%���_��+fwH�J��X�Ng�K�{;#,隲��a�W����H���(���k�s��q(L���&�������G�y��$��H��s��jcND��)'� �����Ζm�0+����l�p���=��PIe}-A<r�ZRV�[pi����j!J9si�Ƥo�o ��rK\��],���*�nϸ�>���+G��՚��6��H�d��<I�V�䪀�����x��T~��Q�^9f>�_JU����B�#�R��Nn!����:\3�,<���UϤ�Nk@�{�����m�>=!!h�!2|u��(��8p���.�3U��`A�}`O^c�#��ʌF�e���O�ws�@h��5p�7�ѮQ�B[�{.���^*�"����S���`�_��>�h6@"�!���;�l�>�������M��^��APv����<��y����p�L2�Z��m��C�S5���(��?iP��f�v�\��m�z8�Ps�C��Ŧ�!/��u�I�w�������T�4�/FmUR����ôM��p�� ���%�p:��W��q9�j}�,44H�rQ`������|l�TG ����a�l~�=^��(F��0cPa,�э��*u�,L�ÿ,-���:�������������$��+�h�Z�պ�C���7s��/�"/������W 1��&Ng�ݿϴ8Ұ��+��ɧ�3ȓ8�QOy(�&�1�3�/;t�vs!l��J:�������F�(�|����b'�ya��Q�_�X�, ��:o��8U�kD�����7HnpMG�:)ի���x���O� ���Smj���e��J���TFk[T"��Jz.y�����۟0���Uq�z@)�Ҡ��*¯REZqr�x4I�������.L�bA�ݖM�%�_T���6��`���}Ԙ9�`:T?Q��B7�����Lj�x���V�VG�]��%_������~�L��O�1�R[A�-_�(�0��ƥS�J��I+N�=osO����2_|w���xr ]py���\��b�욬���=><���!�O)U�|��lQ�kLg��C��wk��0��p��!m��Wt��T�(r>�z+��5zT���IBId[���I/J�&}��^��M�_����V���ఱٯ4��>lC��N'u.Р�VfӃ���M��`]���%/�f���1���n4y�H;�����X��lJ� �S(��=�q�3�? DJI�o�� �˖��ط�UIf1�8{evʣ�9�o,�=��v8�]��(��~�ý������ڈ��rK���vf&6i���馚 �p�N�{3�:l��nR @�Ŭ���U�g�G������9�l..�(\Jc%n���Ya�c�' oR��J��\d�e����E�æ����0Ʃ���'�z4%{�qO^�1o�a����_���1 ���5�-�Ԍ<ke��� [)RL5�ylr�s�5���䦃�p�0�D4q��ӾcUp��x�2\�l�`� ,���V1b3e��ٔ����u�6��-v)��ry������Jt���������9�B�5���UyoB�h,��Q�WV��_��>tI��@��Q0�} �d�eRhVqi�z2�?T� t��e���kzȼ��Y >|rW}�(�r���t'�4�V�2��d��癭0oٳ�Xٱ��]���&�t��l1�ppr�/�Q�+ Y�:x__0��Lʝ=`U�ۣ6��k�i��J�G�,ZJ� �zL�����{!��,=�8�.���t }�-'�}���MRG����?�Y���ԏ��".O�����6/�b����J�Y��"����Hh��S���2��%�F�P������<y�Eid_m��v=��.a���y��v��+č�T�RPY����uWvG Z�}��V#�.P��@aP�#����C��ܳ1�QC,������r���p���~����=��e@�8�F���u��#\������� bٛmػ��n���t�e��>�19���w!�� ���W˅\(� �d��j�!�M�NJ�g���a�;f��uՕ�֎� �+r�eE�}]!��1I[�6�� �������(�$�9�@_QO��#P�l&���WMvw\$*��zb-V��"q�ֶb r6`��c����P"YB߀�j,���ZIzL?��:�x�ߗw)� �p+�8 ��7��������V��Y� ~< � .�-��;#�%�����,�`�(>����s�s������y,��z��e�g�\�5y�}B�/��S7bs{���Ҍ��<�R���N(��ioX�1*L1_�rҬ�eM�{�r�HŒ��K��k�>��~�%t���}L��%�`�"6Kg���;�i�����c/�cY�s����~��qwa�L�Fʋ������Ti �r�X�(���_�����Y%V�8��5��0<���f�{ܦ��1*��*��ߩ�'� �ؠ���B4�:-�?3z ȩ�����M���X���5�7���۪�,�����c��5.�c �z���dϙSy��q"��}���1~�J��}|��^�H �ʢ����bZw�N ���N��Ik���#�H�m�+�Ϥ6�U*1T+�-��� �ݎҧ � J?��U�i}��oJ����o��HRdc�S�[�C��y"0jMy$���9N����ԃ�jw&d]��x���;�-%��}/Y�@�[@N�5�d ��������߾b!ܟ�������,�^q��z�F���>OD&)�E���x�Y�~T�+�=N�XD�Y������q��3PMn���:IO�W�1�~���� ��#��PZ��3�2{�UK��>�B\��h�E.���z�|��qLd�]/E����@K�����ץiJjE��3�����8���,���`1F�Ȩ�`#$�K�E���Ð�f2I���<�z������Ǧ�\}�m���PhG��s�ʹu����CK8��~��<O�~Ԥ��BL����@��ky����R���G߁���<�{ �������+0Ndm>
Behavioral task
behavioral1
Sample
3ad9e0c8086c1014bed117bd8382efff_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3ad9e0c8086c1014bed117bd8382efff_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3ad9e0c8086c1014bed117bd8382efff_JaffaCakes118
-
Size
5.5MB
-
MD5
3ad9e0c8086c1014bed117bd8382efff
-
SHA1
7d8ff032034d9812dc7dd4f6827f0aae30228cd0
-
SHA256
d6a1d3935dc46ed29ab4fe90607dfcab175dbd112844b09857ae191723cd68db
-
SHA512
6506eadae21f1d8a41165f8638abf46b49fcec90ca79b09d9287a3ced77897fb8f28975fe8239572d63996e0e60be39a8aeb9688134dc66c3686a71b1f5ad0bb
-
SSDEEP
98304:3CTPZDbL5fwk95QSuhMmyekaH3VwlBWlB4RVteITglz9bB:36PZXZ5QSykaHF604RveITgZ9B
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ad9e0c8086c1014bed117bd8382efff_JaffaCakes118
Files
-
3ad9e0c8086c1014bed117bd8382efff_JaffaCakes118.exe windows:6 windows x64 arch:x64
81776b8d3ad45ba96111257fb4b00cf5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GetModuleFileNameA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClientRect
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
LookupPrivilegeValueA
imm32
ImmReleaseContext
xinput1_4
ord4
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-math-l1-1-0
log2f
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 318KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ