��^h���1JA������?ٺ[�>ѵ0"�� c^�7�,*&M?��'%��� �����H8=�0��<5ac��Ȧ/�S>?��\���S�¡Dz�?�(�2ϤYp��)���]����*��O��f���+7Rs0<��ac��.M��.����g���P�s���M$"��Z5Y�!�%�C%�W5��#���} [P 5]� ����W���j��w8�ol٧����l�6h3hp�i�V��+����p��ؿcTd�I���ԵT˜Z�Cqe߽�/̮f�b����j�_�#������`��w(���� �,�z.�JB)�[�� �C�p�v�<�kfU0�}��)�h�yR��E� �8A�]�̧�Co-M9��{�4�և��I��_PH����UP��G�ȓIU���(:�P Ru��RM���2��PV��0�o5�(^=�fnׄ䃫bAg֒����������n�����Z��w����Q�^K�����p��\�xF���-J>$�:�DXy-��WS�T�)���d�"h�>t��S�lc�B��������ަ+XMgw�˨� "�75�I��w�4��y"�tY�T�;�e묂�����C��В)�U�of������CCN�T�iM ���e����� �i��'�^џJx&��&�zd�%-���#!<�d�$ҝ����D�B&�ێ ќ�`މ)�蜬�J3�o�)WW�� ��<��Һ�����m+�}D?Ts+,��,�*�a}���NV̯��b��%��P�u�D[����+�j `��<+��"�����{|�}ؼ����U>�G�kL��,-cٍZy��q���H=ea�e��6����b�A�lgVB.�B ���g�`|u*qJ�p����x_�� �=�ģ ��zd��f���nq�'H:�0���\`�Me&S�&+O�c��9����V���\��-hXKM�7� LV ����Kg���s�({�Q�ckwħ{4u�`I�'MVLPl������t��H���n���צ��XHCl K0ۙ�5������&��|�X�֚�,r���F�G��@���o�R+�D� �����g~�̨ *=]�*��u1�G�-&H���n�ׄ��.3fr�Sx����b,��d.-��j]�k������uW��M�l� �(B�{Mtu�m[��;����d1��ȓ��2��EkӺ���HH����u�����L���y<�Zm�����[��6�^R��Ѣ����@�ᆮ)\���9��d���qР~^ �D�l>7�o�(���>�xĒk�af%E,�S ��f��{ 9��!�O]�� �������y���Pw?���ZB]Ûg��k�ޱ�vn�T�3������I�~nU�UV�� ��R���Q{�ܡR�<_�ٜN5�<�y� �%��|&��4H"M���3�l�p��w5�a���];��#���`�n�YI1]`$�-��f���D? �-��6f+��2I�����0��s��@ ���e9�ױ��a�柨�DŽ�UA�%�A�c�φvw��&e/E�� r�ӌ��)�t��%�D4_�y�yi2��FG���x�-�x���2C���6q� ��Hi�8���[��V�D��D��f������X�W�M撨��ep2ʃϽ�+��/X�n0�}˽[ZX츛�6�"��cM��5A��CchP;{[g���`ԗ/@�|$��JB 4B�{1ҝrZ+��s@���\�:�r:U�c2$�8��;j#_be7=��x�J7E��� ����zF�m<�%���.�+Y�����.��(�̥���U��7��C5ba�ہ&�1k�']���;�I����K��Ē�7d2�� �s5����~�Ӟw��$wݾ����z�<=T�(�:늍�F�8�0䡉��/;@ג��8����]��wwm7����Q��E��� |�� *��o��\��P�i� r)t��T$����+���W���J��Y�ĭƇ.��������۸��D4��ufke��/'�D0D�ZA�~ܞ��W<fAer���f�D��ȚY� �2�#.��� &QN���њl<Z�����N�vu:�h{�e}�=?e��˖ІFD�5#�5��)��$���|*)�;x���m��N������C�٦�A�mģ��HN�#z�#��-���z�- ծ;�LJ��E���U��n�n���w�J�\�l������Dt��Δ�z$���X���S�UOx�B�V�d���5�rZq�ȔX�~kW�>�68'h �.{�`"��`p��:Ԛ��P�e՛:;,,���1G����"|�.`��x�]3B�����(��� ;]������;��7.ν������iջ +N2Ӄ�d�� ����%�{�!Y`�o�Po���@����+/�'�{�)�� �2 �}���������Ӄ�*��#��g�oQq������\"'8�h��+��ԡE��m����dO�C��>A`R#�ֈ�1�[�$Ub� ���k��h� �Wpؒ iYI�̛�M|��1vJ�*�afO����V�<��F3q����2}Ϧys���$�m���)�G���7�V��,y��OJO��!�� ��>��u��}(`�g*���R��_1e#����j� �Q0���-@�߀�ڲ��ĺ��wi��K��)�����)�P�p�҈'�l�2?5��5�*�nB�R�Q��dۿ=�`�W��9F�M�����.lu����GN������D��)������D���ZI�F�o�������y������9���Lߦh��1�h/�榣e�{����G�a������#� v� B��L�����\Rx1���]]d\���}��"t�e�V �D~�~O��S�̈��w2�1�z_L�T�2{��ۍS��\�|��?y7ھI[TQ=���HM�o��x��{�d#�m��m.k���F?L�Q����[��Q6Th>q�;��BS�Q����tmVca�|̰��]qа3����y@R�|���^�LKA��>�\�@{'^.h>'�"��w70F�.x��"��
Behavioral task
behavioral1
Sample
20d368bc4e3616b8409ce2748c034ca1_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
20d368bc4e3616b8409ce2748c034ca1_JaffaCakes118
-
Size
200KB
-
MD5
20d368bc4e3616b8409ce2748c034ca1
-
SHA1
a2f68f6b562a44f733179f9f6acd526ebbaf5d38
-
SHA256
bc1962c8c0a90244918188c534907c5284c476f171e0f8d79640fb763c16a83c
-
SHA512
04e99220ac30643aaf46200d0f9fda9296a579fb6ef96aa7ee67737e97a467693f16caa448e4094b040995c7e353b7c00281aedc4889891800e25cdfd5650a63
-
SSDEEP
6144:eVMaPJjOX8/L3DMQD4T4P0e5E5adBKSvJVf:KMaPJis/L3Ie4T4x5CSvf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20d368bc4e3616b8409ce2748c034ca1_JaffaCakes118
Files
-
20d368bc4e3616b8409ce2748c034ca1_JaffaCakes118.exe windows:4 windows x86 arch:x86
53c3af565e9d6d25e94e27ad5c1652d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CreateFileA
LockResource
GlobalAlloc
LoadResource
SizeofResource
FindResourceA
GetProcAddress
CloseHandle
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
GetSystemDirectoryA
GetCurrentDirectoryA
GetModuleFileNameA
LoadLibraryA
CopyFileA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 184KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ