���\�K��Z���T�U�wNdW�9'�t[T59ˆC9H��Q�<���=��d�@��%G�c���{���K]�͉YyS�b�C����~�n���B��Ӂw�%�f�X �[xh�,ͯ��0�z��,c��)�X%*<Q��4�ɛ���{�����t��~�W�RA���O��O蜁cj)*Vf߱��E'�|��(D�H�V-XB�746ԋ�4��J��8}tD�ˆ���3��8����+�_�R���y!�� V^�ߒ9�Z�lD{J/J���ӛ6��@��f�4E]G�Y*���拨D�mՇ���~��� (���X�s�l璻 q_��V���� �Z%���1;��i��v�e��hB_���!�����LA�����ԝ+&�t_�J�}�����U�4�2�� ]� _��:�17<�VN��{ۆPVY`�e���͟H R�XJ�$�&$�\�@�t=�c���mYN�j�����}����V{75ܥЖ&���d�W}N�p:K�YB���"��~/����]%�!�l����Nf��X��F�U_������Cœ�\!�E�Z��CV݄��u Z ��Rw���GFد����%e62���[/��rX����ܠ�r��6��Vؖ�tuǑ�S21�:���L�2��u��F��w��3o��x剹t���N���N1k�x(c�Ӎ�G�c_>D��,���@�l�T��Mp�piZ���]�Ju��;Q��:F���G(�iyҢg��X��# ����m˸3HL6�H?�#h "�㒾���u�����?��ѹ�iP���U��b���m=�!����c� �w���>"z�< |RE�g.N�jqaN���%(ǚ|���?u��gқIz��%_�։}:GrT)#e{�&bx�[~�ʏ��Y��㣤i�p{�9�e��v��7�C�5 0������� ^t��s�^X��nD��&#�k+ɐ�9���l1@�d ����.���o���������@D������\�Vz �o�R�G�����؏a�$GX�Vɸ��Q��o��u�[�M���ḍQQ�滳@���2?��bn�8�NmƉ���,�=i�O_@��'���v�j����VS �Ui�Yx�}*�G����F��}c�)l_�c̀�k�pZS�4�G��ʌep ���f��K�����(vť�K�����=�Y�^�OΥ�]n,.���e�^*��ߕ� �\y�>�}n���17�㢇�=�P#͒.�2�1�b7?��y�g�A+�zzH��߶qYn�v��W�'���+�UK{������X�����@��}�UCn���������u�H-cBu����n�8g3q��y��(�����jo� &��J� ����E�i�����><P��=-+s��>���NRE�1�J��\�0��r<��'TH�R�����X���ztr��aR��~lIf8��Ū�|XJ��F���=7n�ʼH,*���̯s\ѫ�y�?f�&��-ҶWd��?F",.�+?���ƇI<��ؐ�ڞ��ӨrQ��7P���X��S��,jMI�����xΖ&�^��r�a�3��3v�f�C�6!�/t"��]�ӇsQu ִ^oD���et-`��_��t�h~/��E���@� ��=� t+Ӄ��f�����c^N��wE�������"��?M�h9_rg�����&�Hf{� ���������H���$�Y��pt��Dg���ͬK�r��}��x��Zi�{)j������3F@�sl�|����= ���k�`�58��D��T��܊��h��cE��A���Z{��������В'���ò��$�QE��zG:\J�]�3A��V�a]�O�0oJډ��� �SI_�}�mͪu�cIe;�V��e��-�X�bhѭ��8��XзJs���q���i�,���ԫ����|�<Ud�u�un�ƅ�јZ�P��cOG�-?�Ȗ�8�%#|O&>���`"wau�ݙ6��F]3��P��������>�{�sUw��T\6���U���&1���!�3����ź��맯ҬV�aR_1�Rg�k����3W(��p!�wS)�Jx�̼/�FG��������+GV9hmۢˍ�~��@��5s�sPR|����K��ȋ%�2ČF��T�b�a�J���p�F�-��"=d���/���{c-�:� �H�� ^6����Y��F�,����/�s�5��-���2���$gF������������������{�ƀR_�g���.�9���oh�o8���V�6�����e��?d^c�ߊ��:��CTBgw53�CAd<��.R�S�,��a<b�?E1Ҋ��x���:�� ��ߎ%]֥nV�� �d��> �c��Vmp�g�z=˰ۅ���8ˣI��A�U0�=���h����}�*% h_Cs��}@-[�#�i{!SF1`���}#�0� !��K��ޖ��RyV�I�Ձ��*�Ԅ� Qy�8�Ɔ��먧I�e^cd��~�^5J����@��WFT_����L�Jq�/� �q.ٰe�!<�o_� ��pt�0�� �/�#��2�9���dj����[b@L�E�e1q�VǴĨDҨa����8s1%4 �B�xy kS�s�-3��v��Ae�#����6kb����1]���wAeO�|Y��1�]��q=�w�]�n��� S�o������ jH] � �J�� �JF�Kz��5_g̣���mY��Y�9��K�%Z.��`����D�4͘�o�%���I��֬���X� ������sԖ��Y�����-<�lQ�~�qX�G�=�������=��V�CU��;�a�B�תC��}`���`� M��y͂w�e؊kUcɽPG`$A87_�v���9�������m9ⶮ��(��x}����]&ٵ��1@C���[y��W�,p��lMn�tαٮƒ8\��Z�O>�WÎg�f�����u���Á�an8duZ���$(�w�s�!bz���c�szC��Qb��f�7�)�Ԥ�{��=^�Fz3~ӝ?�
Behavioral task
behavioral1
Sample
2d046a4c1bc77dc168b6580f0230087d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2d046a4c1bc77dc168b6580f0230087d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2d046a4c1bc77dc168b6580f0230087d_JaffaCakes118
-
Size
5.3MB
-
MD5
2d046a4c1bc77dc168b6580f0230087d
-
SHA1
b26825ed97605859f67f24c3fe4a01b1aa7722ea
-
SHA256
bf426c73104051ba9161f7f9188beece4869e78b7e316d6da210058ad7ab2617
-
SHA512
0dd206ee38bd19be8c4df21f7d9a0d3008b97893604dc232b898f099dc3414eb174f596fac420eac323c32f7100eea0235b8d803845859e48d38dca9e925f498
-
SSDEEP
98304:IJSExEaWAIhpzpJq35nyhmgMn+KbAOrS+JEqOlwg2HesPKW1BP1Xj5VXI:G3NW9rD05noDMn+oAfqPg2+sB1VXI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d046a4c1bc77dc168b6580f0230087d_JaffaCakes118
Files
-
2d046a4c1bc77dc168b6580f0230087d_JaffaCakes118.exe windows:6 windows x64 arch:x64
c8a693d98dd5cefa069fd76cc9f73ff3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
WSAStartup
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ