e��CIv���������ټ���x��js���vo������,Ty$��G�i�譟�9�AAp�۩��L���6� LŚ�X��W-Ա�r|rA$���T �_6=��J�Wv.&�#�7B��y�.(�BG�\M����� �1`���Ȯ�]5�� �B^�G��$O��v�o��w[`�t�_m�~��)7���Ĵ��q��ב2��9�������M:��@�&Ym��2L���6����G�d�;�}c��Du.�L a���y����q�s�@�c�[�_[S%-#��V�%�F���i�l��%`��ǎi�~�E�a��f,� �DVc��E��%V8:��H�f=��j��^�p�G����g�"7���kn��o�_o���/]����ed#n ��ڃ��t����]22#I@`����(���.�$��M]� ����-J;��і��0���;c��.@.�B3H܉����Uo��_�9w��Ѫ��b�sї�":��e���%���d�(i�E�J�U���T�2�q,�A���W�A?�9X�83�p��ˆ�/y6� ;I�̬f K�|�HA�|)�-���� �h?��SK]�D���:C��ͤA��;���FJ��v^�X��vj�5#f�A�M�Vb��h�B��ܠʖI�D(`��(s�`a밄9 3�% Ar%��y}���.4�f��W��M4r���������] ̓�t�P��{Y��_ś���S���N���:��N�����q̱2,s7E��b�����n�I���h�%���V��ow�*�a*���F�Ĥ$�KN�����)¨�H����i�Uʙ����E.+�V%8-r��l4���}*����2��_��Lus�.���N"zrR���v[F�%����P�N�y➔�Hk�����d�c�8���B�tM6���~����1��G3g�^)����W^�BlmJ��<@�)G�v�^#�X�,��Eأ?my��b���D�)�@Vc��Y�������u���,m�����m����;kھ3� 1N�x%�d1����03L��U��&��f��,���S��RT4����Up��I5t _��.��>�i�g����),[IBL�>��TgR���.RYi��1K,VII*i�"\h�l7R�4����X�?+?ݙ�t� ,�ߩ8%�����B��ɤvů��^�4r�j�_Z�&�(^XX�FT[�MC�X�M_m��C�Z+��v����������X)�t�P���������͠�$q����l��D���4�-��O!i8�LKo�zb�Q�ͬPS�c��-�P�b�ܚ��ƫ�ǔ��5��dN��.��<�#7{�ޘ9�ҥ�g���������4*N���I�"ESֺ��m�҈��Wc�?��3��|�"B:'^��X<5�FtY(Ag��4A#f��x�^�Vu�AiV��8b�j������(ݻePk��!u����~�Y�M�Uq�҇��[�Ҡ�#9��ץy1��@;�6O��M�(AD��>�V9�r0�s<�g����M��u,�������Q��R�^2r��Q`2f���^e�S�`�V��Y����B�)��VV�K6�-,LA$KWo�;=f05(#;��h�,u��3�n�w��\\g��N^z�7��E]���H�;)�"�Kk'2��-�h��_rط֢�mf�x�!�����V��+�ǸwV,�H�E3bu������.�X�� �O�xA��0Oš���Rұ���ǔ���Gc%��TU��ߕ�(b߫Nn� � ���>8e����5������Fil���:,a��b��Z��Mׅ����+�j��.])Sv��&h;�W8�h4���4�`Vdy�;Qq��6[�&̞xe+ 6��%���i�h��|da�6��d����T�T�|��HK|7X��\���@�MJ���?py����E��+,r��w�N9n{-��V'��Z�u;i�I���A�>��^F�pa��2���y,y��֗��O�M5H�w�����"ØF�:�p/�< �@''>�]�� b7�\"UƑ��������(ғ����l�=�L=�2�3�Z��0!i;Z#�Z>/�"&Z�M4vc�W#|�p���#r=��P�(�೪9o�f���Y'Q}�-�l��0!o�h�O������6�\�@ә��֜���rxA6�^d��>�s��ova�CE���u�r?���C���kEC�倢9�ve��ϭ�o]��ZT��ظ�|�����k���̈́;C���k�|��P�`(��Cs"��p�$�p�((h}1�}}�����f͗� M���4o->/c����Q��S�~ghm� ���V���6ȯZ%��3gJ������ <�]\��q���^��V�D��4D���GTq�P'�*��>�A�!1?����bR��B{����క�B� \�kC�Y8�%=�9Dl�3�Jc:�ɉ��b�C��0 #?ŢI=�綾��2��7�,���������!�����[�.�� ��,�CR J�0��K�0�R��u8,�9�;r���#�U����>^��G�� @�~y������M|T ���=6�q��{@���jI�4����$/����sr�����a�<�*w/E�1g�����������tݩ��zs ��z�za��\�V�48B�nz�����\P(�1]���rC����#���?�th.�)<���s���Jna�����)kM��ޢ�S�492<�!�DR��4o(�����ɕ�lZow��4^��0(�� �R��[�X¹���ߺ1�}�uvR1��������ņ\[_~�y꼆)��� fO��"Ш�:i�*���m[�EI�О9k�/��9�e��$9m�7���`�S�x^�<c���������H����+���ʉ�$n�ٍe�C �V��� ���i>�x.2)�?���:��0N�W�z�)䮢�,Y���5(%��an`�W����.��-9r Yů��1�ѻ�{(֑'�Ҙ!'�D�s��)5�`[ ��L{�5P&���06��x��a.�U�f>���_�|������
Behavioral task
behavioral1
Sample
24f5b8a7e5d29ac2da9ed851de7bf1b7_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
24f5b8a7e5d29ac2da9ed851de7bf1b7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
24f5b8a7e5d29ac2da9ed851de7bf1b7_JaffaCakes118
-
Size
985KB
-
MD5
24f5b8a7e5d29ac2da9ed851de7bf1b7
-
SHA1
4c9bfbe9dba3ee07b487ea0c1483ee26169a40b6
-
SHA256
1d982e33af9b6e05f3532757596af1f8c3b79f827f45335156302b56633b9317
-
SHA512
69977dee21d711909e3423c9fc5c9557b8c0ad77fd8e5164d295ea27ef6887ca799761b39a3ef755f5ce65d7d1655d511d36d77a4fb9f448a5dad1d1ad9b56b3
-
SSDEEP
12288:lRQ/SBdna0Z0mgQzBWj6GIo2rDVU1//LCdnCK0gGKLdCpl+hYxfaBqfQ66ij4xvo:lrBJD0mgQzBGl26NLCnGUdCb+IPh604
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24f5b8a7e5d29ac2da9ed851de7bf1b7_JaffaCakes118
Files
-
24f5b8a7e5d29ac2da9ed851de7bf1b7_JaffaCakes118.exe windows:5 windows x86 arch:x86
b7f0d8450080d42af34603bd26167f92
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableMenuItem
advapi32
CryptGetHashParam
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
StrStrIA
urlmon
URLDownloadToFileA
ws2_32
gethostbyname
wininet
InternetOpenA
oleacc
LresultFromObject
gdi32
GetDeviceCaps
winspool.drv
OpenPrinterA
oleaut32
VariantInit
Exports
Exports
Sections
.text Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 769KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 896KB - Virtual size: 896KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ