�Kn4j�f/d@a�j?��BrKv��c�ފ-6.�c��<~�{���c���Q�STK��e]f� ͻYH+��Z���¦�kV�pN;?�_�.��,]�ӫ2y��-1��堨r�B��te�fjh����Ht��V�>B�z R�"���B+E\$(Ke���kB "�Y�~��%�S���{�[W�X���x}�n��$��4���ׇ_p lI�X��<��yo����$F�,�^�3{�s��K��`Z�la�am��]�p��fNi��?I��T�Ӫ�)q�'[f�)ka�Bf��y��e2Z������F���'&�g��� )�'��LV|�Tpo��q�6�UL#��Oc������0�����������F��l�"�"��y��.��+�L^�;����h����V�ܾd��"���}%Q�y\�����Y��I=�)k���Z̦^�����K�q�������R� ���KU@ڐ�j ���ޏ$����T��R���d�'&�C WN�mH&Y�q���' )ȫ���Iݛ���� Y֡7pZ���J1&h����n̢g��1@�˛�D,X���9�FXp�K�������~�^�П�2�C�5�ۺVؕݩaq�^\u�K�xՑk���̪P87tc��0_�j�����jd��^-l]H�Q"Dk ɴ�6��_Aɸ�+�F�Y�01 %(� N��F�O�9z7u"w0�8�oCꎼ��v%�� �. �_n2���;y6�L?5�:Q�;������se��Er~���61��̶����2�*�Cg�z�~I<��#E�-��T�q�Y 7N@5�as���$�$̨L���Kar�+�\�]n���vAb"\~��*5���������x<p����c�}�j�\hH�6ڵ�U?-��6����n+�j��� ���4���tˊ�r@Y�<R����i\ <��F�[^�sđ=��)Z��B+��7��M�B����j����{-�R�� <��5jj�W�F��aP�^�1�Ec��"��$��/R�0w���|���@������z��1�A����j-��/`D��,�zޖ�!�ww���HD+�ʦ�Q;ƍ��~ ��7N��K~���R^��ϸ�J��A���\����7���85g���������i_�籄�ۭ�����D^��W���h��#�pF�?ru�`-������yZj@�Ȍ�D}���4� ��8��t����a��vŨ�*�88����[Q�Մt�lHZ��4kyNJO�b1fM6�40h4o��+��K@�K�����F����zJ�k���U-oȉ�J�7�K��2���9"����U�k�k���>|��K�(�s�8�i/M��������ܒ��q��U�������F��q�3~���̹�e7~rP͜���]��5��x1p�H���~�%F3]HIY3��^A R[����;D.K1A�|M�XFV�ʛc����� b%����t�Έ� c�M��������+��L�_ηƃ�"�lfQ�*b`�-�KJW�J��ʮ� Y$�����z`t�rK��K��U�6�#&��{���Ut�������8ڿ��b>�*��� �O�Eܻ5g���:Vi�P �:����]�8��ũ�/��>���%\�X1� �WC��as���N���x�W��k�����P��hhֈ���q;�9�A�]�֡3��j� �+�ꚴ˒_�$����]�c�I���s¼����գ����WX�x�����.>;�_��@������j�z���@أ�� ��Ѹ�'I=H���u��+�%��ՙdKM&D�0�����z\ؘ�3C���@I��N6f���t���"�N�s��b�6��ȅy ��4�d�L+��io�`T$M�Q���Y��:��6����+ fw���+8����MiJ+$��]�4�0L�lzD��k��Y ��lsՃ&TY��Hl���v��8��*�R���u�XL�J�����������N����[t����cC��+��جi]I�eRVߢ��A#"T�����6�х{��dz ���H�L�~� *���ɧ���2��'*�?���3�®�&)���D����O�$T��u������I���m�q E��e� ���N<B���'�ح�s$��1]b� 0��Y�Id��4�?/��K����CQ@��O�czJ������b�ϋ�{���DF��,9b�ߨeh9EN2���9����ZY��foi���˗>WS�%�}��uĉ��U'��a_.nbC정Qt� #�'.!���]�Q%3Oj��5���]�E&ũ�㽌�x�/F��Ԗȳf ?������% ��C��?����~��7>�ZfV����\L5��Ճw;.3y�'fm�bPPK�B����9�g�ߨ��B!�CY ^�Y{��~��*��w�;T���T��NDA�.k��@슚���/���l �~C� a̫��� �NV;�Ϥ�����:�w��=.�@$��˭���K��>$�.���XH�d�"'�Á})��w8m��]�TPT]��X�me�8��זOo)R9lK{.��f���Fd�h]$�^��ʛAF���r��t��̯9u4��Gf���=��i�P*�������ѝ�ho���9��RӸ��q;�UM]w�Sp�yȭ���ތ�̇�`J�=c%ۅ��l"LL��Rg�7�h�=ifl����[�cum�O�{��?h���6[����̌Ѱ�il��8����i�ק}���.�����d����*��#��k�h�9��OB*�L4j��2�E�ݔln0�t4,U��4; �T+m�1t U�J��I�ՙ�w��\�.� k56�^�!.���H-)�F�Ooru� (�@)F�\1��UQYj�����d��Y�)4r,���s��)�b�?�U0B��UZ>��(D�,ϡoޡ�.Z���c�/Gy�0L_��j�+y�}I�]�"l]8�����d�tfFx���3�R�E#+&�g���S��/W���h��Q�Z���n�K?�F�<���q��(q�Q��W}������{:������N�(\��
Behavioral task
behavioral1
Sample
29cd7b667f2afd919b143d3738aff810_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
29cd7b667f2afd919b143d3738aff810_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
29cd7b667f2afd919b143d3738aff810_JaffaCakes118
-
Size
177KB
-
MD5
29cd7b667f2afd919b143d3738aff810
-
SHA1
d021aff98851727f0f925f5597561410e5b7e7a9
-
SHA256
aa4c68e1b06df16ce1ebe06b201704a829a002ddf6483275416a2df88fa54002
-
SHA512
017517efa099c288ad4ed2c07a91fb2e19d1b828645b2ad5beeadc2b2289e5258d580063c7c70c956f03a7ae5a65118425837027c8d00768d6e90bffc8b334ad
-
SSDEEP
3072:mmPnzalgGGoytu25wRxypzGyQneEgPMcFFbzZb4mgBaq6ORZwzivjio5rWvwb6QB:5UhGNY8mxyp6yQneTXFFJb4mgVFjwWrX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29cd7b667f2afd919b143d3738aff810_JaffaCakes118
Files
-
29cd7b667f2afd919b143d3738aff810_JaffaCakes118.exe windows:4 windows x86 arch:x86
60cb68a1c1677e79bf2847178fd98461
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
AdjustTokenPrivileges
gdi32
GetDIBits
msvcrt
_acmdln
shell32
ShellExecuteA
user32
wsprintfA
MessageBoxA
ws2_32
WSAStartup
Exports
Exports
Sections
.text Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ