�����oo�*�Yz��c@�?�-E�����[z�@�� u)�KS��X���ꄑ(���Vn;�6�ՒL� �0M�N��a?����O�Fg���\%��>ы���ͷ��+*j��n���E��� �#J"��]"�����M���3ږ�:�������]��@[�yL�<VM���j��F����wsk�>o��}&}1��g��e3��#Љ ^���n�n��{Ғ�X�.�I�d!�N�"�S�������ƕ����O#�ox��Lx�����bC&�U"b`��Ə�F��=+%֔�&�+��]�� %%*#5'�M����㩲���>�:��?6m���{ y�JA�k���&��T��S��� �@n���^��ʨ�$������\}4�ݮ�&�� �ɖ](����nU}�ي�[�{���U�w�nOG�@�*�%\� ���_������9����J�� �Ey���(u�����3�Ԋ�_���.��T��w!�����X�LQ��/�Y[L����G����ܫ���������遾!����zɥ�h'ԺL���6���ڴ���:{�M��.lZH�7R��B�{����B�>Fc���u@�̗r�(7�K����9@�Q�Q���t H� �H'R4��{|g�Xҹpe=������Q��� `|K?ꦛNٹ2vl�� X�<ՙm�Zۼ�b�]!.>&�m�ę�O(�h�p콏�L4�g�m���~�V��P�ؙنCw�Z?.��\��x���^l'�V�=Z@�v��� �5F�����.�{�<s�fxq�Cs$����Z����8y���]J{��3+�bp �����Vq̓[�˽�LB��ԷW:@���tx˰���S�Ӳ���$�Ym~y3����<�dd�|Yu����T�S!yϬ�Yh30�_ #s'L:2��Ք*\�+���d��d�k��d Q|f4��5��Q���Pbf���U����)K�}��^d-���(ک�X3{̊^r6C J��;`�b ���%�$!x ʀ6;� 3���E��ӹ��hS���o���s��7q~`��9��;��儹��l�����+h��}�`��Q�ͦ(���,y?<��n�jDdWO���}�v�q0nH���I�o��[5Y���p�4�����g`�*�d�^��C���h�i&�_��L{�`C�$���0�͵ȊZ�:]�gCBRk�����������1��N�V���t3�^�������v��?n�~ʁ��V-�I{އ ��.�%&V�;x��폭�h�ގ�+0�����������3xóo9|'X�/�,�Cn!DF/�vM��iR��Z��<��0��p����e9��!7`�+Ŧj�n���8� �Zu��7�,cc���P�+~��T`j��7A���+m��k�u vF����,��N��B��L��eR͟F������X}�C�]������E��'����{TX����'jx[d�h����`f�}�ϰ��oUPó�i�ی�EJ��=�����I��tF������뚲~1�>b��e�[�h=�=������ "�1�y�c��R'���ˏGk�8���F]Ȟ&�Ӄ�Bp���k�ҥ�mՃ�"��jx��&p����+�Ӗ� �@�7��~�4wA6lq.��v�a����*��8��v�1�卺~�'��M��B���+�ڂ㾧��f;J ��|� �L����E�+&\M�:����ce��J�Ӛ�y�R�#����Q<�jn%ڹ-�In��9$-}�7��/�5�]��u�;g��O��]ڹv�RA�u�aR�+���o^mb%C}������������u���LO���8�l��(u�q��+�iz��:�0amx�D�`�Ո�Z�b�_H���Z���.C�T�} y+ͼ��ȝ3��g����ә�����U!ֹjPBKV>āڶ�RWNy�Y �O�dr��fo�4}��8m�o���������P���K��>N��-V��c�~��J����������ؑ�s�R ��� �����!/TOʦ�[|���������Ri�b��$�� �6�v����'��pL�mçuA���8�ڨ�¨�pT���%�%���U?9�罰��w 6�����b�O���n����Q��� �ޙ�w�)��(��y�� -r9��t���l�z*�z�O;A;���hF4����x*Z}���6C]a{�0KЈ�D`zI�E���1�1 �<�ڤ�Q��)�bc� ��P03P�X�ެD8�03M��n�� �ogS��m�3����1��ɋԥI���6^e�최djB"�ݵ�*_�1�u��x}��P8sh,���c������Dil�t�=lq��gka��d��a��f�����y���?���h%V�o��M3�����#�96'ʌ~�lE�I���/���jh��"���gd�*fM�yO�!�)$�c(S���?�����DBþq8L���G����I�ɇ�ǂ��5)�BݠU�z�����S�>â�J۱�3Ix�� �T��;/�x����/Fk &:�����C�r?a�5~� ? �9��N�o�Z��Z(��2�l����1ԋ��#�&��o�"ĮFħ�m��G�? �z���Y�&�s.����_�)Fu7t�^^U��GIj ���P���&�)툽�HN�B�q ���O�8��ń�2 ��[N� 1���d�z&o��㚧�D���I��y8~h�%;h�/��M����5 ?�y�<c�������)ͅ��8��g[z�>��{�f*��J�NnF�y,^=+�Og�g���O\���|���g�<�h�?4�+�v��`L�,K��DE�3�s֦Z�*�{(�哧*��7�$J~����� �{�Swr���`��i�c��(�^ �K���N�]���+f(���$ �z[�Oi��/Y�|��@��K04�8k�yR4��,P1�=�v�`�j�{����.J�_��MK>Á��zp�v܈�Ew�$�`�<B�n���l�0lܪ��=���6U|"���9�|�<wp�K�HA�=��ʶ�8��W��
Behavioral task
behavioral1
Sample
2dc387e80cf979c12cc484eae9728bfd_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
2dc387e80cf979c12cc484eae9728bfd_JaffaCakes118
-
Size
1.2MB
-
MD5
2dc387e80cf979c12cc484eae9728bfd
-
SHA1
c34797254bc73cc7b3208304be6725c3bd6b9ea2
-
SHA256
c6dc8e7481bba138d36ff777ffb92c713ae441cf3967207e934cc2810a6326a2
-
SHA512
db329415c78f603751037eb989377f25bd1e0d92bc0a596bd33bf8ce838f41388621739afa613b15e08935547b68c5aacac5b9b7f8107e463798dad11126a61a
-
SSDEEP
24576:2BXgUsZToWUHe1mHhuFlj7Lt/9mIun3u88R9B0vqF7gc/YaHH8HNkLqgVFiK5D:2Fm+W4e1iArHLu3p86vq99tnhe4AK5D
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dc387e80cf979c12cc484eae9728bfd_JaffaCakes118
Files
-
2dc387e80cf979c12cc484eae9728bfd_JaffaCakes118.exe windows:4 windows x86 arch:x86
1acf6f626a13e1fce9cd1f2486783f96
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutUnprepareHeader
ws2_32
send
kernel32
SetUnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OffsetRect
MessageBoxA
gdi32
GetMapMode
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
SafeArrayGetElemsize
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetConnectA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 763KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 731KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 341KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE