�+ew�<<��M�o����<��`�v���0^V��'�[�cc/:��+.�A���i7I-��7ȅ&�����'��Y�ҎBi����:�Ÿ�T�-%��i�+ޣ ���R����E��A�k���1���[2��~ �`0����y揵[a+H���������� x�wX�a�j��Mo84/%F�%����H�6؟;��پA��EuJݴ ����aH���Y����I3糃�?��=�N3���?zPN %��{j���l؞B�,�U�J$&�����t�zo�-H:�����P n�9�7D_�1�L��O�c�Y�i�1�Y��.�(��E+@��0�;������R+�]���P�߁T�vjs:�|��`���7l��1�q~�7�#y�f�X33>�T�} ����2옧��X��2G8j��|1�� ����1��E�`a���dz��P�e/�����I'�]r��G�ZkӼ�%=<9�%��CvԤc�Vp�Ln��@�� 8�!Ҩ%�����"��E�b,_[��@ W��'�Z�3��Zȅ���=b��]���"����N��{"�)�?91�aɊ6����G? ��]L� e�Y��؟W�-� ��DY���fC&/Z;�%�������8����nM�S������%}⫷�E����,�^Z@mJy A�}S�]��}��,�V�!�nə�d�נ[�������i!�O����ȯ����|Ĩ����V6 �|�� ��E�C!�±I�ʝ$?������=���� ���`�d"3F���ٚ���P�W�0ѱ�x݈;W�+�J֛�j ���#X���K����3eJi�'�|�z�[u������c����������M6�$��z÷����*b˪h�H'4�/��TT!�S �����<��֡p3����u�0���!&�� U�\#��9��68�{��/���?��kl7�rev}e<j��C����y�寧ll����w��҅�m�� r���/��Oۺ��{$q�e��-��@�MGuA��q���n�����+��"V�T��� ��537S��J�C��[7*!����p5�`�yd�䎦uB;+r9}6,c����v�2�(ۺ�-��Ј��D3՚�؍�����+�TKU�ժ�4kY ynw�8J^�p�Eq(� �\p���I��� ۔�$P�T�fmW���С�%�@� ��3~��_G_�h�,�fi�fZ_/S�z�Zbb�]��h����B����tf47�~���gL���a���d�$��R#���|��+a���zS����w��CW�u2\9�Ph�]d�=� L�Y6#���'.-����/�V��c�����3n��ߞ�������(;�͘+�j�ܫs��`L��s��&���~L�X"/��Y'�f�>����^�3�,�G�#~5m��@��������{]}t%����Ƭ.%�c���KtA��ff�h�gL��5�)��u�о?zm���7�B& 4ѱ����H�YG�Ҟ�inІBTXւ�Vb�ⶎ�<7�{lR��T�����z Z�b*��A�f�gе?� �#q��G]A:��Z?=<S6��>�z)���[r4NH�\?�ĭrp���b�� ��{��ڦ���#����9+�2'��>3�j��V���ެ�b�uV���]㠆N�Q�pC����[,\Z�}f������?�K�|jh�EQ�[��XП4���FG���6sn�W��6���Z�Dpx8Z5��AD*�\T *y%%��Id��D��X������[��O���W:�E�>�zDpo}�AA���-�66��ٷ���l�}��}��eȭ��UW*�;�`��s���-� 5�_T`pG��_��w�A�����F����t��-��]�W�.<�'��Cs"�I��(��p�䌓!p��)�^��=#9u�EWKW@)��&`���{� >���|�n7��盉ٽ̸R���#T�+""s&�t�����J���Crndo�aY�����R�b�u]Г�8�� �֟7@�r�8�Zۥ�8�1� ���_���cЂϵ�9TfG�e�MB�R1��q������kvſVd+[D��ND�B�����sr�s�H*qe3�����3��գ5���B�ܮ�H߬�(b,�#������ � ��cJ�u���q-�O�6�n�˅�iv���/ :|�ë~��n"�t\0i�J�jv[!�ʃ2�5[���ZK-�b�1�*i��mY;\�A�f� �o �?���`M���+;c]r���e�; �& j���z��:p�Tyr��[B�� �qT0 s�t��y~��,}93:�3��5� Q���.)��P�{[c��%� .r������� �Ł)��W����x�D���ȟ��R� ��{��N.�����l��U�X��q;������5xg�{9��N8��f�����ߝ�G��m�j�7�x� ���jS'~��>�&�ܷ�U��c.��&;%�*�����D�7��4pM���]k�3B��U�n;�lk��!>7�Y�*�{���q���қ�&���|�DV�`�����B�D�[�@ N�v,�o Y��o��}�&�~g"��OF4+d�]��W1��}�~c9�С-�?�6`j��L��\�8�.F�H �k${�<�������ZN�x���B��Y$�%�vqT�3����-����^Q|��T�MsHX�����Y�R�����6Ǐ�"���05��E� W?4�՛@�o��6 ���l`3�J�3<2�G�h�,+[����*���>'F1�,�|��)�3nr����z��$z �����7�W��CfN�H��j's.z�u�I��<�+ڦ7�NW6��ǹ��MI��h�bʢm�u��� D�p �bS%O_��ѯ1@���w�j��O�ދI��ӹ�k[�����|s���T���4���2 ~M�r=�e�5]��?���a-=�*�R��H(��#�R�.?0������,�������YHK��IP8r�l���ζQ�}�-���0Z;��2-��I� ]��;�*T�*�<N:�&1nV�OH��M�
Behavioral task
behavioral1
Sample
26e03af49190279729c5cdda4d2405b0_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
26e03af49190279729c5cdda4d2405b0_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
26e03af49190279729c5cdda4d2405b0_JaffaCakes118
-
Size
948KB
-
MD5
26e03af49190279729c5cdda4d2405b0
-
SHA1
04031cc0501a2f35f20be6dcbe854c71011aab39
-
SHA256
cb5465f4fe5a02d4c398f5a0e4fef2f0e35ac698669bc41abfedac371187970a
-
SHA512
b7ae9c78a8c6a24f442f5da050b27e7f23d888aeeda2b6c1dc1e77cfbd513ace885e3ad231b5a99e0c4c46f0b845bd47c93cdfbbc1bbd947ebb61c36e7439a97
-
SSDEEP
24576:ihKgxM0Ub9KmytDtAeCqUeANAXm1SAzWhSggbzgLNB52EvMuY:TymytDtJCBzOW1t8SggngLNXZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26e03af49190279729c5cdda4d2405b0_JaffaCakes118
Files
-
26e03af49190279729c5cdda4d2405b0_JaffaCakes118.exe windows:4 windows x86 arch:x86
a13e28cac7cd68486118e458a1d300fc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetScrollPos
gdi32
DPtoLP
winmm
midiOutPrepareHeader
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
VariantClear
comctl32
ImageList_Read
oledlg
ord8
ws2_32
recv
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 667KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 393KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 836KB - Virtual size: 833KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE