��@�TE^E�Yw]W?���>�,��a��ۖ�ByV���X��w��.�jˠ�_�<��CIGy.:(�<���Q���R%MԨ�{kH]�i�=T�?��;��7ˤ��G��'��X��]�"���0����$�y&5�C����K�4���2�����N�-_�c��[�.��w�-�-�J/8%Is����~�M��鼐����w��P����h����;���� �^�����#=�+ �� yNh��1��i��T͓��HԦ+8����GU.�O�������6¨Bق����.�^��0�����w~��DOq3q8���K���>NE��0nss3��%o�gG��O)�M����c���x�cB2�� L@�_�iGb?lh�ao\��8���$:�kH����g��2����D��C(b-J�!�?mzdh���'Z��{e)T��)�G���)(�Eҟ���4m���Ҍ���R+"���٥����ؚ}�S�����M��繧�����W�)驈�%�������`�c)&��?YQ��Z�R,cd|���-���;b�pB?��O���݁_�>��.<�f���}٭9��\(;B�T���ľ N��d�hJy�A*��~�̦��h��6�����8��h�[CI�Y۽���Ha�y)�;��:��������k��`��(�1x}�5ӄ����#����ڤ?�)d���)�W����Z���1�Ҕۤߣ1Ss�}�U�5�����O�?�ɾԨH�� (ct�;�ɯ��i�/�����J $��&����Ҍ��s.Vkx���rA�nI��Q�洌0WQ��`A���Q2a�Jf�������ޞ�2~��@���k�?A�g&�����0p���uq�$�k)x�7;{ �D;�@���4'Z�9 ��F�UJ�����sr�.�e���3 s=8��te�]7�Z,�p@0z������W�bP)ߡrOH�/��m��?!�}F�Fn��cڜ���ʿ/�Ն�P�l�dM�������|��p n���V�|I(����gW{%��e+o�O<ġ�l�(�b�)����?ֳ�&��1�'/���!?+2%8������ 3���3�`أxWTc?����%�'SF�,A:֩��A� 8Y7��?�<\{.l(j.Kh��Q�.�������[�����������E��S���R>����s�k�SG��N�1����0��w����HhD<l�a�p��{�]i ���VRء������5J-`Bم-]~�����`� �՛{����p�rf��b�ͼ�N���EvD�Y��)�oR��_��Ydl��V��w+ç��-1����y"��H�=�kc%M��ޢ�w�����f��X)�7��?�� =E��RG��:��~z�c��7 ��6����X2?^=����#*Y�BOk�����l��t>�5T�?"@/�!�Z����G�쭻i�*��P���ҋ����a��- ��{x���Ow`Vk�Y�O� ������K���.%���K��Ԃ�a�/�_Z�/pf�^?��6߈oz���.���]��}�0o�����6N�a�/4��n�@0[Msυ5���o&�K����D3�5A��!EHu�*v^sM�6�>y�I�B����SR'X�q��d�=z��gdI���|A�=cw�$�3{��� 8Xƺ=�;�͝�O:���U,p�TbƘ�r��)`��>غDkt^w]� N�r,O���w��ܐ3��r~1�pc��R��i.�=�1���zfJ�BPx��8�O�����7�(��m����k��e�9}�i:.�`Y�v�AKb�(�ׄ�h�g\$����g��0��zU��w`lF.C~�c6E�� ٟ8�@��q��!߅�U�57���s��&�U=z;&8(M7س���M� �<H��c�<`��DaR�ԩ_�0c����{�|�eD٥�id Z< �$���iP���Ƕ���k���\%�5��U-�2�V�+v���Qj^).l��]���H���ntmFfqq���*�zxm�ga�@SnP��̀M�� �Y��bG��:�H?��n�ֈQ�R���B8:k��8�&��-q��$Or)g�N#������I,P���������+�G�6���RK��.�����C|W�)Qaj�{����<Q�xH'�fuY�v<�$ ��QK$��K_u9��D��P�K!kG���)U�<ج�����2vxC�/Rg�؋?5�LJD��9&��$���S\B����ᨣ(�\(�o�(�g�T{G�~�!F&�7��.ђ{@ǖ�6bܓ ��~���6�lT�i!��.2�U�j���F0C�u�����u5�a��]��M�h[��w3���2 �e�?�l,���X����r��H����D���}+�� ����Ldʈ�ߡFh�RXv�|=B�)0��p0<*oQm%�=A ��ߝ��.0ܸ-0�r #m�e��W��-cp�$g>$�z�o��<a��Ƥ���<���/!ae�;�[��k:K��Y�M��9s�U�� =t�l E��D'><���[���.]��v0Zu����� ��4N�\4tp7��< ���'\%"`p�*�(g��6�!�[�gr�÷�͗>�(<{5[�I�(e��������GkWϨ�,����/V�Q��|�Q�2�!գ�2�x�Tn���' ��m8A Z� �S���m{m�{\�i����t�I���%�m.]�l��)��T�'x���@�>�)��v���u־`W��N�Ӱ8f~�)����}f[Uf�)t!��!�4F��0Z� �����۔�F%ԝx�!G��2Q�7H�����������'X���h���f�i�˒Z㐳�}�M!� �7)mB���R��%$M�#�TJ/��.A��)����~KQ��ǭ�a�����֏�Y�+IIJѴFp�g`R:��k��Z{��X+D�V��L������s��������?�r����J�ɮ�+z�N�V�����?F�����;ZxÁ~��p��TZ�ւ`�ɣ�%w i>'�']�b����<�&����,[��J8�����I��t�:��
Behavioral task
behavioral1
Sample
3bfbf41570d23bce387741109bbe3c72_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
3bfbf41570d23bce387741109bbe3c72_JaffaCakes118
-
Size
2.5MB
-
MD5
3bfbf41570d23bce387741109bbe3c72
-
SHA1
501fa56eacd38ad5cad4a571ea8cf56c9c41c546
-
SHA256
1d56089ff73a022a02f2168e926c93ba8631d9f16e7f6944075419322e85e2e7
-
SHA512
f0aec1f165521da928b75649cfca4f3b6aa383bb52b716aa0fb1a32852668f45156431bdda0729b1b0fc933935a2fee2a0fa03bd5ac02c81b09d2bb4bdfad72f
-
SSDEEP
49152:fDrv8AbqtN0tbxSsEHmyHa3xycqv8QSeo9qvwM3gyUimzR/zo+DTOb:f3v8aIaEXHafqv8QSem0wmXMR/M4TO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bfbf41570d23bce387741109bbe3c72_JaffaCakes118
Files
-
3bfbf41570d23bce387741109bbe3c72_JaffaCakes118.exe windows:4 windows x86 arch:x86
6e1d43f3d308f54a5aa2115cb0cdf789
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
RegisterClassA
gdi32
GetBkColor
winmm
midiOutUnprepareHeader
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
VariantInit
comctl32
ord17
ws2_32
inet_ntoa
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 520KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 902KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 156KB - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 156KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ