ao͞e:�>��1w�T�9p� u�R�j%]�~/�b�}k1��$�@�n&n��f��z����(���|b�e\�� V�\W9ݗ����lY��������;\�R����lk{n p�.��J�b4%Y(o�sLʛ�F�dKxJ9_ �ݦ���i<�Y�*歷�E2�j��v@2}͢�׳��@�Z1���S>K����xɋ��,�l�)�ۼ�P�N���!?�i~���<?���e�p���?V6�RMN5���Ҫ���jO ��i�D<ZAN��r�!�?��[ޥD���C��j8S���� �k�h?�c0��R25Qp�6L��B�F��AK4I��B��v��`�ΉOb6�m�����W$R?8�3c�����I)���f*Ԫ������2�/����{q֡��U�ۊ��~Kۘۊ��Wta�n���:G�\�DL`�d50���;�x�2�U���ZI'Kb)̥R[]R"П�]#ae7�����c�z��}X�ױ���)BBO�{��]���iC�.�UۑO��;��}��}l�}o��'��C���0�� �$�,�)�cz����O�Jo�}�A]���o�:������ �4/�ߔ{ �p���]�����7n ���-��]�!��m"��������LխV@��~b� �3�?5&�� � $ˏZ�sJM�8��j{ę��G���6����[ȥO��ADݯBz�R ���"3�d7���>�kpoY!\���rB�+R"����|��)�6���b�a�[ȧ�ǚJ���C��.��NL�Ej���;���{�.�'��%Շ�v�Ԩ:����;��om��M�+t6-��v�(i����2_���A�h��B�ee����1� k�3ٜtLJ��{�cܓ1"�;����0�C�� %��"]#Z�P ��g��[����d���};j ��oXH|tf����:�ͨ{q�� =3��r�p� ��xa� $Wf�xW�z�x5���>[t�T�Bq�+N�Ũ±� �:6��M�mr��4�(_SB��3���ut��Qp��Z�*7���S�1ƨ�w�֗L<����&������W�v�{)��ҟ��E�{|o�V? g��+Oà�R���W 8y�>+�2�yU�҈�g9�Ԓ���A\#k ��_�H���1>�7>E]ѐ�y?��"���Q�hTU�(��๔\��>��o�i���/r3�&����1���{w�-d�(Q�j@0��ֱ|[K�j��_>8����:ω � �K;���%.���S�~��*+��b�i�J���r�u-�}����vB����_g�"5ُ�gjV6q���;t@\W���Թ��y0Okb؟.�l<p�D����C%�c�"ɪe��J�7/:��x�Tu^�6$�Z2W���Y/z��:i�*x��6�� ۦv�n���Ex�5Ɣ�g3i߅4�L�Qb�ߞX7͘��u���!�1�e�x9<H��L����c-�o�C����O\n����I��/w��<il�]�VŷyVur,t8�&�ҵ��l��a��㷊<��!��$iH1��L,5/K�~�WZ)kg��7Dw�a�r�(�;�F �n�A�YfA��VP{���KA��a����t��Ѓt�p�=�A����Kn߬, ~+4�x��Xa�;�;rW�'yK�l(?�-���<�Vē�u8��:���Y���&�u ��3����i PyL���`��~�����Y�o�p�9 ������)���x���X�CeI ��s*{��h�Nm����[�X�j1��,�ȼN�[��+����;vT�yܜf�,\��x����B0T�����,�waW�J�~ �t� �2ݭ�k�������+�Ih���9v����7p.�gk��;E � L�e$���,������H��;����T�"��]>�2@�c�?����S����L�L�5�ISA�l�Nt��TB�oq��Z�H}<�dQȘBn�k�Q��-��a�7��ZD��QW5�R���#�(�g���u�G��:� d +p{4��QdC��]Wvz����$�#����B?�?}���:�� �T�`�.:���@����p�ݍ�Rz�m�;̻�a�FѬ5�c�O~�x�#�^�?�El������UF��-6%�`�����\�_u,��(�+���i@�г��dEr��לi��b���5� [�`�_I(Z��-��&z�Hh����K�kS����뉡�v�{uDk)_���P�[��?u�T�� ��� ]�`�p����T"Bh�z �֢�d4:�ot�/W�_G�* ��ȋ���%�b��>��4e�A�5�;� ��B8o���B�) �����Lm�-�F�<=�^%��d� �TB�<nD���g�灦z;�i��;�eȮ���n$�0*w/�� �|n@�N�V�AJ�E�_�g:�v�۴w��S�+�%]II�Ը�%6�Y�V8������zGE�R��n�����[PwU��������]�3�����.���Rj+��֚B�Lԅ�3�Dn��hyH���W4P���j�Z �!���-�3�֏T�R*�в�FG� �� �Ҙ�ӳ,���������������:Y�M�|�>[$Q���wb����#�~ؔg]�/�u������"�X2��b_�LX��[�}פ�BL_����yT�$̝ �mr�݉<Fc���f)T��2��{b�w��N�G;�O�%u/��螓1�V׃��ΙdŊv;���n+���ud�����|$��Rp� "���&TF��X��[}��O;WY����:*��-\���]�c�(�|.��R���3� �Ar��G��X�� �z�Vt����'QbVl��.|��1�c9x�J���'�["��֣W���E�F>)����b�����&��yV���ĉ�s��g`n�qp���(!�bVov�ԗJH)/,Re܅&n �=��΄��R���/BBg�9������E��گ��M]A[/�#E�V�І���0����<7L��?ҝ�B&�&f@L"Y*��PLx p��
Behavioral task
behavioral1
Sample
37240512ade3c39ce205b1f618514ee5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
37240512ade3c39ce205b1f618514ee5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
37240512ade3c39ce205b1f618514ee5_JaffaCakes118
-
Size
2.8MB
-
MD5
37240512ade3c39ce205b1f618514ee5
-
SHA1
89cd2ff66aeaeddd1ac4fc25cce24566566cc166
-
SHA256
96904021176e26d885d18ad3ba2419686915ec5f286b0d98feeae97298c19d74
-
SHA512
af0ef21ac61fc328444e85b7109240ef0ba269878b4c4ffdb16550d7914f2bad2f7430f4b05a028529106b7fb2a58442050e1821a773331d5ce8b8cee1d7425c
-
SSDEEP
49152:3y7DbltGyCCiyiNEt7y1lhTs/LyBxRBBrzOzCJdLto4LyYOTo3ZJ+SJts8:3gbxCCCNnO/L0gCJdL2YOE3Xs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37240512ade3c39ce205b1f618514ee5_JaffaCakes118
Files
-
37240512ade3c39ce205b1f618514ee5_JaffaCakes118.exe windows:5 windows x86 arch:x86
8eea27631eb096ceb3293ffc322503c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
RegCreateKeyA
ole32
CoInitialize
comctl32
ord17
ws2_32
listen
wininet
InternetConnectA
shell32
SHBrowseForFolderA
Exports
Exports
Sections
.text Size: - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 740KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ