���C}�cR����!��S9ҁG����h�?I(��gL�x���E���)UO�������$B�(�U��N�� �z�Ӄ{y����o6mNL�`u:���.S5T��pH��*Y�dC���E��]��l��V�Ӗ;�a =��������:Y���b��gZ�\) �߲�'���WV��;[��M���CU��y�����f[:)�\��A)�8^ɖC�l�� {.�P�bW�c7kntRZ�{���7�Wz/C_b;w ���8����^;~���>��>QP�h�p���¿�C��.������f�#O���8iֽ������")��?[� EFVeJ9Γ�`|���z������6)�=���'�֕��+9�~��B��3�tt��C꽠�"������5$+)x�i<����Wk�% <�eԤx{2�r�w8�j�\�z����,YMHG����Oh�G�tTԜ5�p�rX���H�a-��7���?�ݵ�UT�w80��4w���I��6��!��a9N�&&-�=� �$}�nW<�ܕ�D�}(�f�x��)2�^�lD�I�Xϗ��_�0S��x˲�_��ε8J?ɖ����{��h�ˆ���E����SzoA���Jª�<䧑 �l��5�$������N��SF�Z���d�1<��v%��xߊ� �pKL�IJ�*�����G�@b֓S�`���F��K��k� �X����k��K!�� �Jx.� ��\#o(B�8j�7����K���mb��_�2���jt �;�e�<�U � ��u���i�U����>�l�J�_�o�Sir���0��f�����i�`�&h���Z��#����k{V���>�a)ෞ��G]�5 ��!�2�\�e�����G�ŝ���<" �#�F*��/��H�-�\ ������>��R�HB@1����h�[�t�3dat{Y�U�'��3��H l�8�*��<"frof�|��n�W�T�J���R��ʂ��e��.��[�1V͓��j�iKL�풦 :I�2�#�������M����J��Z��n��$�̇J����Z�n�f9+�{��1�����`���c�8R� ��+�Gvd��wuӖj���f�@��Sl�7����hش�Q�(��?t!'��7C1�>�� �T ��i17(��w������U�����9��z��O���{�Ws��>�<��i�T8��b��N����\l����J�F���X�������ɉ�2�7���`B05��%@��6̒k*�R��g�[���I�1p7U����i'����~D��|ld?U�r-�J����O�}`&�2��4��C��y� �r��Vc�@"xwn�+3\zo�{�\�5�"|�$�G�ˏ��N�k�9B�CR٫P�1[�7��N�漴�3�]gy��E6@ C|�w�:��Z��p�ե ���m@C�����d${Y�u���\-K�(�P���H�"WZ���������*Cɹ�P��y[?,��OۣSZj��|NEsΖ�Q�K������|�Z.Tݪ�{ �c-1b�Ŋk��&��� e�%OGZ�E)_�1�ݫ�RYt*j�:�v}���y]ּә�V4�|�M����zH�������Y!�S��r����nsԞ� x$9/��Jʆ��Q�n{�)'�ts4z���7���s��m\�ˀ����#��i�o����:4��Vl��>Q;�KǪ���KPD6�dEb�}�a�a�]&�_d��(��iG�{���M*@_?�v�wJV�r�Ik�9�����E 2VE�����$�+C��dm�c��h G�P>*��ʽ��a �ݙF��V/��,��s5�{��<�ܻ!�8�R��m'y����Z>% ��L��I�� ��w�O5Ɠ.�eA$���MA� ٖ����t�K~�F���� �l��Ə�N�F�-; �L�?/n2�����n��8^��-�Z.#8��F��x��J�F8D�oC�U$� ���]�������7W��������o�6Ro:��D��g�uG+|����)������>��C�B1R"oU3z��+!�i�0����O�������fIvᙴ��!���F;ǔ�i]�z��N�������<+�v�������ʡm��Y�Õ��1�w�ĄY� c#�I3�.���\�_iɿj�d`j�e���=z7��s%FƔQ k�3�~�ʕ��t� ����s�����;��>;�|>�����!��-���s���;�fv�x�_�L]I���R44�N.slӏ���7�$����W�e*XgV��yXZ�9��Ⳝ$�5\YOb�� �Od����Dt��)�:Ӫ1�m?��v�~r����B���z��^����5[�{~BP�0vv_Q����s��NZJ�%��-HpC�um�� ,���A�R�+ x���8�?V Dp��-��[��w�Xe0/B�(�L��r��z���o�~��Uo��9���>��c��T�'��?�Ŀ���脤G$2Đ��v�]ͅ:��"B�����CeAw�h S��B-�1h�Dv�44��'.ޡY��.��d@��2�����y���~�u2>-��!n�w<��_� ��б��khk(R�ܷ��Z+�υ��4+,�mj��`���ˠ�:խ�� ک0���1b>F��N��qłd����;{x7/'�3�e���F�Sp��>�S���03���)���B���ݫo��eF}�� l���,5A�ض�ke��np'[�C�����$��گ\�Si��d^P��e���Q�]��bW{R6C��N[��~�U��\٢v��k��5����G�T�:��IN�f���,`=���� SZ�KV+�N��0��{$�N�*U|�K�vU/š��/�[C��(њ�h��Ι˥�i�6恒�>�G�g`Le)_�s�g�߲�6�r���"��Yl^Ў lP<�k�R�:�����!K��UjHZ��[q?�|Ji���t�?(ŵ�}ӠU�n�خt������@���狚�.�w�o�O��n��4��eAN�����R�T���%tc���5k����}��s
Behavioral task
behavioral1
Sample
114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118
-
Size
528KB
-
MD5
114b0b606e5cf7427184bc390c79ba9c
-
SHA1
206f74ec955d64dfc3dff8d8181e4f2137c4b909
-
SHA256
afb9216450c8dcb6b63ba81c8425d561568f7e20831e12227d6d1fa997e3fae1
-
SHA512
637ff291ec3bf8e12edbe51a6a207e5a280a2f77e2b64a748dd7e7019f2229fdd1e70d12d63a169fde58dbe7544c2296c9fee922f59ab65e5c3ce2dd2aafbb01
-
SSDEEP
12288:aX9mcUsSzxGztt/XLTIbhuqge68EEo+ulEl6HxTO4aO:we1xoLvQbhqe66o+2H84aO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118
Files
-
114b0b606e5cf7427184bc390c79ba9c_JaffaCakes118.exe windows:4 windows x86 arch:x86
15399b7698e51d25ebf79f256ecd370d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetPrivateProfileSectionA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
PostThreadMessageA
MessageBoxA
advapi32
RegCloseKey
mfc42
ord5710
msvcrt
_adjust_fdiv
urlmon
URLDownloadToCacheFileA
msvcp60
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
shlwapi
StrFormatByteSizeA
wininet
GetUrlCacheEntryInfoA
psapi
EnumProcessModules
version
GetFileVersionInfoSizeA
Exports
Exports
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ