�F�X5y���f�U~C�����Ѐ:��"v����>f&B�;?�|T*cW5�q�WR���>K4 x� t�} ��,����ꅚ��q�4eh|a*���Б5��71�z(�LL��_݄�l��e������5���5W��q�箖�[�@7u��]9�N�QX��!1Ԏ����"�M���<���TV|�G����U'ь����;�h�s4LAPa�ʛkRp���F�KPi�?PF��w�S�8�F��L8��ڗS����.i�G3��;T��㲵���E��(�獐5�OwZ��W�y�]&?�M�K7o<i�J/P�"֔7��p80ٶ��D�7�5���������3������#c��!�L�h8�-��j�e,ȋ���1}�~�2&(Ju�t�G�@�_�����o���"�����)O�1��A��' Y��l���Fi�.]X�g6���^^{���j�)���5����F��f�pI&5����#=���eS���o�Tq�弧�#�h��'iO�+�ƿ�&��l�S�{�� %.?r�Ji�|�h��e�{v�e����O�:���V��k�P�jaRXU�u����Ak��E0�ópD7��I�Ø��g��=����#���Ntd�_O�(�Jcv� [Q���A6WJ����m��7�´c��1�����h�"Bߕ�\ |�I�P�Vx��BV%�P*Z7�.��=]�w5 v�M����Y�k�Bci�x~s,���<@=�i�T%b.��s�;�s�>h20�'���ޑ�� qO♔��M1,������8*��N;�y�@o],��h՚�^)����uΨ���=rmC�N�!f��j��!�� z���>���Ώ-����!M'h�KJt%g����]�g@���jU;�`%x��q���-�%�����b��C0)�oAMw�e���s�6�?��Hj�� k���cb٭OOy��j����/�U��y�(���C=�&�����\b=Z����O2�� *5��h#��}R$ e���ggI�/���ח�e�P6<�P)�JSa,٤3��Q#��>O^��@ll���*�%��Kk�m���v�>;B0Φ�Y��6EQU6/#o@�V/=����p�r4Ȑ��(�d��c��o����i|�1���[k����iY��n$��g��Dʀ�a��8 ����>�>�o����*�����&nG#�\�72��������ܽ&��p�F�;P������r)t�9)�Р����p�k�ϰ�R��Zzj�K�h�rɻ8� X0���K\j$X�����* ������0������.��x���%�P���V,ݹ��� �q��ޞ�Zn����J,�ɗ�q�L�.%�W[��n���s���,L�2V�M.������"����|$�t��o,�ػN�Xw���!*C��+������a'�X=/���R�,��g���9n��5�ft�i��5�����0kef�nt�yd�)�x��-gCS�s� w�?��ѱ���Lұ���8B�qt�6j��i�2�`ԚJ"2���Up�57p�Ս'�i���OQ��^��C!��4Fs�8f< �����z=�Rpiv��5)��A�V�l�A���8�=3�(��HUV�?�mZ[�$�O֤�}8��j=aWI. 2�ps^�`W�쏶����Rg�wm����;%����h�B��A ��rJ�CѺZ�t��o&9Ϩ�xۭfI�F��Β��>��1R���Ʃ�"��i8 }S�k���NA�a~�+�#�����.*�1'�%:�K|����t�~'���3���/>\�Gn4�mS�BR^����2^&������j�Sn?���v�n�����]ݯ�R��������9�&������`����w �#��.}��ɣoc�G�룽c����^w2wVl�Za�����?�ˮ��B��)5y.e���G�$b��x��4��y�#K�B�"w���cwڽ7��>���Υ��[����ɡ��!'xe�iL*�Ct�� �R˙].�Ӊ���ɘh�t��$m� i�^���$�\뙟�ۗ�T��C���-n�w��~��p"Ŀ�+�u��%������CVyUcD@ "�ujfB]���-3&���rj#J��f�m�ι7n�X_ �Ѥ����K�]��e�B�)vD o�;m!� �0����ߪ��o_��XI~�S�X��(��ɦ4�m:��NA�\��m��ɐ� �n=���X�����i��.�-.{Cm_�$iپ��*���v�aB����;�P�4����k��]��y�*���6?�q������/+X�������Z�Nԣ�d�ln&�h���|F���8|C��(����*Gt��Gvsdڬ���n�X���EL��p�+梞!���o�{l�-l��2�%�K}�O+*%��c:[-��:�+w�����6�8�e�<D���T�<��U�� �s�֓�||3�=w�57��9��_6s�n$�GU)���QU���AH����z��ߥ&����L��`�!� P!,����v{Eĸh��D�z%D�>�&�8��?�ǩ��9�B�46Z�]���V@��x��~�:��:�A_ M�BD�g�y��h�*+;'d��B� rk|��ے��������ؚRY�*���/jI�Ԫ����ڪ�8i�RJ��sY�����24��$Q�*�i�v���u��(���'n�3��O����"S�)�dF�Tu�#I�� ����#����2_.�"kv�~ZG��B���|�6�b�1I�\�mll�@Xl��>č����"KԎ�M�̓��:`��;�[������J�Uܓ7$��Z֙7�+�-)���������t��,�;��o����0���aѾI"�$��à'������b��D���lz�A�ޒВ�`�⭾�<i��[SQ�x�W0�K~����'�v��;W�x����V�����1���M2}l?)7��P2�&��7�A�����43�^>��Vkb��VF��[�����:z0Э�6,1=[�@���b��'Y��[�}���ژǀC�li-b���`,t�=N��k1�ۜڎ�#/D�x9����]'TU�i��
Behavioral task
behavioral1
Sample
356282d22dfa161663b29708a06c8249_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
356282d22dfa161663b29708a06c8249_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
356282d22dfa161663b29708a06c8249_JaffaCakes118
-
Size
2.5MB
-
MD5
356282d22dfa161663b29708a06c8249
-
SHA1
301e88d2c91cdd16b882683d335d759ac1ef4b14
-
SHA256
2f83eed3b5567c8068f1a26d0e4ccf6c9b72cd49b0a20b9a8d5c3039bc62d318
-
SHA512
520d1796ca47735c11149c09c03332862c720b2f192677e1ab64851de4d996292974eabb3f7e8f6c68ed96e138187d85704ee28636bdb87e0b86c11fa356df8e
-
SSDEEP
49152:DqL3wSFeYNz3YG+JGebSLYKq7QPaISnf8rz0sW+pWOqbHQKQ:Dw3wS4YVD+A0mRCDIz/0cpZUwKQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 356282d22dfa161663b29708a06c8249_JaffaCakes118
Files
-
356282d22dfa161663b29708a06c8249_JaffaCakes118.exe windows:4 windows x86 arch:x86
081eddb42c0f0a9e4e75d358577d1b69
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE