~���9J���y>��%{����.�yQ��9�[�ge�D��}iW%����h1�ؑ`O�[�PI�(e�2�7P��FO�]�>vU�y(��̓�*t�� �G������7�;B LO-O�>W�=e����ܟЊ�C��ySY~�� ��}*�@(��}�Hn1��ث1��.�,{p~�����$�:?���%+��#8�S�&yR8�wM����5�|� B-�՞��m�4�|T3���G�ۭ�������[M����l�\*�?6D5˓��� �\���D�@>�$�E����p9�b-q��:_ޣ����H6f/@M��ز&m�x|�eq�����P]�[B<�1��aK�*#�`��}�� o���RO#[k_���G/=@�^��g�_ -N>�cn�5i�v��ф$��5/��p�xV���,U��ڴ���K�)�6w}��e��N�����Wl�qʈ��Ā�F��P�oR�����h�-�k !p����A��A�'(��Jv��P�TNmO��iS-ܪ�����:/�X��Xf�K�K��}p���Њ�؝��@tQ%��\��*j���K2�-uryأF�, $Ю#�d.�`iȒ��y���:�v�J��_s�d��P� �Ѕe'�aT��S_���LT P�����h�_���Ȫ�)�ā�f�H?3i�ʼne3G����a�6��cQ\��v3cܹ�Qp�N���`<ܦA����ol˻7a�p�����!����j��MK9G��8�b��sp�E�Յ��5"l�dv���n� �.� ���������jPUkGF��>^cg�rRIo�B(��.M��v?�?H�:��b���q���,F�!D�܈m T�I�I����/�I}<YJ�Κ�S�a<SǛ���i0��k�V�ѽ�ǃBKݎ5B� �ת��6���F���p[��D� R��Ò� ���&��r��M�]����&����Q��UN5ь���E;�d�7�}�Zj�'jڌlt>r��8��L�0�̅A�q�:�p3�.G�,Q��x�O9�X���b���D"B�ny�>P��R�����wLә����������Rb(o�� �,MD���̰0��7�U5ʔ+s߹�i#!��DuMy�Co�v£`<�{zs4� 0*9���z-�GJD���ۛ�����X��8�N����K���s��������h�7�,b*J���d�^eZ*PƬ�?x�?��@���Z�l@)�u���F�Ht[>��`@l��5[�Wy_A�K���s ���;K�S����-6���:F���X�mP[�%iy�����)߲��3��� j�/�(_d�!~$s\��=���ݡń��!�ȐlB-k��Ov�H��0���R�g�ʩ`�U�f�ܘ5$^?j��n+��*�9H?�,�&�%4���t���M 5\<�R6g"ѳ��el���ď;���0S|��8�z���<�/�_� �]�=���!v;����R���f���ItL����̩=th�X�� ��h&�g����5�� �&��W�[��f',�J��އ+�F�nB��?�� ���W�[_�`;�7�A��zdr&���Ψ|9�_T�=�����Q�(�?��qm����:�w�~KWʢ��#�M2U5<����ܝ�y�����̗���Z"c��< ^��`�OF�'�I��""���v���-�Qdԑ�A���#�m��},�̞��R�ݵ~�U?��u��_�)���Fw�A���G"��Rh+� ��╨�Y���~�S�\R���٪w��:���O�N��Q���F�J �f_x�wu&{�vY�y3$��������rfmU���pN�yY"��_bm�^�%�e���`��R�:�(&��&�K�_�Ld�}}��W��ǣ����#�dy�m<;F�WX멆����6������l��K����÷� ��j���2MZ��ep�5Y]ynM�����]������_�=K ���Yqq϶#9x%�_B�R��R����l�]p>ta���E3�+�X���]5�����ze�� H�J���LoRf蓨�,�����5l\�`�����f봪1"~N�7���Oa�\�Nϖ�RX�O�nb0�B��y%����}9�[E[!�NG3����.SHÇ4�[���C�.� �������Zk� q��dQ�}Q�i 벨<���S�����Y���A�8�L'�������!@_�u�p?܊�>F%q�rvj�"�����Q�4�8�����{� ��[v+�ڟE��`^?���R���|�� ����S�q�#���"iH��2%F���&�evV1M+�}����,����E;^�B��μz9�_� �hc,���ҫ57N+����_�Tp&��P}k3)����s��ѐ%�r���E<y�S� ܝ[y�����f�L#���^sW�H�����o��Ʈ���վ��C��[~�Tߺ��N�ء�<{q�T�ܼy?=ja9�}�����3��V�4�6 �� 9;���OI��э���c�hͬ��ڧ?[�8ِ� #���^
Behavioral task
behavioral1
Sample
0c18a3971a6c7517ff37920fb29f7eee_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0c18a3971a6c7517ff37920fb29f7eee_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0c18a3971a6c7517ff37920fb29f7eee_JaffaCakes118
-
Size
448KB
-
MD5
0c18a3971a6c7517ff37920fb29f7eee
-
SHA1
3a736e42eae6ef2d3f0e6204721b7af594008a73
-
SHA256
d4c3d863d4414ccac4c1152f74f3651cc44e3c7392b8613e04900259cd65c5d0
-
SHA512
9ec1d04a3704d87a18f4bc486b7b82a8ba367414d6d64989df45d15f25a75e4d22ab45f510c8ea52e249b18576c31f68e0c69dab8ee6050f46961796bca0b782
-
SSDEEP
12288:y+qMrZUkDwjg0Wttxap3fcMkYQlNZlHfRmLDVe:yTMl7DwjgCfWNL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c18a3971a6c7517ff37920fb29f7eee_JaffaCakes118
Files
-
0c18a3971a6c7517ff37920fb29f7eee_JaffaCakes118.exe windows:4 windows x86 arch:x86
65f373879986ce06ccff69e5683f0737
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp71
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
mfc71
ord2902
msvcr71
__setusermatherr
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperA
MessageBoxA
szbf
SetxHook
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 406KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 436KB - Virtual size: 433KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE