����`$B�zކ���3�-�Ц 0�c����J;�`��➫��I��@�*ݦ\ޣ �.��F�&P�T�=5��!,�����*7�t)��2"�֠� ���6l��R8��C$A9�G���\�CQ�1\�)�GY��9��-�����g��b���D|)i*����� ��o���|;`Qa�\q#�@+�3DwW~"�����3);A�]�g+z8�R-9�a��Þ��f�]¼-���/2�)�W��ꇠ����91&��f���Zԑ����S�e���k�,X�����f��Ж.���sv4Y�����X�� �%��h�(r�&�K�� [�}�e����"�\�h��C������]Iu�Y���\ѿ���U��L�(�U�/�g����]���������.��~{W'����k��BWK5�Z�!�LQ8@�V.z�G�dC�Gc��~�Vk� h|��D�����[B�������9���Y}��85���6�"�sd'���^��"1����-�S���QiNZ�S��G���}�d71��Dx��4��h{z����F�uH�9�ƬqU�\v&[��<f�bc�������R�t�M-�Zg��3�-�Iy2i��n�%�Yz�\P�B� d�tʋ��G��A�Ewt�+���9)��?�}Q·I|��g9�Py��O_y��1'��%�� �u5V{���o�z���4�1�:���K���������`��D������� 2h���{�������k���@g7���m]i�S{7�8�z�>!�E��@�2��C+]6U~�ZBMs�T����FX ��W�8�ѹ ne9;�6����r9S����s�vڷi#4̋��L����]|��t֬ ���5�6k'#����P0�oN�� 1�����D�i]'������Y&������ыO^�S���?L���s���w&�� �IN[�jT��Mo����J%Dy���0=���ɠ���%��mo�c cIv�d����� RE���>%�t��~i�����2���Z��Hצ���eV��Dl����^Ձ��!�40ǏW�LsH;��5[�;�u�ۇ���Mw�?T� 7�\���@&./y��:��<�~�Ce�6�y��_���j�����|��h�Q��d�:��pY.J�rL���*�֍A}K+��Y���� [Y-~��yd���;���F%����sq�l:˄�����G���(��y��g�"�IE�I�ӧ��(6?�U�^y1�hP��� �5��.V��^f~�ky������Η�De��y ��V���[t,!@ ��~�4�D�>��'��r<��^��M8��ز��M�����5��l�r��"G�T`j��|2!�� WС���'}_�x���Uc�Y�Z!��� �����A���QtrC��bK6!����b�N��i1JX�K;��� �,|��bZ��)#����3�q��y�E�q���&�� �L����p�յ��|�jF�1��i�>W����kЕ�����O��% F0�����̖��a]�¸�e�C�W�,�d��ob�"���}wx[<����GA��][����'�����:&�ʂؐ�ѭ�Gd����x��T�3�@����Q��:�|e4�VO���+Au��v���q]j%e*��U�r�������89Sp����+^���ɗ�o�`�-5��a��\.�@��QeoE�.�5�|MK�$�tD�#����u���'Ye�l�jpx}�Q���N��F�;Q^�.�u�������b�0]?��ۦ��~\��rHj#ᧇb����W|����<�p��j-�GSQ ?���^k ��Q$�>)@���%x�t�X���:�5��Ѫ�]��W�gL_��C;�����*�k���s��TP���S����0H�j�c����� ��n�B�&-��xx�;�!8c9�]-x����]�kV'�N�~Z]L 0*^���$���~��,�;��z�y�ر�+��9d��S[^�GRڋ�/��Ϗ)��A��a�P(�ܗs:��4NA���i���Aׅ����-3�읏���}���>Lh�:&�=��d�F��6� W0�^q2ZF��I^0jzJ���i���`!�������|�)��6U /��F�8��q��s��S���_3�PW��(��-��C���$�)Z�WУ���Bc[���W$�^�����b��|F�6xI]�ۊ8lRIS_����t��!~�0Y ��~y�W'?���5fq���ߒ-]�����@^�ҽb�����L��!��O&�ʣ��9�� {�p��%r�D����Ӗ��eIy��|��Q��az�T��m P�Kvߖw 5&2C.*Ұ���Ң�a���z�`�9�wM��[ք�rEЗ����,h����%�Ӈdʎ��p�ɐ�m; n$Dkz�z��@s��Z0�qDc�I6P�����+�^Zg�f'��I��~���@y�Cc�����;�{e��I���}����+Ԅ�����14���dc���n���}��3����V� @�Fc2 �g7=0����QnB�[�^0T�uzQRpu�T�K�����TT�����>&���4"�>�J�%�������9ىe���Br����a+�`�/#�D��T'�DE��"i����uօc�k�o[N:��49�NY9'�t��手���,�:^�����@qMř�u�:b)���0ٺ����S�#0��4����?B\w����Ҁ�]���KF����ǀ��hoؗ贪gdF�?���wk_ܖ����'��/�E�AL�Yn����R��7� �]r��B��2�c��\AO��Qc$K�/�|tD�_Y�z�=�$x�feb!��+j���Jp蔙~K��&5f9X���|_~�w×ku�<�::��/�j����|xaՇu�Z�0('w�vܖ�h�O �)_� W��� )��H ���kF�Թoթ����` �Q���b�Ǜ.9H5~p5E���h|p7E=:S�c� sFV��nc��j^�Q��ް�r-r�7WY�"Z���w��;�[��`�a������=
Behavioral task
behavioral1
Sample
184b08f29f6457fdd92e22f7c0d957f5_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
184b08f29f6457fdd92e22f7c0d957f5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
184b08f29f6457fdd92e22f7c0d957f5_JaffaCakes118
-
Size
185KB
-
MD5
184b08f29f6457fdd92e22f7c0d957f5
-
SHA1
c0d5d0ea54377810c8dfd15e3a3d120908fb2d31
-
SHA256
5c037109544d08cabdab59e2b7bc3edd8d5f80ff0326e63162d14f020421e7c7
-
SHA512
37721664b98dc952a22385797ba07a37796dcbbd319fa42fa1df1bb580df14d83e65ccc77b0bd26e39ebfbbb13f6e7b8a748f7c338393b2e243a35c52b8b2241
-
SSDEEP
3072:um4VTtl6yq9v6v0ktx/rGmpSJsrnCZ4KF3NIugR4SMkqIQCOkpUw1nhQP:KVTL6Lgv0ktJrGbKTo403NVgFpOu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 184b08f29f6457fdd92e22f7c0d957f5_JaffaCakes118
Files
-
184b08f29f6457fdd92e22f7c0d957f5_JaffaCakes118.exe windows:4 windows x86 arch:x86
648416866a5786c32031a26bea1df94b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetShortPathNameA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
gdi32
DeleteDC
advapi32
CloseServiceHandle
shell32
ShellExecuteA
msvcrt
_initterm
ws2_32
htons
Exports
Exports
Sections
.kylin Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kylin Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kylin Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kylin Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kylin Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 182KB - Virtual size: 181KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE