���߃���f7�O������!�b��G�œ�5�L��;hӐ�N^�y���E/�������<�����b�O�HjCq��Į�ǧF���uLD���H�M�B�$��n�R\���P��V[�������mX"����0�`��8�F�+�>��!ֽW�k����}s����9!�z�D���ُBD�Y��y����]��z��@���ye��ہ_�+�����>Д��&�r��c2C�iۊ�9T(N��t;���8f0�q�p�v�w�2s�æ1X�2�&���BWu��� -�ͮ��/��E�n�5��:|3�av�j�-�-��xN���'3�Wu���X?cm�?,(�koQ�� �ow�$��o!�����j���{7��a0�<8gn23�E��4��+�W �;�89���6��ͥ vQ�[�+�����FvB��dgt��9Xa�Ϝ��p�%�ܟ���h��"��y���s�cP����C|���R���M���bl��U��WI|�<��#��%�����e�jh��},P�.�&O`�w]�>v�W�`�y"XM�sZ��9���I�~��d��\p&h� 9ޜm!n�vbH�;�0��:D��N����Pk%�7�e�$ݱg8���P��|Y���#����&����T�F��o"���"�tJ�)��y���zD�͋3|nR���.� w\���# ���;�X�H��n��s�&Gc���u0���Qlj������Y1�M��8>:y*s�� ��%��(��S��Kuk��"�g�e�8�~o�z��"���!����Q����X �L2X��<ƾ�;lA%s9����(�r.e�aI�;�1��,k)����ܬQ�W�.4Ngm6����y�i�r�$A,m\�ʰ9oh�y�s���j�'{������o�A���=��O���k=�c���S/�d+f�'GS_��Ղݽo�y�@� �y���^��2�?{�!�N�l�YȃBM�8 {�.�J�,"��q/�{� k��$N4X�YӰ�d��E&͈x��嬳����J�?}�xnѤ���s}#��()��<�ș�#g�QU�]��<iJ��$��:�t�����_xOlS�z;�m�00p�$%I����[ #It�O�jDΤ��ӹ���o��u21�t�(��alq�v����-�.W��3V��X�)Q�`�os��m0S��l�j�����[=�ٰ9���gG_���H.(u8T�o���{�@v(��2j���|��B���p����ϝ?��Ill��+ȉ�Z��O���g���T�jj�����������o����8 �^�j�5�|�x��0ϟ7��"���T\�K�M�Ƿ]X���Y0���4B5��loć�����|z��}gb(+'�W���dYC���Q��"m���2�*b7F2�&��� ND0İu`�f���{�'W�1`�,M�A��1$%����bŭ�YL��W"�뵮�GJE��5P|K뷾���)r�>F)�Ĉ蠐tp���q���:'>�b�4S��/��x��A�pG�xC�� ��/����4���;:�^���Rj��m%��֪�_\�la�x�o�E:�=����,1xTɋ�$Z\�dHY:����-����P~�����L�O_Qp���8&S�ھ��'�&���uك���B�c��y�±� �l˘���óP��/,�ŀ�� ��D��[�4��}�L$WI��P�c%L�K�y���/�ͤ��O0ϳQ,ZKZ;k�pT*� dzߒP4���+�s�R��ͪ�E���x�E�|DE� ��*�(��V�3��aI���.�3`�)�͂�wVa��|�ܜ�c��g2���6���TS���T���Av���R$� �+�����{uux�@1���d���G�zy ص0:!����g���]RcV3n"���g2�ӑ�Ѱ��(wl�Q4��rqWghؕ���!]{��;��b<���-D�4�E!\��L�#��Z��gc �&��U�<����*J�y4�.`�p��V����7M{��_�ː����(��Hb���1�D���I22t�3��.�$Dat8���W�A�����W�C-��T����*�?�˧Z�P��x�(%�}�no�"ez)����u������#C���O|@ Z������n�E��$ V�� /��N��ό�:�Z�\a�������\�x���pQ|�Pc��0q�������ȲӸ�"M��9�@4b�7��������n��ן1�`�i ]љ��D@ r7:���*>ßY�p)�S(��|���ʦa ��2��C����~�Ӯɖ�;S��^����}3�;�sw������Kp-�� �W1)o���.��j� O�&�|V0�Ћf�i�ZQ /�7P�2)�<H���j�*����g#��ڑy�z��}��~�'�y�����e��9p�h/�齫$�6���2W���;���ju4o�xs,���/���=��(���wm�R��Iz\�ڽ�I[��ʥ��rԌg_%҅�U?X�M��\Y`�<�_��Ls�����I��T�.V�yD�}*{"#�&�ܛ����56*͊�}���n4�;F$���� ?����+܂������F"�-̿��n�?�<�������Ǎ�+��{�H�ӿie�p��a��,�LҎ�7�Ѫ��D[܆4��� @��wD<���4���TmJqY����s��q^� �f�zD>�k��\�%��=7\�}��O�/)G�K���)��G !�tt�ɻ��u+\b�g��!:'�_�}���i��(� d�tʸ��ur-&���q �cb�r�Ѯ�����\,��Pd.!�@���yR�{�(��sh0��WPUH6P�����lL�,�Z����#�Z5���z��\���I�q�����>.q�"e�DTF����~��L)3��{�H$DQ:�1ӯ�xs6��� ��N���٭�R���Ww���2�wNh�!\Fc���4b1~Vzb�ƸO"N+V�vF(�õ�07��y�+�d� k.���8�rgr�5�{�Xa���厑̯�[D�m��h`e]l���M�[k
Behavioral task
behavioral1
Sample
21aea18cf7a353a77653b22f5e734199_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
21aea18cf7a353a77653b22f5e734199_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
21aea18cf7a353a77653b22f5e734199_JaffaCakes118
-
Size
1.6MB
-
MD5
21aea18cf7a353a77653b22f5e734199
-
SHA1
24d362baa64b97463c819c7273b025c81c6f541b
-
SHA256
a39ac5ce8443ce7b9e23cd4610a839a23b200dc38a3d27a82fe03ac8a2e7eb8a
-
SHA512
7dbc1a289406ef7aa4c7921cef9abe624d9c8e7673c1ea0d5fdfccb2274f84a2a4ec3c9cd8dcf29e7531dac67349c3cf09168e83446c1c07702c45f74e125cac
-
SSDEEP
49152:MJcIe8fhX9V1p7Al3F8BUIxFQySZuzZqVRj6HvXnTo:MJN5fhX9lB3NSMVqVRjuvU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21aea18cf7a353a77653b22f5e734199_JaffaCakes118
Files
-
21aea18cf7a353a77653b22f5e734199_JaffaCakes118.exe windows:4 windows x86 arch:x86
0b7be8b48b0e3b63905616bd02e3d2e5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
LocalReAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PeekMessageA
gdi32
MoveToEx
winmm
waveOutClose
winspool.drv
OpenPrinterA
comdlg32
GetSaveFileNameA
advapi32
RegCloseKey
shell32
SHGetSpecialFolderPathA
ole32
CoTaskMemAlloc
oleaut32
VariantCopyInd
comctl32
_TrackMouseEvent
oledlg
ord8
ws2_32
WSACleanup
Exports
Exports
Sections
.text Size: - Virtual size: 948KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 762KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 502KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE