�gglH��;7�#TkN��YQz��u�R+c�ET���l���$��}Ұ�TKK���`�ӓ��e�k�ӈ��45�"�� ����y�֥�r{y��Z�`���W�F}��0,<�g�ז99�pH���|�KS��&�h�̛���h_�*y��%�͉#8Z����54;��K ��m�*Ÿ�VG9%��IP���u��0���F��E�8��N�Ҏ��d&<�$]]������x�.�+����ҏ6q��:�X��.< "��4ߐ:S�aT��f��87����6%��v��Ɔ|b���4�3�TV�����?&�bp��L&��gӸ\�h%�a3�ݷ�o�L�ӈ<qD�q.�������M<sg�ncl)<�̃�b����ؾuO�V'�nZ�ń��#�v����G�����W%}�~Y�M��{2��QIk&�:!���ˆD0��2�������������0��������_)%�X�����|�[�LҙM�� �\0�EZF�dr�e�����&=ͱ�!߶�Ѐ:�������Ҿ{Um-��������R�(:�-����{b��O��Zx��@��܈�k&0�1\4q)J I�C����dN�O*��pIzdLW|'�\=c��F;�ΐ�V� zK+[���t��%Re ��C>6���Y��Ϸ>>(-���U��O�q'��Ί�o���A��-�>)��9&����q�ѧ����L9�b��ĩ�F���\��{�������NG�/��d���TN�o�7�6\"�2�lBF[���"�䶯�J�� ���9f����F�^����C'��O����k���q�0}ujw����}ع�Қ�^v6�3���/��Do�モ[}; _��+l�%8q����%_�8v�\���ݳ�Lt��Q8ϐ[��WA�p�gw[���-u��2��LF*�'DPv*�jy�3�sts~��;'t���$�5^$�[�E]R�%p���,��DM��I�2G�c�Z (;�ڇ��JQ)Yˢ�9��8tQ"���}ޑ�J�dX�Qc�����Pc�-���R��q��x��bQ���.պwy����+`�T�q��$8�;F��I`�#���!��FTo�,i�A,-��S>����k��y�]B��v�rZ����!��,�p�ߡ�Uo�l�H�;VVԭ>�����*���e�����GӉ��i�|�WQ ����rK��H�(̝n��Aގ�s��,� �r�%lH� �މ�(�?C΅E��^��z�� � $��$"����62ٞ�*yAvGoj�I�O;\(����J�"�y�}�Ǟ��,0�V=5�;a�����3�b�]�EK�B���[��������NyX6ϥ���y�h�A ����b&�����%�3a�{?зS��z�Qv��x.hz�#��)DiK6RHù(h��ƶ�Ӂ�J��ZX���0����%�^d���7Ѡ.͘|>7�l�iuD3չf=��iP���w=s�8���ʋAF��=���4�Ш�w��@9I1F>"�B�����?V���~�*��F�%ٶ!d 8zAc��|�qX;�˂L�3�����d�C�!%��;��K�8$J+:��%Y����N��o�P�G�����[����Z�;X6�i.!�ޖ�s5[�0%Pv ������&��SV��>�g����m��J��+�t5|�A���x��:~�$N� ޙ�8ΫƗ��0�q��i S��e<+����ev ��^^�R]��7^SJ�������A�K[�S�Xel��p=9����`�����[a�B+Y���GD?�5=�:;\� ������0��,!'۞I���Ԑ �[؋�M�*��cb�&a@�k��뤸����UP�Rx4���|�p��������X��+c/�4WDž~TcM���F5�Ȋ� �$>ONg0�1�ˆQX2�g�N�����k��h�%���l�_^���W�ć��/��O���A�t#Xt������P�y�e��쐶��̦!1�"�q�/��F�TBy���SU#��:��H8�qlF�.o�"A2e-��� ��;��"����8W�u�0��@���M5����h:93���`8�}[̔����/����Yoԧ�0��BIӐ���Y����O���ŷ�b��[�a{o���k����V�8>Q�L%�ق�2�bL"梘6��""�*Z�:�!���-�+�wz�w��Hk��p��Ҙ�`�*0���Sf���V�i����9�j!Ow�<����7ښl+�O7a�%^^q���:�7�&pK�'�E���jԲ7�v�tx�\o�e��<qu_�E ���;X�G���8�RT��t�x���ԁbІLP����W��8����;3f�Ƽ�� �n���',4�Nk���8����o��+��G�{�����(tu�՛�#\K��a�3k ���mC��$o�Sѩ��PV=�1��v���O��U�^: L7_�P$�kp���r�xA��䝝��f��w�j�Hӂ>����|�u[{�q�05MK���_َ���F;FW�TPg *�H�<� +������ъn� ���̓(�_���{e]�7@�Xw�b{���\ c��oN�M���� #���q��E= ���I�':N�����$� )��?�]�31���%s�KR��'DmI��=��h��U ��$O�T�PYP������'�Z��#�z�g�m�p��SD*-(�_0a�,\���'�JS�V�eSj�,@��0-�_2��B��u���9���Ja�'�D����Ƃ2�q�I�B��/��R}�x@x:����%E�UB)��7�VAnw��.�FBi�d�@OTxb��R@�ά�QS��;On��k��Y,7;�3��4뷍UK`��RUuY<3^�X��[5����b�垮��I_��fw_����v5���ܤ�^Sv��0��~* $��[�����`h�����~�h�)X+�M�?�ᄔb7�:kp�x�y#��(����aPb�?J��⹙~Z\*�Q�����x9�ET�o%�[���]v� �i���_a�����b����n�G� ��Q���ߨ,�_27R[�*������l� �QGd~
Behavioral task
behavioral1
Sample
348eaf73445326b0b37538f00e4ee0b2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
348eaf73445326b0b37538f00e4ee0b2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
348eaf73445326b0b37538f00e4ee0b2_JaffaCakes118
-
Size
484KB
-
MD5
348eaf73445326b0b37538f00e4ee0b2
-
SHA1
a410a74e977879a31e3e312d55823b1f443c990c
-
SHA256
58a3305e60e836d22e5b0bb68850b92d6077e74c30b0152625052b0680b95c88
-
SHA512
26fd1e1374e77f169e3ef4a0e8551e68b1085f47ca480521ea0202c088e84fe249e2371f927ca2e1e94d5158b58122168f50951a56765cb9641bc55fd05791b8
-
SSDEEP
12288:sa68Ux5GpXshfJzB0t1kHeiNMCygI8TJu0:saQ5GJGfJWtINMufI0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 348eaf73445326b0b37538f00e4ee0b2_JaffaCakes118
Files
-
348eaf73445326b0b37538f00e4ee0b2_JaffaCakes118.exe windows:6 windows x64 arch:x64
2498dc27bdbf408582e0552a6f08cd6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
IsTextUnicode
kernel32
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetAbortProc
user32
ReleaseDC
MessageBoxW
msvcrt
_commode
comdlg32
GetSaveFileNameW
shell32
ShellAboutW
winspool.drv
GetPrinterDriverW
ole32
CoTaskMemFree
shlwapi
SHStrDupW
comctl32
PropertySheetW
oleaut32
SysAllocString
ntdll
RtlLookupFunctionEntry
version
VerQueryValueW
Exports
Exports
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 412B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ