�g���k �)���Cvy�<��L:����B�KC�ڭg�8��d����U���oأ,p����J.�M�P���c��f?�N皮�{��gq0.���1fsY���$M����D�"<;"�+�7���k�1{햏�g����W��@��y��\�}�7����6��%U��� ��}Eaҧ3�0��ѯצ�(��ABU�s��_�KJsQ��P3a�C"_i���ġ��7��nRZ�ք�m���*��`?M������+�8����s`[����^�Y�h9��7��|�(yd>�~pֺz*�S��ğ����,E@M���I�i蔊xS�ꥋ $��?0k3�N8��{���v���J:"4�ÂF#r��V�Q%�d�8!-ခ܍г�����V@��(�]��o��vl���$6��O����uw���&)�H@��!Ϩ�������t'�k(*8l���б��\dj�XD�K�U���a�a��ֽSҥ-M���K4����آrV7���:-fB��3� L�;���2�Ѝ�T��+�K��44��׀{Im��Z�Y�&�Z�u{���A�^p<���p*����#j���\cLR�HធtЂ0���Jw��{�%�:_�+�'ҹe L�6�j�5�19����Z,��.�í����<��i��Sk����*X;��R���8֏*SMG=���|��h�y��̠��3��!�k7�9�����%�@�J�uX������$����5UT0��e�W��E��9r$��YZ��=[�[Hs�������H�D�ٳ�.��\g�܍��O�|e�C��vmҹP�q����{�襛};R{$N�J�}J�|�\�@��qs����j���l�#�S������ �M�y���B�[V>~T{睗OJ�S�Q����#���s�w?Z�'Q���ә��t�A������3�[]^�R��N�7���ezB�W���S��q��Y���.�X+�����y�D�V�L�o��1��E�VbNgpKnY�آC 4[;�v+pl��]���{#1E�fdB����}�Y�MF�в�?��GC���,�Q����,'*��M�I�{ٙ!��P���AIF�� �a@>&�u�4��h�)���(�[���F:*�9��̰0g�Ԓ�,�n���|쌒��u��~�Gu�E0x��h�$�{��TDN��矉@X���(G�{SG���<�IRCCfj��¹xg�d�3s���Zl�7���<1�b��ClN�Є��A]�1#JUc���o:V}�ɳ�#�:g`G����!�Q�d{���]����}-#MGb��&�:\�l�A?���7ǵnc՛<����clO�c�$�g.T5��0��u�YH*�h�g��Ub�c���M������� �:�0��rԂ0K����} @x<ʨ������?O�J�dh{���b��(���a ��Ԩ!W�z�����q'�^�8����8���``��1��ߜ�eYg~0��������k�/���> ��8_�b�0��u|����ب�~E��üzR;Ԛ��X��ax�lջ�X�*�d�5_�7B�jvF�O�/mD�Id ��,��)�� n1��ʉ�U�O�!� 2��Q'�����[9��KE�Y��I���kiKJ���6����P>�Y�+��YVQ��ʐ�>�"u��?{#4��@7eKb�B����^ӵ�jf��ڱY��]D�:�j�oM�b7Ɖv@O��kbذ���n�GO\�h�nL&3s+뽨K���皯������L4�7/=����Y��{mdQȎA�I>��� g��~!���<R��[>�m0�2dUoꆼs�Dg<?g��Qp���h �/�~TF.b�| p�q:��+���a�����,���Ր��,#�c���ZD��6 �v�7Afو��*��W�m�wZ"H�DX��'G�>�a�<���F�cJ �^` �X�ű�=�b�Ӫ~F��e��3��Ǧ#���3�d�<��P��VE��c ��ֳlc~6�~�X'�n����w��T6����֑��x��ڲՁ�{�i��w4��?-X����fut�z�c��Z�O���Y:��sG�,�!c���!\�@`��"�@���Kvup�;=Qs����}��LnsJ��N��H����}9�텼�N��J1yq ����5)@��8D�"���R������JK�-4�}S?�q]`����9��{K���:���9E5Q�Q-�H^���s����Kw��������b+>��I�z��1���^�(}�t�+��<D\c"����HA����I� �8Oc�Qܒ>���)�z����BM4��G�Z�P?;��u�V�D�L�7�P�xb`�e&k#].㓼}+���Uʈ��&�a����b��R����9 ���^%���i �"����vs���nU1zI</��Z&pFX_s l�/Tk��t�G��E���'@��=�P�4�R6|��'�����+T*=��7���L���:�m��[�z���+�i��:f*)�U˾����@���륐�;��Ԥ[�<�"�NR����o�^t�6ɮ�}:S %%�*���Z�f+H��h���:�@b*�R��p������;]���~J�� �6"�Fi�}h5���rB�ޥ������Plܪ0]�ma����6g3�懈�J�Cx��T�_��MM#��� E�j�k?/C��1g�E���$���(�7K�\�/�`�5H��0��ļ��8�C�2� 6����5�����됅/�� ��P2��zN��E[��S)�)�}mx��;�>;�7����T�Rw~Df��$�=�C�m,{���h̄�F�Q���qZ �*D���,ر���@�%�Kǩ�*�]!�S+���s��� ��,�F?$��"�o�I��a&�9�!j!�NV����G3����T$)%5��0KȔG�kH��D��bS� ��=T������E��R�l��/�M�xNa�I���i�(z��7.��B��WUΨ��p;�g�z ��r�3��懞��l���G6/
Behavioral task
behavioral1
Sample
2651166c4887834cdd62b9ce5d8aa7d7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2651166c4887834cdd62b9ce5d8aa7d7_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2651166c4887834cdd62b9ce5d8aa7d7_JaffaCakes118
-
Size
6.9MB
-
MD5
2651166c4887834cdd62b9ce5d8aa7d7
-
SHA1
14de76ca86812123c9d5fbb1dee4483794f8d020
-
SHA256
2726d8deb73a3ca6ecdf6af3e764dd24b2f3b766f88cac68f77b086a4fd15fff
-
SHA512
c1727583dd9dd8ef6a0e5c8a73575149f275b5946181f1f08cf62a41b466546e03ab9aff673ce8849f90795eefd8964b03df8ba9412eae0f139a7628f3762e77
-
SSDEEP
49152:DgoDtktO7EE6WlmgVbiXh9atUPE5gkc3r:7kAUq9QXh7PE5gJr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2651166c4887834cdd62b9ce5d8aa7d7_JaffaCakes118
Files
-
2651166c4887834cdd62b9ce5d8aa7d7_JaffaCakes118.exe windows:4 windows x86 arch:x86
f6071921ba7173b73dd0f4eb1eef6259
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
AVIStreamGetFrame
winmm
waveOutUnprepareHeader
ws2_32
getpeername
rasapi32
RasHangUpA
kernel32
GetTimeZoneInformation
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuCheckMarkDimensions
gdi32
GetMapMode
winspool.drv
DocumentPropertiesA
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleIsCurrentClipboard
oleaut32
OleCreateFontIndirect
comctl32
_TrackMouseEvent
oledlg
ord8
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 629KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 651KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ