T�b)` �D��(Mh�T}���A����;j~cI�����f�D4��h�}�i�p�Ik��p�\����m�����A���^���`�T4��(��$��b�F�\��힊^��8dZ�J} �Tp�Y��{��v�l��m�,�E:kO1��Mc����'�J|֚N&��|��[ ��(NDѥ9 ,��M�_ UJ_bg���%,#!�땳��aOO�M���Ɂᄿ�\;9{�tLG��Cs�c3����mޢ?.ҩ�뇫ٌ�x�2��Ȫ����b�XY���9�0+��J��'�a�#��W���8~��Daȵ�n}�x�_����ɜ[9�k��n�S��3��c�GWW6�����T�pɌٌ) ��rN�&JH%=�VK�ʽ�������fs�����+BI�L�?���jG� g�.3ۭ�3B[��S=����9�d����~�G�C�"�L4$�a���9�VǏ�D\�o��ϒ(W�|�a�����W! ����Q����)����6S<����~�ѵ �C��������(S4�߆<A+p�=)�B[J��x����$��裍(�>T�k�4k�� �Q'��(۽˟Z}/Х֮�'7�������Ϙ��ͺ�J2@f5���_T0x2�t]P��8?�:rV��Õ�Y^|�۹��¹���)�T˱��v�L��.!��h0?Ĩ��-&=J6���I�Wn7!*�"�{�(N��d��u:��'�I�� 8��)7�*F�/!�r;��x�T�/���фJB�E�͖�@ۙ�K���������A�������jrm�m(t��;�|�K����s��ɰ�x��.���h��k��,��ͷ�W��s<�B]�;AZ�s�跿?����k�yok�`tG? ud����WB�ͭ�J-#\d����\2�s����}I�����3%p*N�0N�W�:�������0�Y͙�.��⓴%1�����WZ�k��zR�5��bq��C0+[�i�<\���mM"r?�q�Q����U������6>&�Mx���~AQ�Y����]N,s)�]�kq�&0���)qIl�δ�v��ޥw�����%���Ӛ%��Ե7��t���fg!&�04%��!���2K`���`%@DE;��H9O�YŦ���qDŲ�D�d�[��[�X3��&.!" ����>~��y1�x<��u�#"�l�a{<R��zq�gc���YhJ�`�5`����4�Upc�y��N�:^ʼ5A��EmC0�l,wVX�l�Ô�3�ꃻ�D ��F�b���ܣ�����w�F{�������)�x��#�q�Mj�%�,�̅�%$�K~�]�����.�l�cI����A�|Bp�q��chRy��� �ܘ�wlq]�����φ�hF���O|.ȵ:ǔ���GMX�e�>o�(N��S[�y^ �<.w���=������<d����Qa+.'�Q6E��)b��c]� ���m����`W������2?�g֬�x�kbmZ�c�o%q�Jc�E��+�,�H�����O��a0�Y��SehF2�N`j紿�s��!��5��oFSp͏��Wc ٴd�5�;�w�\�J��F%S^�X����+���3��ܷ����?+��:���lz�5 ��HB�@_��9,�����o*�-y*`�{.A�s���x��}O�ZSҚ�Lܩ=6_�K�b[���Q�M�����k��C��_�z��f-�,�g����2E�+�'}}�&�O�q��;7�c!A% ��|!��O�h�+�7 ��$\c�1�R ����}-��[]������ z?�u����QA� M1dla���.�P��XK�7;ȲS{Y>`I�փڄZ�c�5þy���<�NA�n:�5P5j(iJC~g�,��&�`�m��y'h� ��+����ۃ�3(?f}$(��G���L�g�܁Κ�+�cK����PדL����E"E��@d��o�,�m���(_Ox����xϲt(C���4I�\�����NS�`��f���p��DӉ��0�������9�ܱ1�w7�nl��Z��{0��8T�KkfdO90��&{��'�!�!ƅ�)b��J�w#G_�#�'>�/�b�t��$�NRZ��UZҶ�U �$� �Etw���=�i�Ń+8m�C>�ҿ3���0,����5|��w]K������f0�TD-73��$1J�,�� ��W ������/�Cp��g�L�q-�[��4��y�L"����Q����}��.r���Y��#.g<�e��wL|1�&��p�5^���!�� 1�i�_��_��y� �rdHA�Z�������� C+�!�����m�p �FI5#��{#�NP��y.`�%��S�Ԓ*k��b�� ϻT,��g�7�Ҁ�F��o����q3R�Aة%����F�C����n�nˤ="tc�m�Z�p�=���������i�}�'h"q�,����oY�T� ����G�:�k_LF��%A���cuC��à�FN�*8�#�B�T����$��oo�9����sI6�)���jn2jM�О[������a˫�*9�@\�o�����p"*|� ��=q��M|���]ߍ�������zXD���%���i�ʶAn�\k��pt�)�]춞�u��-�/I��± *I������h�ӄ�$s�Ei����5h�H4m|�L�L%��S���}(=�}?�h�6����E7���M�K"V��a�l�F>k/ٗ�h^���?&��'O;�R�B`a8��U��������x�e�9\.J�۠�5M"���5�w��k2��h]P����ֶ0ؖ�q�7Cvҝ}�,�.lI�T���`%�����'����b������ 9�����O�:&3��UI�y�f����Re��4uO�����n�D=a��~҄�؞�}�b�d���4�>h�l��%} ҢP/5��Ŵ�* �u�|����W{s&�ރ���,G\�~�9�̀��`��S�@�� W��uFi�(2�y�YF�'����^��k�C�\n��o��}��ox��/���O��B�<�������$�)�0EnvV��H�������N��~�� �����؈�>��Ǥ����w�V� ��ܺ
Behavioral task
behavioral1
Sample
34f14009eac46b823a221a54b75e5c51_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34f14009eac46b823a221a54b75e5c51_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
34f14009eac46b823a221a54b75e5c51_JaffaCakes118
-
Size
252KB
-
MD5
34f14009eac46b823a221a54b75e5c51
-
SHA1
9738076ccd0dc33037bcba61985d5066820fa37e
-
SHA256
18c2c9965cce7a5bbd1c4fa74db7958c7fb40329a73818adb1d0331f9bf79a26
-
SHA512
d2448647c702159668404110e6c0f02c8787a58296ed5ed02f03ace64211bcb0dd30224bd77e554210a971f8eeda47aececd5f57dff7ac4230793419acdb9988
-
SSDEEP
6144:bYIvW9nsiBTfXGjysvj7Py94zJvhOb/W/ZAng:msKDDsPy94zJvhOiOg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34f14009eac46b823a221a54b75e5c51_JaffaCakes118
Files
-
34f14009eac46b823a221a54b75e5c51_JaffaCakes118.exe windows:5 windows x86 arch:x86
ec490638e6c7aa48f9cdf1fb9dc8a3b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushFileBuffers
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
OpenProcessToken
winmm
timeGetTime
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 245KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ