��[�5���ќ"G�Y^#QUJGrͱF�}t��y��LI���� Q�\�VX��_`G���G\l��ڿ�;'�$�ȭ�F���Sh�>�#��ċ���Y�9�RYl�����aKRPߤ>��_� ݗ�Z�|9�����8Ĩ���\�B���%�Rn����w��?�X.��� �ͽ�/��u���B��:Hl�t�(���O�9���y�r�DT�ۥ��j0�����"��g��%@�I^�z����Nt�@ ���i��@^&�M�IRAW��P��\p�U�1������m�5-̲;�$;�lG2@��|(ב���3������:'D�bkK� ��T>��h�7�`����y�8��ٶ��-�V$W����Vn{��9�rF3Wద �&I�R�M{Q�q��b�/�����r$ ���u�յ8�A��RV��z�D�`ir���Pj���~��p���j&�/�<�m�q�5R��OH�RS�7|V�E�b,0_�����M�m:Y��a\�S�9�EAS��C��^q�v��Q�����U�W���I���B�lo�ƾݽ A��S.��-���L �A����@Pߌ]�h��&��- }\Ӳbʙuy�a�ל�=ˎ(WY��s�*)�ALR��t6�D:2�z�UY���*ZfxK�}&y��02�}Nvx6���"-�x�@�f���ONROn��15� (z�[��~��d�TT���+�!!�"� |����BP�i�8������|wH��(`���.=�0t��/X�_+��U_�M 9)�'4�S���F�Iq�b"T�@��3O��X/��ͺ);NjxDl(@�-�m��R�&H,Ei�<߲�4P�m ϼ��C�M$!�裻�Dz4]E��J�Q�O�^�!�یZ9�R�H�Nص�8�VD)y�����=���4��;��/��v����9�~+\�w�$�Q2'7��I�k�.3[i��0)d�T��!����ʞd�c:���2sB��6�4(K�_�Ţ�&9��F�qAja8��)S��RqMpOԪ.����w� �# J�*���X��anȳ��@���ٙ�31���i����S��8��Mq��*��a�UmG�IƎ}�n�8��W�j�h� SA��U����n:����R[���5$x49�Cf����|i����}d���w���(��-�~�e�����K8�W��^��n���]�)q���]0f���S��~���O$��o�� �?����>��3��3w�يkJ!��4�-�ɇ����p��� l}�O�g��f%�GOB��|�u��f��(A�C�j�������2��]�E���i���3�,Ϲ�Ӫ�7�v @u�Z�zv��H�WL�����a��\�淯�<��F�}Փ����7)i(�`�>gS�($t!)��yQ(�ȱ�e#�,��b����y��zm�G����*�?�Hdd��漡Z:D��h�6g��b�(Kr>�5m ��Y۵-�aQ)/��M'���-@س}�kh�(zt��%|fj��Mw�t�s������ņʵ������F�Ŧ��)�T���H��7mڬ5�X�P�]�cʡ�hHJO'G ��l�13i� Vn_�K��<!�qB)����vT�:Þ2<Ȑ�{}���NG��d�iW�g��8�~uLd���U����Ca�3ÖwT ]�L�S�{�:Q��'���w���ɿ�da����l �m�5c�ڊV�<���Y,�p��&�{�*��(?��2��]ݹiO��6߂ 3�R�i��Ǚ��%�i=N$%) ��������qgo|J&����Yf�����I�@5W��~"��Q-���/0;�z�h#�^�w����P�~��\͔m''��8��� ��* ��r�t�F3��d��k�����!�_:�R��J>~���I/@��h6�ۜ�<��(� L-\ƾ��(7h:σ�,)�.�`�%�$7�u�-�������W�#e��h�l. ���3�aœ� ��PV��9�v�S&��{�8ְl���1�\�P-4�3��"S���N�����!m�CM��Xҭf�#�^{xV�X�yy���3��u���U��/��V9%�d�K�s�$����I������(f�!�X�}9��Um�i4P ��p�q�t�������SϤT����D/��7����������RBƇ��"����Ǯ!�A�c�17�-h�|N%'"/ni='X�!>ܿ�{&����;~��%�D9_����EȀ�5��ES%ř������� 'HL��٨�؉z{B]{ц����4�K�0��R�W�1�ț�]�̝��˽�RV��g���7�Dj e|�"GR�a(B��_����hD�����j=�'����5�{��1�(K�����>��Zo��7��υ��.�/eӜ���̉�H`�24C���PG-p�������ⵜ���� t�@[lHJF6r<h��4����P`A^'�q�3�2��NF��aC���g�y�b�}F�W7�%���Zs�w��D��ʅo�1�T��Y!�L����|j�Z���#\验u�}"��Z�.�:����zR!�Wp�@RN���Ɗ��'��$݃��M�����_�֥]���Ŝ��aẢ�k�mO�m�D�f�yOإ_ߟ�v �Z|�}�}@��_����l�؊_��d����������@���ev�u�χ�8h�F��#�Kv��a��j�Vr�LՊ�)�7�qDJ��gI!�[�6����©�f��u�Ox�Am�^v�A������Ok ����{�L^D��҆������uK�V7l��M2¨����Aؠ &� 7�M�]��"�����������"��w��HdT�cR�>`}9� �^k"]���O�Ղ[[��7�A'��)�1-��q��ΐD��]����6+juB|�3x�q`�ĭ�n��`�K�K���@Pm9���"����Ʊb�h13�]|!��0��W���''�`�B���Lo�*?1�����i��;b��~��mر�0>���5M������#!��GͼC*t���S� �
Behavioral task
behavioral1
Sample
2f6907672853d7d0f0b0841d3e90b5bf_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2f6907672853d7d0f0b0841d3e90b5bf_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2f6907672853d7d0f0b0841d3e90b5bf_JaffaCakes118
-
Size
764KB
-
MD5
2f6907672853d7d0f0b0841d3e90b5bf
-
SHA1
69ba62a07d8d6215bb0526e0d9c7aa03c102df1a
-
SHA256
c8ada3fb88384fb067b8c2c5d1656a9cb428d2f360c2e98bb5221113e94dafb2
-
SHA512
4596404991c385511bd681107c0fbd89c6f96361c11344c21af7f9f7b14760b9fe5fb8f177478667f6232b6ecf358d2ef8041a6e7995599fe29d1e35b9a1e7f9
-
SSDEEP
12288:cgxKsYBupylgNDje6VjCpr3BgIJ7BQT8ocp3C9Wws6nPymqE/FcA3BNB7pzcWrlC:j0yXe6VjSr3PzQIo4C/PPvn66JL5Pvy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f6907672853d7d0f0b0841d3e90b5bf_JaffaCakes118
Files
-
2f6907672853d7d0f0b0841d3e90b5bf_JaffaCakes118.exe windows:4 windows x86 arch:x86
d599e02ec8a24445897822352250da38
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
iphlpapi
GetAdaptersInfo
winmm
waveOutGetNumDevs
ws2_32
WSAAsyncSelect
kernel32
CompareStringW
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CheckMenuItem
gdi32
GetTextColor
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
VariantChangeType
comctl32
ord17
oledlg
ord8
wininet
HttpOpenRequestA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 561KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 337KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 748KB - Virtual size: 745KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE