������R0Yq�o����������|�&���m.f3� w ؕ���b;��GR"�B�w�j$ ;�8):Wn��B��t~���;#-b��������n��دR��n��gsy.�m�pmr]�c�I���z ��O�'&l�d]��~O��wC���"q¬�<=C<���� =ٳ5m!t�p!)A��P��a2�IǘA9����<�ڪZn�X�I#��-fy~|>Yo x��u�;��)^aҝrg��ҡ��K#�f<`2k���h����D���H�ۈ��������|l�Ґ����xKcK��f� ƅ#6�9����Bw���^/4�4*V�t����U��>j�K%]1�m�dV��k��&~'��������]g�����Z�� kd0��G4�ia�Q�[H�~;Hqͧǻ ���B��+��Jj#0 �2�(>V�LV�;��v��&���okÊ��M�||���ܱ���cZrN�x�)��ى�k\�����!G�`XI?ʲ��t[57��-�ox��av�S�1Z�x�Ƿ���+C�p-=��w��⦘#U4��W(@�$[زr�!��"ӥ17�A�����¶&�[xeL�����c���?�!ݱ^�5�<���d^�&ua3V�>�M�(o���̇���A�tƑh�zj6_n�8�+��*[����G������}��ء��@�J�D[�Ә�k��inz���/�~��ԙ&��]�$1d=R�\��֗0_x0Ӿ�<� 9Z��C-YCb>�_A �s���"P-�%��L��7\�Z7R_�����05B{���<0�j�����{sl��-䜖;o�(�n��~��Ϻs�V���5M1tI}�Ů%{&J�j�^��NXYKY�D��� gk��#{����]�ud8Մ���azT��5��o��2TU ���7|S�!C H�Ψ���Sw����G�Ƿ�q��Q:����PO�M ���B�y;X��d��D�;C7z��gj��^���k>8��D*��m��9^Uȅ���X����������Ʉu��yI _�4N%}�� ��Ӟ����I��?I*!jF�-�7V��Y�f!��I�}�l���W��eZ�����42�z���w���l�Ϫ>nW�%0e�@�y=�,� ��4�*�4.�P���in���c�b��*���)�=!1��r��-8�+Q�lU��.G�Tf,��9���<s&�j�uyݶ��(���8�B�!��Q(�MS�.�i�H��7�(/�lG���f>Q���=�_z"L�tl���G���"A�%T(D����3z� +j��q�ݛ4O���)h6�('��exw��ۂ�����A���;v�>�X"��B�<k��Zt���d��0(Դ�s��1�!h��8�gؤO�WLLX�z�x�gp!݈���[i���v���)�Xd��Q^�yc������vU3��|}�_���q�H/-���`�E��T}@]*�� ��i���"�{@���\NIpϡμ���6yx)���������/��kLm��cq���z��Z�r%@�v���o���~O_�$� �g�f�%Pʧ��*)�I��p��.\j�^{[ZyF��(�h�6 an{qȪ�/�w�y�h+ô�8aP� w��\�=&%I��{��x���t�W��x�¯���ؾ�+���m'����d,�a�SS�Qٿ1�}譬�#Ri�����*ʹ���:��X����%ӱ����C�=�Lh�^�j���5�uߛZ�cy����9�{Q��c�z��Y��B��]�c�W����@��i,���� �@|�+��v���7Wl����m�.���?�[vL5�<Ҏ!�e������BJ����Q,����IK�&���]���[�)G�e{� q�'���e�Ꮰ�p�A�E�~=�b�/�z��F {��&W�Wӕ*$�^���Q�2�Q\g˪c����������Na������(�/�f� -q ?Z�}� �� �6�t�����=K� #��a~n�e�̓csQ��f��}B\٨� r�@yq껪���V��W9۽��m���ހ��2;ֶh۹���Do���ݓX�弯��N���j"��(����C�ݰ��p�b]P��.����%$�H{��ݮ8�����]D.[z�]��dz3Lk��P4r��F������!u�1><�G�u �9�C���z�A��V����&x��K�9 �T�ɠ�b�1 ��iZ=�l@�9�Æ\�cor�/���hސ��F�nwgByeo�S@M����q-�$hIj j����6n�y���� ʑ�R�ێ�?�����Y,`����+Â�17�lK�Y0��0ߓr����㏋^�nR��W��z4@}��I�v}�Po��X�`��V{��㳼�����T��A2k�}Q�n��Q5 k�v?�9��7j�F۞�e�Z�����Xot:��OΆV(ގ�;��d���7+��x�{��W*�Y��%��:{����G ���s(����P�i6)�0�3�^ ���!I�,={�(���"��'~���w��"�.Zѹ!!��8vn8�E��k�r��OWCSͲ��?�������a�P������_ﮮfIQR�#�����99M`� |ݕ��6n��$8����u��]�������O��~�����.�� S��XDigjD��v���:ޠCp�M����!/�In�� ��KjK��\Ĭ�t̃�!nQ6\2�[@�,M�����kt�7�I#��RC��"fie��ƪ��Gzb,��E�����B� }��ݩ��9>nk,�>.�2�wEp�*�F@����s(�����Ci��������$Np��EeU�� vKo���%��d�a��<�Wm�P��6-deCV�=@x�4�٫NZ��k�R�lr7�*�U�O�O�T�R����j�E|-2[zE���z^Ũ� �9|BW�]�:{"1w�kT�����w��b-#U�r�E=�S�8XNZБ;;Qb���c���(Ɩ���9��sI��s�#٠dWܹr�{6q x ^���t�X4L���q,l�m,#
Behavioral task
behavioral1
Sample
115a0ee65018d7ba7d2d33c83a7c1027_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
115a0ee65018d7ba7d2d33c83a7c1027_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
115a0ee65018d7ba7d2d33c83a7c1027_JaffaCakes118
-
Size
4.8MB
-
MD5
115a0ee65018d7ba7d2d33c83a7c1027
-
SHA1
2a4558c679a24b8b954b322cee952cdb395782b1
-
SHA256
b367dab3095c4d33a843dbc61e3ccaf854c4833bc1814a92de258459bbc04614
-
SHA512
f802fad6c5d76efd0a7eb526293edf0f338d3c05e8654ce0907a0b3dc11a0a0331ef87d20938d3e7d09e98539ea7e871078905ce41ec50fce08c67ab1002cdcf
-
SSDEEP
98304:HfdEapxjCc73WbFRfVHzcSKo2EFakG5IRUYGTgQjQXCZrMZIscxflwMHe:HtpxjCcLaRfNNKobakGrBTT8XWflwMHe
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 115a0ee65018d7ba7d2d33c83a7c1027_JaffaCakes118
Files
-
115a0ee65018d7ba7d2d33c83a7c1027_JaffaCakes118.exe windows:6 windows x86 arch:x86
01fa62e49cb10a391ad6383c7df43500
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
vcruntime140
_except_handler4_common
api-ms-win-crt-stdio-l1-1-0
rewind
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
kernel32
UnhandledExceptionFilter
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ