;Ӥ���s������e ���U��vE�[]��Ό7J�.������ƻTM��Ksr ��__���xm;Y�S�Q�L�vy�E���ʫ$lչt��5D�w �f�������"߮W�TJThT�oP��Rn5��)�x:hP�����l� �I����4�q����;�b@d_|@1t��m���=ӡ���n�i������Al{�5��)o��z�x1���No+m����h5S�a��y��>��e6�z*C�K��,�LP��]gɡ3�P�Y!��*�` �HZ�Չg"�1�^��A�ۼ)raCS��n(�- Q,U%eQg�eYub�7���Z�<�/��s�믆���-zp9�Y�j�E���IU���K�zckӫ٦ɱ~5��m����J�o�K����~^�{��Fhb��G3��6�9ΐ� ��T-s�:��ñAG��!ƈ��m������˙<z/K�!����ѬL2 j�kQ �h�+$ Po{��Sw����|ܹd*����N�����/�ϣH�t�P?�j�Q�}�^����hD�}D�&�����?.P�P�MY12��9q���7�0��p�?������D���1c�=�3;-h/��Y)]�9�3��;���*���u�LfQ{��=��Z��8X����AP1 ��J��w����:�Az<�rm�ΛKMm��ʺq��ͧ��5�}�;}1+���#��Q'@��Q.Q�"��4�J�1��W��|Կ���x�q�q�w:�xyy���[g�E�Ҋ��7 £`���>�U˱�S$@e�L1ߓ�)Q�&�Y2�69w�֬�� �9�ƺ>0�BP�9��ŹǻzD�-��)9�Ԭ���Xx��Z��u "�L]k*^&�v��DX�����M5YT���t���9W]l-���>~�5qc�z&iq�Px�����_����� �aJH~����>��������z����.I��=㑽�#�lR��2��Ⱥ�@�_��S�Ф���4�X�Q�*Ϡ��ޖG|�e�|�2%ן����"�0�R+���/{�����\�� ��f������!2��Y�J��w)��|f���dz $g�k<j�U�KS|�2=����x=��~� �� �C ��E�?�狷��di���a��w�^��0��u7��d���[��+�#�̇X���}�W���)�[�ZW1=����ᆱ���F%�P�� �t� B�0���Mp+2�#.��H.�BV:ԘU�c-�9��u�C���A�[�4F�����No�P)ϓ���_�,_�=�Ζ](���X�I���E�y��Lm�F�RӐ�2fr����(s���I�]0T�7�.���G�20c���a���DM��=���+�3w�;���tT�3�@��A��%� ��c���&�����z{�\��,�� !RN������h� �(��W6��%�n���Ȏ;��'Í������&�R�� �x9�Z+����IՔӣ��Nuv���[���ZC ����a�" T�����>זҝ$`����Gu�۽� �F��¯������T�GI�Q�zs�������0���� hto;�V��6����%�����Wl���ކ2��d\�3B_����C'�)x{�W�-$�d�\kG��\ =��e!mOJ�& Ib�|��"�;�4D��4�T��P��9b�n�A��M� �(s̯<{�KQ3�60K>V���b�p� 2��O�\��}>p�v�q��w��!�����$�������BM��_��P��;�wj3�2�zEM5���m��px�=�_3�1����Wv�Q.����x��~w 8���]3J��9��J� a+c�\���6?�I�����i�+'�ӭ�xj��^��T �N�]ө��?W9&��Ȉ�/rL��y���q�]j�ꏧ=�,�Lثto����l)�^q�����V�� ���c3�t�1Oo�B8����G"�+��_������| ����(�)����|��]���|���z" ��좜���<[k�6.����Cx�����lm����'Q��-tL�FoKb�M߷�7,�! �9���� 3��<�Hx�z�Z��8j*7�;�yop�C�b��~@��۱ybI�ݩ�W@j�����"� *}����t�=���q^z��G}{AL�B�59�Tբ8Q/�=!�H���Թ�U�̖$������k��:��֫����wzٟA����� ��H�|�2W����.�����-'k�Խ�wP\�v�����8�~!������o��J��8��lQ�S�I�O��'�re���Y�)T��a�,�rVk7�\��I��?gg�dz���]/AH��l�O��a�Ƕo�#@{�O�^E��>�^�#�J�Ȅ$��*Ԁc��� �x�+B�~t�z��9:���^�Dřw �{5+2�|�H�T���(Pe��ن�0�Ԫ)�ِ �|�d��]�l��O��!�~%��-`؝#tzA�� Wnb��`R�y�� �K��8�^Nc�m��MV��Q��w�j$V��#�z$ra.� m"v��P\I;ȉ�x�`�����&���V"Iu���g l[A�Qb -�-� ;�����Pg!���R�ۺ��V��ٜ��e�$�����Z��ä�Wr�, �P@0:I���;@���ޑ�F����g��_ �4I/��� 㖙��h�t ��!����l�b��@�R�QN����;�D4Һ� +c���������e�%I��K�b��U?����&����|#!QR�^X�m��,�y�8���`gf��������뚣>�>^+��^m��vT7����O�����`zo%�uν� �EV�p��ޥ��{��� ��K���H�<���0KqW���N˰���Q9��+�����L_`h8������c\�gy��:C +I����d9�!��^NPD�)���4ݡz����G�i~+���)"u���� �茫�`�Y��q�������I*J\'jWwD���8��[ׇ�Ĵ�Ҫr˄�֝U�OH�fMv6���ԁ�U7��~I:�o.OX5L�_?҈'�9�PLnA��3�
Behavioral task
behavioral1
Sample
252be7bad32a43da113e47ee9663ebef_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
252be7bad32a43da113e47ee9663ebef_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
252be7bad32a43da113e47ee9663ebef_JaffaCakes118
-
Size
260KB
-
MD5
252be7bad32a43da113e47ee9663ebef
-
SHA1
6b0b92dc324b198b9b89315cd0b8c4f88d2472da
-
SHA256
370ed2fef4aca013bff778556d9b592d54aff01e9958270fa67553e63517651d
-
SHA512
fa82f5fb68b185b3ba5bf0bd7035e73a21b540f3dfdc124a800ddd577bf4f97d1b854bdbddc33be67349b4d84f397d894b94ca845a7256ff4b065e0f64b7e549
-
SSDEEP
6144:prCFnepIHdUuBkkkVtv+fKM6Qqi241lQGtsPbetxiKQfp:6HiVVzni2ZjPush
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 252be7bad32a43da113e47ee9663ebef_JaffaCakes118
Files
-
252be7bad32a43da113e47ee9663ebef_JaffaCakes118.exe windows:4 windows x86 arch:x86
7aa126ae215e3a3b9ab975d46d7f40bd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualQuery
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemInfo
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
VirtualAlloc
VirtualProtect
HeapAlloc
HeapFree
SetErrorMode
GetTickCount
FileTimeToLocalFileTime
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
DeleteFileA
FileTimeToSystemTime
GetThreadLocale
InterlockedIncrement
GetFullPathNameA
GetFileTime
GetFileAttributesA
FormatMessageA
LocalFree
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
WritePrivateProfileStringA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
MulDiv
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
LoadLibraryA
SetLastError
lstrcmpW
GetModuleHandleA
GetProcAddress
GetVersionExA
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersion
CompareStringA
InterlockedExchange
MultiByteToWideChar
CompareStringW
lstrlenA
CreateThread
Sleep
WriteFile
SizeofResource
LoadResource
FindResourceA
LockResource
WideCharToMultiByte
DeviceIoControl
TerminateProcess
CreateFileA
GetLastError
OpenProcess
GetCurrentDirectoryA
SetHandleCount
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
UnregisterClassA
RegisterClipboardFormatA
PostThreadMessageA
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorA
InvalidateRgn
SetRect
CopyAcceleratorTableA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
GetMenuItemInfoA
InflateRect
GetWindowThreadProcessId
ShowOwnedPopups
GetMessageA
TranslateMessage
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
GetCursorPos
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
ClientToScreen
FillRect
IsRectEmpty
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
EnableWindow
LoadIconA
FindWindowA
GetClientRect
GetSystemMenu
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
MessageBeep
GetNextDlgGroupItem
ScreenToClient
EqualRect
GetSysColorBrush
CharNextA
UnpackDDElParam
SetWindowRgn
ReuseDDElParam
AppendMenuA
IsIconic
SendMessageA
GetSystemMetrics
DrawIcon
KillTimer
SetTimer
CharUpperA
AdjustWindowRectEx
IsWindow
UpdateWindow
InvalidateRect
GetParent
IsChild
GetFocus
GetDlgCtrlID
GetWindow
GetWindowRect
GetWindowPlacement
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
SetWindowLongA
GetWindowLongA
CallWindowProcA
DefWindowProcA
PtInRect
SetScrollInfo
GetScrollInfo
CopyRect
DeferWindowPos
MessageBoxA
gdi32
GetStockObject
GetDeviceCaps
CreateSolidBrush
CreatePatternBrush
GetRgnBox
CreateCompatibleBitmap
GetBkColor
GetTextColor
GetMapMode
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
GetWindowExtEx
PtVisible
CreateRectRgnIndirect
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetTextExtentPoint32A
ExtTextOutA
BitBlt
CreateCompatibleDC
CreateFontIndirectA
Ellipse
LPtoDP
CreateEllipticRgn
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetPixel
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
OpenSCManagerA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DeleteService
ControlService
StartServiceA
OpenServiceA
CloseServiceHandle
CreateServiceA
shell32
DragQueryFileA
DragFinish
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA
oledlg
ord8
ole32
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoRevokeClassObject
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
oleaut32
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
VariantChangeType
SysStringLen
SysAllocStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantCopy
OleCreateFontIndirect
Exports
Exports
Sections
.text Size: - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 232KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ