3h��U������1!V���_$6M����C�c߅�*��I��!�ro����G�e�*��Wى�"�n}:\H�2۩(H�3�ެ�� ��D`�lLlƗ9���לq�`2z-2~uB��[>'KRUP��<,7�Ts�y���@��D1����3��� ���!N'�fiY�7J|k'�W!�g: 3%�IBO�Zh��u�N��h���-���ݕ3��'k������)El����+e��ʽ�Er��S��[+2��{�����ؙ;�OP�B`:w�O�2��̀s�9�K0����+<^�Q��psr�W��������I����\����Qvr���7W?�>��Ȗ���W(��a��ΊjǶ2��D�G8����� � �ޕ�yԞ�E� ����/n5jt*±��%�Z,e��H�R$Q�<[@@!f���~k*�jYj ���*��X������;�tP�Q_�_$e��V���n�iIv9��:�����rwAK�:�^_�8~�j�a��(�㳝�:u�����5.����;�^�,�#s��KC�r7�UheCq��a(n�w��}������^�����gzK�� 7��A �+٦O�j��������}l���1��"�j���"�*g'���fAʛs���6�4��̺�� [j~�J�^ͳuIT�Ar��ـvH��!��Kzg& ��v�����v`|>�Q<K8�n�&�q3��6���zT54�;���dN��%xFZT��w���iK}�� R)=h�0X��I5��M� ?�7����� ���ŧ6i��`��j�e:x T���s��:��+nSG�U[��YMQ�AW5�ٖ��-�P�M��*~R�d��ѹ 7p��_~�c�2E�����t�@/�dAs����1��~�+�A�-�v��V���6���g2�W�$�9-Ņ:�%�{�FSP{�z"�k(4G��doq��<�HqC��������i��(����r��.��|54�_4ᕤ�������;�tsfU��5x��>� �9�.���۠YS������i��2���tw�n�sJU�;>qұ�A�t<��{D�A�FB�L���v��q�C�He����hG��G�:���&b��:���U�dכ<�◈�B�z���7���Nl7 H�opX��>1���������m���kd1���(�����'����~�ߛ�g"1�5��Wx�Ә��N��o�3^�{�#6�#c;V (�0� ��W�fF�#�����ku�K+�U�P��+�@�B�kn�-�)�ì@� �'�od�Q��&��a����|��apȀ�oo�E���?��k���z�g�E�]��ޟ��+ZG�kPQm7%���pKm�*P���M�?�M���UB6.|>^���!T��s��M��g�p{x�m���@�F�LR#���+�l���>��<�Y�LN���V/O��bkj������oi���-��ݸjZZ��������lC�(�/��,��<����/v[��(�|J9Ȓ��恥������<����|����ͼԀ���-wQS��Q7a3�����(��P-!It�8`i��,��4��Eܶ1�"n� NHխ]�h����^T�� �M�Y��U���'��<�*Ҥ8O|}C��s��8�|4��©�&����2�9`%15�zj霵b�X/�6JIʿ����O0(;`�E��GVȺ�x!��G�1�����e~{�ғ������>��-M-T�;���KO5�Q.FC��1����Y���;3 �k���!DH.B*8��"��<��M�3�k�w��ů)����㿲�퍞4`� ;bw�陀�CBm�8U���ۚ\��i�������⧩��rLZ����P�p��_���g�+��G��43^���:��u�hj��ӎ{���6b� ��Zr=�a�ϥ�o����)V��~ӆ~��7�aL�������̀q���ΖW��2Z���]�NQ���c�&��c���"G����Dǿ��O���O����yGn�5��w���O|������Vl�ic�����A���N1%�x�;c�3�ء�K0��5�&�r��R.�- ^ޥ,�X��k���8��9�0v!]8m}I(X�����y�Χ��u�4��b�V1(����d�� P�0�d���?�9� 8 ƕ6J�Ҩ�'�Ō�lM$*\�:���G����ʊ�}���M)� �?�'{E�i<�\>�"���(�}��q��v���+^eYr��EF�;B`S�C8,��"��ԓ�w�/Y�Cd{��%2u��)���tVu?/Z�ʟ7���*��ॽ���<ȭ�j�ڏk��U=���F�ϣO�^ ÍDop9�#}��Z0n�V[ b(ʤI̕�X���cd��*ׄyN�b�U�V��t ~��C�o�wc%�^��w�U)����l���s����dZ�^��b�����(?b��~�3���F#?("o�?�D��i���K��G�;حx���Z��6�[,ؽ�'M�����{r �%�hݽ�C8�/ayG��5��@�����ի �A<�f�DuOF��F�o�k��~V�WaL�4y��A���]U#��zt^��[,&Z(�;T{5��|��GI'5��21���<�f'��SX�橫ZB��{ ,��BUX��lF��+��K����9����c��>�����Ÿހc��(ʏ[�a�cV�1�l�0���i�M<|��L�9�>��$�f�G����D�d?aTg�\���r�|�9�愞�7��,�o��LݰX�>����pQ��4I�%���0���E:�F��~R�E���0iЖ�rdY,$��^mJcB�*��3��+�9=Pu���f����Q�� ^vل�\J�-���!,�Y�m�O� GT��q,5�#eo`��f����2�[����pX͚:�z���Tݣf��j���� ���QcdC�7#ܡ�yDQGZ�}h(������Qj�+/.��V?���L��[��L@ѭ}�9G[֡"�� K�!y}g ��ጁ9�Rӝ�>~��8�O�H$Nـ�[W��B�܃MH�y���Ğ
Behavioral task
behavioral1
Sample
241ee275d8a5fffd4f7f8a0005b708e0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
241ee275d8a5fffd4f7f8a0005b708e0_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
241ee275d8a5fffd4f7f8a0005b708e0_JaffaCakes118
-
Size
113KB
-
MD5
241ee275d8a5fffd4f7f8a0005b708e0
-
SHA1
61a0ec740dbe33e2bf1be737a00049dd866a411a
-
SHA256
fce250481beb366c4dbb2977674f1ba3ad8eb016b18461c62630ff2cef0e9f31
-
SHA512
3bcf47ac144a8c56d122bb656133dc45df5d8e794bed954984b119f1edc1c86db60ebde555840d7e32bed32d6333b39a0c77930b7a0dda61a0da7a109297ba43
-
SSDEEP
1536:/BAIFzpukIvE4sfzAY1yNuHoHN/lLEy7PNKXFtFT3Zy6wZh2lLEyVfc:51evNdUsN/NEy7lK1tFTOh2NEyVf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 241ee275d8a5fffd4f7f8a0005b708e0_JaffaCakes118
Files
-
241ee275d8a5fffd4f7f8a0005b708e0_JaffaCakes118.exe windows:1 windows x86 arch:x86
a65feb82cab9de4ebdaafe418a82e5a5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crtdll
__GetMainArgs
_strcmpi
atoi
exit
free
malloc
memcpy
printf
raise
signal
strcmp
strlen
strncpy
gdi32
GetStockObject
user32
LoadCursorA
LoadIconA
RegisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
PostMessageA
CreateWindowExA
DefWindowProcA
MessageBoxA
kernel32
EnterCriticalSection
FreeConsole
GetLastError
InitializeCriticalSection
LeaveCriticalSection
RtlUnwind
RtlZeroMemory
SetConsoleCtrlHandler
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
ws2_32
htons
inet_ntoa
listen
ntohl
ntohs
send
setsockopt
socket
gethostbyname
bind
WSAAsyncSelect
closesocket
WSAGetLastError
WSAStartup
WSACleanup
connect
WSAAccept
getpeername
WSARecv
getsockname
WSARecvFrom
WSASend
WSASendTo
WSASocketA
htonl
Exports
Exports
Sections
������ Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
����@� Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
����p Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
������ Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ