U�I~���G�A�$ 3�r�n4���H\P�BQD�/T���C�f���{9�Υ����� �3���n9˂b<`�������q���z��U:�b����e�G4�|���+)��e�u^P����R����xQ]��R<9 �|�e��O|FV��������7�!�2n��9(�Z'��2q�]����)Μ���!����@���q�\�B�}Q��~�xÔ�MV�$�O)����s�y��g^����sw�}�Z� c���weC����.���9�Fb�w�wB(l��d�7F>�U5� ��,p+[���l�ԋ�Ů1�D_jwy�*ߠ��=��ں�F�lՎ~\����>��Tx�X$�d���`��U�O�E�ر���'hV��-����|�zT���%�5��I��b���+I��h��n�Q��u�ǽQ����K<kN����O5���?�Y����D����6/Y�������ȃ� �00ˎ���g쪊����MN��P˴~���]N�ꭒ�?�-�EhFP���C��Ȉ`�U�i��m�X�3���'��7Cd�iۯZv����lG}Vz1��@#g�6�ka����a%K��^�l_�;4�+Q�a���ťb�Q;�e681XG"�E��Oұ,�Ek������h�L���t� JB:���{��,�F�Ǯ�|�]�$H�s/bA~eH��F]j��Q�_Hѩj�zN��:j@�4x%׀��R�M��N�ꝺo�NtZ�p��!���hzYp�ш��eʡe�<E?r$����!s���QZ�����t�+��!�8��x�Y���>j����t��=2���Y�{�<���L�Z#T����XsD�����,�L�e)ӳ�߱ ��2���)X;��ӻ�hX��� w[�'\\<�'����|&Z��������s!؆�M���h��@? }ōo����������k�^Ԫ��{z�L���"W�P`KMj�����V�"��%��Ed�I�V�ܦ �" ��ý`���� ����Mp�N'�0h���`��2~e���tf�(Y�nد����P�ӥ q+$���$~���I��!m���M!� �����u6Vg5d`�|e>b��se˪w�������m�ɀ�+j��s[��d��b�R�����K�3��/Y%@��>8����e2��|���f�%/��y�R�S�f��`hu�ݛ�������i��8.�4H���g_������Wgx���� ��㥣QoQ�l�,��<^U�d�T8Ϣ9M�J �b!��R�dy}B����`a��@��I�B�Π�"$������S�w��^ �:��&�W� �&���+�٢�����[nfN=��-|9[,¥�ϡ.�¢̝͂�b��i��p���'��,�����Z�9^�s���8 J2��.������5N���N��lw���%� ����Mq��}���k�=�1��x�E�� �J�>�ʌ:~���O�s� ���N� ��K�B�dX w^~�r���B6�n�A��ء刃R�������_�Dw�N��t9���A) G��3#���]z~v� ��"F�V��Nl�D���gB�����g��n�m��9�u�����3m����q!Ɖ:��8��}HR���r�x�;gJ�xr��B?�<����z�`�;V3�"�օ.� ����Ӽ������$(���p"��~9���c�#�&�)7e������Xו�K�Qb� 8Z�e�*�ݔ��|�W�� b�5hF~�/�l�h��K�g���{�8P���ͫq�����A!��c���]gȮ�ڇ$��f[��A�ӤS/h���p�L-�R약. �o�*3PAV���v� <m1�D� ���t�_�9�Y����ŕD�"�J\��q(�#&��I�����_�o�����"��G��0�w��> �Q}Ԁ� ��&'�eH��iHy,�(�j�k;�� (��z���'��-t"�}%���䜹��] ��~h����*�>SC^8����-��u�g���0��OsIt�;H@>���MN�R��|�=' �[��x+��L"�*��m��㓚��*)���e�� �~�V�q��<�&e�i���ς����?諦}�@y�`�G1�Z�P�8]ӱX��X1�N��;5��S�ѯ4?tY�{�P�����ɵ ��G����^[�^F\Hz�a��s���k_���)ۑI�v��8c����V�:��;��%[�ץ��É:w ߓZ �(@�P���y�>�Fm؝;��dMHR�7/�Xܴ/�1�ȓ��ƺ5Md��](G�p'��X��?�)�����2i �n~���+��8�R�r���� �Bӗ{��=�by��]8��Gz��En�u;/9�� �F�,�����;/��n ���� `����<40$�� T�2���#!T��D ��n��.����4u3��~�ٳ�������"G #�#gA������[�@R/1�7Aq$R̾�(*X�[��������#��v#��x����1�}~$Y�sFҮ1��M�[5���y��W��4<�?���_�74�$�4�`K��)�Qa�� ԁ���d�0�ň��A1)�8m6��R���q� ��7��v;��I�9b���.��Eso�"r���$yRS�� �P��t&i �{M��D�iEc�4Z���K�Y �ʗK�u%�q��(s����D>(wu��j�����g����J*�5�zs�N[x���N�%a+���M^1�S��F��m���P�],Z�⫒�ע�$pJ ۓ�����OeZ@�Z�����@�����wW0l�4�YN.�d�k��g��s��s�Ha��� ��w���ź�qM.z�<�:y-��Q�Ŵ*U"����ơ�~�"��V�����z?��Ӱ��ըYk�d�����D�1�@��҅��^+ҽ" �����ޛ�3)�"-��ۏ�,������a��϶�o�����'l�/wĴ��� �����-:�Y�ū�]! � ���Mܼ���tFT�ō�h `< >jJ�� �'�.`��&
Behavioral task
behavioral1
Sample
2557e5c28eafdb3d9a7703b8884b93b9_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2557e5c28eafdb3d9a7703b8884b93b9_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
2557e5c28eafdb3d9a7703b8884b93b9_JaffaCakes118
-
Size
102KB
-
MD5
2557e5c28eafdb3d9a7703b8884b93b9
-
SHA1
3ddb0091a23420f32d20103a78e974ebf7cfca4e
-
SHA256
d527f71cb01d8f4f7c9192ab3155d87606c95cd6da18c7a79ef8c19e0a101dd5
-
SHA512
8d7cb572280ee57cbccb278ce9f8d9762da844b46f87fb8003af1abaccb65c728899fc585b8780c3493357c6b755be41cba90c88026ed0e181f1fff30e05d796
-
SSDEEP
1536:XQ4qSoQ1bvLgUp8xILWEZM8Rcib/tzNr6hWbjk8uZSsOmNLJYSjKc7Nbda:Dq0RDghxsWhYcC6k0fYSOGS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2557e5c28eafdb3d9a7703b8884b93b9_JaffaCakes118
Files
-
2557e5c28eafdb3d9a7703b8884b93b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
3348b28a42c88d84d0d1e57233fc3fc2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
FreeLibrary
LoadLibraryA
Process32Next
OpenProcess
TerminateProcess
Process32First
CreateToolhelp32Snapshot
SetFilePointer
ReleaseMutex
CreateMutexA
GetCommandLineA
Sleep
GetCurrentThreadId
GetStartupInfoA
ReadFile
lstrcmpA
GetFileAttributesA
SetLastError
lstrcmpiA
lstrcpyA
GetTempPathA
GetTickCount
FindResourceA
LoadResource
HeapFree
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SizeofResource
WriteFile
lstrlenA
CloseHandle
FreeResource
MoveFileA
SetFileAttributesA
DeleteFileA
GetSystemDirectoryA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
lstrcatA
GetLastError
GetProcessHeap
HeapAlloc
GetModuleHandleA
GetProcAddress
SetUnhandledExceptionFilter
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
PostThreadMessageA
wsprintfA
GetInputState
GetMessageA
MessageBoxA
advapi32
AddAce
CloseServiceHandle
RegCreateKeyA
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA
OpenSCManagerA
StartServiceA
OpenServiceA
CreateServiceA
msvcrt
exit
_except_handler3
realloc
malloc
strchr
strncat
??2@YAPAXI@Z
strncpy
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
strstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
_strupr
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
netapi32.dll�
NetUserGetLocalGroups
NetApiBufferFree
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ