`�I��!da�y82Gь�t*[����U?����na���(J��.�3 �k�ɕ�V]� �_����T�������k��'��YN� �sG�*��魣��H�u��.��E�L�Ȓ���:x�0'��z�띗�K#��AA.祬�<�Hp�������7b�LB6(�oFwz�A:�[������_�t��7�[�� ���J�G�/߭��� �n��#8��dO����`R��5{"3�,#�+�֊��]�y$�0s&W��۹�a�d|XIN89IF�!��fB�j��t�?0�bMp�21����u�)*j�ŭ)+8J��e�m ����Aҭ�|V�ɓ�,�c:����� ��5����ZK6詐 ;�a<ϣ?����6I�u��Qx���ls�TX�-�&���+(VÚ`��ru��RC�����X����� x�EG��Z*ۃ4Q3�M>�Tź~ SP� ���%[��@���:*��P� �)=�����0�����o#�VcY��y@���=k �b=OxG���L�6��bcH@�]���e���>I�( �2O��pO�S0���°k;w�� ,��8�����M�!�P��ѧ q��s���H��m\�p�e�p4����)`���M�@`�iT�(���ۘ���&��fK*�@ќ!�gZ������9��tG�\����̃����Ա��J �#+BӀ�n>��������J_��9 ��Z�7��3�(UH>h�� ����rA;9S�:8��<Y����>d�Srg�5a{���q?�u2Z5v�&���#�� u���� dR�5~:��(�{K�ï�1��~��6�db�@̼����`��pج�@K�I�6��ubp?J�(�ڥ����8e�D:�m�^Y^E�|[��|t�_�ʸU8���ʚU�W&[|�KC|e��Sq�q��,����~�Ջ��_�o��uJ"����ω�_��^���Q�e����)�O��� �O�R1�c˭�������M�BDZ�?�'�-WCQ�����@{_�J>�U��X<�?-�8�9��!�Ć�H�IoB&(��V�u�qͩ��� c(9�3c!��q4�c6�AȮd+�ovSn�cu:��=}Z�H�3��S�UI��#q�����Ŀ&�$�%]�k���?t-D�\�*�< d�\<q-�B,��6�$�Q�� ���JKC��.���s�.j؊���*7=��u�Ǝ.��ژ�9F�F:S�����{�s?.����mh\��Ё�x�����+z����$��b�F����Lq+��\�V�����a�@�F�`�[�_�9��<L�9k�P��چr�p��]g�%�TY�����?8�.�NB�̝4N(�oi�ژ"g����1Cm� �R�n �!�$6 �������jL~�=Ku�(z���L����7j��v��OC�v}-5b%�$~A��io��Ps�<L��uT.�H��B1�P.����q)��� �手)q�?��� �o.�7^S;�l���8P l/4ܚ�\o"��}z�]ΪCC�F�.�1�n?CU騱Y#����.Q�-��+�����a��A�ŕ������W�z���6g�U�C�l<��hj>�v�FPAJ�?% (�p&uS6/�9� �=M��T����W����<� 卣��G��1����m9j����c�t�����������ځ O/�}�k�czi�3c� �*�~�|ep�( U谶������_'~x��?��k�0��M�� >B1�w��3m�f֝y����wu���x�7>� +�T���%]�� ��i �C76�E�q�/�����ӂ�C�J�jU�5А�ׄ���YMT���%�u�>N8�'V��F��v�i&0{��i����������,�&X|��m_Н?l��05�ö��)Qk���mM��{Z��!�<��b7g{�������v��ʄ9�ƚ�B��g��N�|�@ x%sg,� V��ց�I.S�t|l�� �� �]G�A��,��@�C���=��:H�ϲ�RN�,��a��\� p8J��ø�� 2�`�{�����x��g˱�`�s�q:#$&26ء9� Y���k��mU��d�v�����D�Gc������_P�d6l*�����2oaye�Q��A|MK�l�2��]f�m�Y���e.tW���wmP�o��X �(-_RD��)fb�T�?�!\-0�������#����Hk���C\2,W��0� �9_V��^.����f-�\G���J�m��@ɤ�?�����,=N�������h��P6Ө������A��J]�^arD�WHҥY'��TK�||k}>���¼��/�LBĜ�c鱬�N���?���ک�%GKbK��h�s<��+Q�����}��W���uol�3����?��q��@<���s-�î�L�r��X"����j���(��O����ʕ�>�?͊B+}\����Upa�;�sxh3Kv@LɎ^\|ꝉ���>y!�{v������m~�eUQ��/���{�� VwѠ. �ɏQ���_~t��UE������1�rڇ"uo�y�}�ϐLS?��<k����xc��'�G�w�z}{x����ҙ�r�Jeh���YSJ��$�jӨm<�X��}J>�d4�/ڞm!X��k��Td��U�j��; ��'�z"�4n�\���{���@�r�T�s��7��|��9�]z3�[��� �����0MϤ����������.S����T�kh��i��(� o���3~<��*:�fq��i���W��k'�sZkȲ��?hTT��!��F��Y4�Yi���|�e���'q������d=���XIIbb��*�X�u=�E!�ȘM=*@�PכɃB<�T ?�����Y�����`J�_*��$(=�C�����!f���dL���v�eT��G�b�Ge�6�I�"���)�PEH8��_`����>�p�}��W�j{"� E����O���1�2B�D�'�S��� ����������E=�\o+]��"YM����UJS�ܺ��ޔ��L���oX+��bj��zA�7��]
Behavioral task
behavioral1
Sample
296ff1af10516ff3044d8baa1642b9a4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
296ff1af10516ff3044d8baa1642b9a4_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
296ff1af10516ff3044d8baa1642b9a4_JaffaCakes118
-
Size
5.1MB
-
MD5
296ff1af10516ff3044d8baa1642b9a4
-
SHA1
cac79a1ade249dae74d413d32c63fe22ed0a2277
-
SHA256
e38399541b75352bd7667a4755796ce0d74c8ec152adba7777bd536c4208a254
-
SHA512
889a88c52d659313929a26c0a3bdc534252adb88f93e2502b08a47d51c55ccaf63f9fd693dffee01c0febb2ff80e3c59d4f3cf1d7ff2240cb6b6c9386dc20868
-
SSDEEP
98304:MSvvrkN7rhM1JMxEEE303UBG4Yo9zfIcixo2aSYFX2mmG:cNRMj0EBG/oNB8FaSYp2mmG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 296ff1af10516ff3044d8baa1642b9a4_JaffaCakes118
Files
-
296ff1af10516ff3044d8baa1642b9a4_JaffaCakes118.exe windows:6 windows x86 arch:x86
bce0c97cc97c57f33aedc49bb3e73990
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
urlmon
URLDownloadToFileW
vcruntime140d
memset
ucrtbased
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ