#�&��ăUg�.�Q���+52ۙ�X��{�xP��4�3\D���S]I������q�V�vX��!��d��Y��P��V�����n�L��M+X�`�f� ��U#�'/��|}i$�FW{i�� ���������EV6h�[��F.�����p�SR&��� {G�Rқ��%���M����V���)�{ﶰ���R�)�=��e ������*<������ �LG�������K{U-���| ��s���6yg�l�FZ��K�*.ܧ�)����dEBB��wD��w0g���c ���R�uH��7�!h(T����[hMԽ��w,�?�e�����?R�(ϏK1ҙtY��ƣC�o�a��~ �ۚS� l����#B��}=��0�+��Gg.�ݿ���S��c'i<�F+��~4�Y�|��@�����^Y�XXv���i;�T�o4�5̳P��ȑ�]{3Yݍ@(��)�H�:��ROF�������Z���w���R~Q�s��G�s���e,\@��&���7��H��P?\(�F�J��� G6�:EÓ��^_� 1L.{���')������۪��ȀS'���]G�f�$��{�47;9���3����)&W�I�m֔>�4�FEG3Sm���go�Ú�=�t������ A �f����ҥ�~����3;����&����YV2�O^�j�#��oJ������g�Sx)>��/|�^�~;L��e���.�EK#uQ�.o�W[�X�ݱ>S�<f����P�R�O2��3^�&k�=n��^��27p�Yt�K�'T�D����4f�2(a�i��}"v�}�)�=ksD�^!�&�I�T�rr�_�ƏA����l�5��l����|��?@��rѻ�}}7a��C�ƅ�ܣ ���^� g��4���B�IW4�Tk;��t>x̀�8��r��O�$��0t�sd���6��K����\p�/c�ֈ7EBQr�v�FL%W��c�~D� �4\�iy*AB��GDé8R�n%%$ҨE�R��w����͛�E�F�@Ew�m{С�����_���#O�DIYw��pƺl��C�����3���͟8���^7U�\�9�N�t�BH�z�����f(�7\̕�g�n�;��̴!�>� 6�� <�9*N�x���jNv��SI(55��ޝ1�,��ِ�h���C2�n�#h6�;����^��0�[��k���.�:-fܡ�=m`� 5�2�:��Ο�6t�}� x�s��e}�]�f,��UN��⯥�[C���Us�o>�|Rw��D�������0����g���[�]��o]����0E���Pux��ӟL;χ+Lԫn���G2߬����Z���2�J�ӧ�ZO�L1%h�2�4y�8��s��$H�h�KQ�����H� ��2�Jns^�;^�Z�W"��+t�۽=[�S�U���j��i �\����Z��˓�������IIE��g�����(����G������#g_N�$'��ݿm����6�˴_���#��'�F���f�Be>5�����!�J���R���>Q��������5��H�x�w+&曢j���(J��� �Dz�&v]��*�X�A{��E�/S�ew�h��0�GX (6`���W.�DG?Y��a�+B�S��M�A�Ixy� �'�[ w,�;��#`w��I���c��ӓ�x����D�u����L�aj+:�_�b4����D �� ��R٬��_��ND�32L7ԘI�f�NN~}�����k9���'0L�VU>l�@��E���p_���Ѕ ���!�e��}t�,~��yI�cʺiɄ�{�CE�m���+�Vu���� /("�;�x�ꌞ�l8VWi 4�gXe�-tص5!���X]�?��ߖ`�K�s՞����pf�F<�����\�s�2�@c�Xt�&�A�c�����Xz�I�s��~����E���l��]�_���\a� ��?�[�xE_��2rw�7��R�Ӝ�Ɣ�������(5�)��>����9�`E�w�$�إSHl��~�W=���h2w����U<�q�0�c=N�F�mo1��a��VϬ��R7���Ƒ',�{�c܃��n'BG��ya��'��x{�2�#3�I����Ut��3O�������6��ꔂ�♫ˡ/n� M��$�Ws2R5�Tk�U>[�za) ����hU�H:��s���ٲ�:{���\�ݣ�D������L�o�����C�3o�J .���e&]�7�K�ҕ{�s(��h��<RR�T5:r�'�f�2�˚�LO�����9[�e���v����0Xu�2���|�`��;�/�[j�;N���[��:�gJe<�v�fR�S0>;��8eA�ڝ��0���4�-!�922lj_�������X"v�Ώ����fG3J��&����BX�����1��������u���m��a�_8>_n�&�^\Э��p�Q����{7�͑�54�.�N���9ȺG'%�����(��z.�En$����,���d�g�92�'��%s�Ғ�;��w� Jы��ypO�u9��h�FT�h��T3�k��"�\�R2��A>cԄe;���*�&Fg�J�)|N��b5�q���4�r��璈T}P� �w_0��~2<�O�l�J_n�G�!�J7�t����~�����&��=n�y?ŏ7�ƣ�k�����a�L(��������(<�������� �]�8���s�=2;����WFU�.-N<�d~�켉����{��_�M�-Ӝ��11���VK�� uTM���/h�֓��+�����֥j�@ww2r��.�e���_U!��p A@f��W��KQ�}����]�OT@�k�M}F;X�a �n7��}�Ћ���gk�[�#%�DbG��a�O�Σ�%µ���Tw���S$E���i���3�tn.���Yc���b8��t�v?�l���⢻���h��=Q&~��F������ٛOgt��F�:��g���.� �7�Aը��v�:�\7�ީ�zY���d�M�,w��r���5�cy?ֶl��\�:j���R����I��k��PaƠj���A��c�S��@�����0%���:
Behavioral task
behavioral1
Sample
19a5ff0807e730ef9a9f8b22722da90d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
19a5ff0807e730ef9a9f8b22722da90d_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
19a5ff0807e730ef9a9f8b22722da90d_JaffaCakes118
-
Size
3.6MB
-
MD5
19a5ff0807e730ef9a9f8b22722da90d
-
SHA1
2a75fa103a69984503b577fc26ecf3b81aca1629
-
SHA256
cae3362449069b70eb6f1e00b340f5f2625bf4f101ffdbdd6fc985f630749331
-
SHA512
8f92939d71c01dfefd32e924b2e643f5f765cd5f12e4e392fad852331e5f172b560c38e6b90093997888cf87d91a050045e7ebcd7cd5082816e905af8569ac76
-
SSDEEP
98304:1Ej6zFikY/0V/lnowD+MBhZ/tfzimhLhQEN:gEFs/8JL+MBHnh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19a5ff0807e730ef9a9f8b22722da90d_JaffaCakes118
Files
-
19a5ff0807e730ef9a9f8b22722da90d_JaffaCakes118.exe windows:4 windows x86 arch:x86
4d3cd68549ae62a32d44710d097256c8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutOpen
ws2_32
accept
kernel32
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursor
gdi32
SetBkColor
winspool.drv
ClosePrinter
advapi32
RegCreateKeyA
shell32
ShellExecuteA
ole32
CoTaskMemAlloc
oleaut32
SysAllocStringLen
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 482KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE