�1�|yL��=����7�V��U* {�э�U�����h���J�ux#�=`�P����H���@����R�HV��e���Q�t�mo�03��i��>�3}��_;)T���Mu��bѴ��N�x��Җ#�Ż'�������(� ��Z��r��©8�/�[��_�g 8a3��� �o�nf"e��MG�AY�P�\[1�hu�UЖgn��:�;������ùØҗXb;��E�FyH/��� ��F�26꿇C`������a~-�=��<�ט%ח�uZ�1�53����jU# ��C�`J����^\�^<z���dґ�s��*��U/~������ ����:E�G�MK����Opݵe�!�F�ȳ���EV��R�:0�v�fQV�ى�!�'IH7~�s�^ӡQD��������ˎ���M۠O���mw�_��r/�%���Tiұ���e��z�SG�R� ���h�J~�E���@&�Z]�82��v���tx2|��Z|����0�CFc��L���x��y��� �3O$����q}����#c9jX�}�ݟ�g�A�"a�$C[+E�P��`�H�S;�ץz3a�j��f�$��T(���%��������oc[�s<\�0�g{.F�s\��O ~�d[�QĄZE�y�k۩%w{WT���{@Yg�Շ�:�-J��n�[*-�*��kC��^��T���0�!�B��� �сi����F ���Q���"�!�ᦗ>�h�|�ڭ?ԹĺUtק��U>Rv@��^2�M�.�(F�?_¯A��N������Y��k=toh��F�Mi�Ւ�<�Xf.����a�7=1���~:jϥЩC���!������~���~��|Gk�[�70~��*D�L�.?MI�ٌƅ���~ ��6ȱ+Emxq��dJ����q��)�;~k̓�bɎ���0�m�rma �Mf#V?�;2���xT>�4]=3k/�')�|QP`�����6�A1m){e� >\�{ �_�����T�\g�����+�H��[��qtrz��3��'�f�^M5������oMuu�tM&��Ȑ�3�hկaV��t��xH��f0�k�Uw��D?[� y��>{����~ř3��Ǘ�v�7��o��֎�ާ�Z� �|���b�U$w8+E#-�%�C�w��F4��%[������ߘx]���iubW+��[t�ߘ�r�Ŵ��{�����n4�0�k:��D��]��#���,��9�;!��7�?�>�qL�LeUU�(eE��02�v����|��K��& �Jz�f;%��ܱs�6��F�}@Z�����{���}(}�(�U]� t�,I���B]X�K?�i�ϖ�3|�~�ő@�x ?�1�I��N>� C���㧚"S�Ԭ�S�c��m��-CߺC3�j����~�@��&��������pa<F(`D���^�.)��s�Pc�*KkIeop�ae[^�^����q�5l �8B����T_�!�W�ϑ�i��/�V��9>�-�i����r��D`*g�f@骿���;�ݥ� ���c^j��e�B�_T�0�R3����)���Z̩�iY����a�C�Dž�+��z:�Ǝ�<���6aT��V���?FU^�\����Ga�������}$���Rm���/%��g[�� `�� l�� �n��yc�Ɵ����g٭>����jٍUZ�����P�TX��0�B��p"��:Jh��FJ&������l��n��!�T��!&���5#��4�3��Xeg�������FUD� 0���-����H�2SC[�8U�y�l���2����y})�G���o^�Q(Es.�;��Wb��#���l=9�l�Z���3�{��B,|��k�K�gSP~� $2�X��H'���НIy� Җ�o�%Lz�X�[�@L��qV~;��3;/�|�"=V��z�'����cF��nE�c������Ҹ\V�B���Y�Ǿ���#�}�k��y�ҩ��a6Pz���6��<���l6������� �M 7���#ˈCQ~ok�x��_j�ڣ� �L����� R�\@q�{�P�4#��x.���U֗pr{�(���^�}W+L��L�8����8��r�X��I�]2����ar\p~�`��m7�8.���b7�[ ��N����m4p���IB0�)����|�wv�XPc�i��bu��] @��N/�F�����0Hq�Ỷ�K@ष�[���RIh�])g� ���u���ˉG�Z$U�sъ�yi�VY}N������JDo�'�G���:9���l~�`v�&6_���s]����}]l֕M̩��=���(�D�.t �Sg�V �L��c�� *H1��&@�����b�G]���7�\�we!��of��Y5 ��6�8 �X>��i�Ⱦ��p�/��{�<�T������ג�μ͍,C?�hJH������B�An���}�^H}r ���B5T:�~�$�)m�� �{��Pjz���9��MHƸ�Dj�P���I�G%P�\�SJK���\1��������b�V��̙Cef";BC�b�l�pq������=I�Pnr�]�eq+�/�,�XKG6b؏3�/d�����/�t6џR5_��SH^��qQ\�s��87�FI˭h�����M߮q����^�V����껩�������'����q�J^x6����1ϝ��:���A>^"Ӌp��&Cc��o^�����Q��p� t���e�XYe���}!�����ž�s������Sw��w�t��8��i� �%T�t��`���,���g�$����KpmsG�M|��� #2��r+�;V����|:��?�]{�8z�Μfh����0��Q��sԂ��{��߳~���IH,B��EP��\��DBR�sW {T����Z� |/< � E=��|5?`VS�T3�1�5T�����Z���~<C���8� ��O����o��z��"�q͌��#���H��_�G�u(n����$vS-�F��<�����"��RpJj���[C$@i���17d��� ���m" 1e�\+��vI��JD®�Bkr?�
Behavioral task
behavioral1
Sample
2a4dbb8643e50abe0c3fd9648d57e9eb_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2a4dbb8643e50abe0c3fd9648d57e9eb_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2a4dbb8643e50abe0c3fd9648d57e9eb_JaffaCakes118
-
Size
6.6MB
-
MD5
2a4dbb8643e50abe0c3fd9648d57e9eb
-
SHA1
3db21dea4aadb7c0314e5837250f68fa9783a373
-
SHA256
0de12bc58d4fddfa8496160ba573349433ea9445010273f6af10570b736b80fd
-
SHA512
4a0f8ad3cdcdea5ecf69b0e158915680ee78266ed609ccf5f3d6d95a356b8a0bd27fc4353c15310e5fe05de6bf9086006590776ec26c4c558083af72d72cba1e
-
SSDEEP
196608:DUPtOeB3kiL/sDUeD8S0rKYDIHjhtk8L:DCcGJEAeDdCvkm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a4dbb8643e50abe0c3fd9648d57e9eb_JaffaCakes118
Files
-
2a4dbb8643e50abe0c3fd9648d57e9eb_JaffaCakes118.exe windows:6 windows x86 arch:x86
324c079906cc0de7dc0c4611106f0606
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnhandledExceptionFilter
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?__ExceptionPtrCurrentException@@YAXPAX@Z
imm32
ImmSetCompositionWindow
ws2_32
getaddrinfo
crypt32
CertOpenStore
wldap32
ord200
normaliz
IdnToAscii
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
vcruntime140
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
floor
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 527KB - Virtual size: 526KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 678KB - Virtual size: 677KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ