�R�f�.7�v�q���ڽ|�c�ʶHG�t��>��Q$�}�*�6}Z��Ƕ��[h�h�W0�� r�7o浬j��h9���p�q];YI�3:��q̺-��s7o1 (�a���4'#����\T��g��9b�Rm!֔s���'�������h�{E��k��MU-h�7U�f:��~~�[e� �/ח����qi�Th��8v��V�c�?�]��a�츗&q�!I�c����9�S퉕�����&ڰ������Fc�3ՠ��JT&��K&(j��,��@��&�TD�I�P��v2�m����U �4,��^(�b�Aj�ZhO_L�]��-!O-�~:=�,��B�kϹ�q 0,���V/��8 �|�XxY���?3i�H-o5b�cYc���1�cr�1~}�6�YI$���>�/ɵ����b�nwd�"�j��3w���UQ�T`�1cg���K��+5$yo�t�����ka�:$��6JDZRu.@;Q��SVΕ˄/��ӹ�}j'g.s��Z-<���|� d�D6���� �iM �S�\Y�N=��sy�/,٨��e�M����qq�R�b����Á��X�͟�Pq{�Lj�i���Zj� �N曱}�]di��s=����?,�0Xq�@��⻤���*�z��{��>(h���lB��V%N��6'�S��%�61K���S�'�z�Zլ.�&�� T� �P� �}�%���t����e��"��e١�L|����� Re��E| mT��P���pe�O����T;0�U��x@�x6X1�bc���l�-[Α��S�ޭ���� 1hq�`l ����CQp[���zj�?���m:�3~�Us{���{�)�w��� ���X��k%���Q�^�l�M?�ua�����H�����3�drlEH�� ���I�Y�+��/����F�Y�q0�Q�����[�T����H�O�cv}]�#jQ1�ntw}��;��yj��ci�7�J����Lº�g�/�����EWz����.CC����� gc�8a��F&P��Vi߂~:� Y�M�Nx�_��>� �^t�.y�-n[ޱ4�X��a���z`?c�����0�}9pD��j/�M��q5x.[����G��3��Xރ(�#�������C[=��������MH���&`ɵ�k������f����3������'�� ������^�˅��'-��n(J�c:�;q$�J�l��9̶g�o��"Cb s��ڛ��*�]���*&�#h�d�(݅����붪|��n��*��D#��#��'�@�PN�m͍(���F�(��'� �����h�������[�@���0���<��tU�h��b[���VA������)�s%-U�W�w|��k��ѥn�I��el���p&-��i����'�$&(�TFQˢʒhK纛%Rg��p��\�̬.p��C��O��؞Z���/ϗ�di���Ҧ �7F���z׆�|�A��&�ֆm�O����>��V�A� �� �>�u��,CQ�/�����c�Jy�>�~p�����%��k��Mc% �n��opԂ��/*����N���2����\X�o���x�� 2��H�R��h��}�����/q.��z`��͡%2ADt ��I���"��Y�{h�"FQ�R�5���!>3�:�x� W,���Ֆf%}% G�����A�B���Yͬ%[�C>��4��1V=Ф��o�����P4`���1����a��L�օx|���%��M^��OZ]N�a��哖ۉ�|����@H4Ԭsa_��}顪�.�J�Z�/�Ab`������#��u�D萮��0�E���y�vOC:6R|H����+s���^zQ�9U�@}D[NC�r���c �#/�Y�#N<ᤈ��� s�y�dQe@?O�G.���Pp�3��S���ސ�h0&�����L�|}C��U��T���k��|x�)�!���߅K8J������*�p��`ӄ�8@E�����I���,p�kg^�Ą���!�d�Kwو!I���Oӫ6��������S�3�$����GT+a�<�_A����kQ� �0����p��Î��g2C�S3���UI]����A���|txV?�)_ yZ�b��#,0�>�"�Q�1!�_�n� xO�Q����1�u��Kfp^�Y#��B�#�p�r�gUq�:����E>��_/2�Eđ�0x�0n���֙� ��'^�����\?�����gM`QV� ��3d����Q�-Ԇ#���g(zq��ʼ��-�1yAAO��@A{F�ëu��:�I� ����~/فAIg�Հ��zN���/+(�E��X�j�_^�m��q�dR��P&��OL*ᘗ���O-��1�yy�*PX�〈Ղ����M�A�b�zw�Iߩ��>�МTX} ����c���a��;v ��f{�l8~1�h ���&=Oň�"AÜ���h���^T^�C�;���k��`q��ӷR��J=~x}���T�Ӡ�����D^�ME��ŀ9_�&��`��T8�I�O���RFN,�7{�p��@�4�r9�J����0p)�]ݚ�1B�k��a�6��9. ���dN��J�$E��x�c�:ŶO���'�����G Xݦ�4�Rj����T�b�-A����#J>�T�Q/��9���=ԼDƩ����fG���E# ¯�H ����Y1aŭ��`���šB��d��5�ͼ�L6���\�<������M� ��@9<I�lI�gp4�]Q��q|�:?��;� �5.�ٱ�/�(�Y�6��y�_%-lYH�:�mZ�n��SΦJ� PtR02�tt6���ㆤ*z3�B�[��C����7��Rg��골��H=A%�}�Y2�P3����1�n�=XQVRo��CI��ք�����b'�.s�T1��z��og�- H�T���m�G^<���P�j�w����!���I� ����Q�2Dd��<̺�ej{���9巀����'!��c5��h��d���<y��������w,�=]&�͂�'�E>��}��l�o� ��-1�_-���/�������U��Er�s�L�KQ�
Behavioral task
behavioral1
Sample
3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118
-
Size
6.0MB
-
MD5
3cd86189efbd280c1cef2e6b7bd1b4ea
-
SHA1
7fced15cf82909bd4c7dbc7298af4ac6f8790fd7
-
SHA256
31db18a579aacce5af0fa3f9a539e08a58843d82b54ebc9416841f544689d817
-
SHA512
c7f44eb16dbd69103f5ed306e54b04d77b082c3f8c8c72a0c164da3af82bd58cd23dbe4df10c4ac495413f97e3602a8a6607a92eb6c3c9c673a4c34bdb12d294
-
SSDEEP
98304:QlktN4zX0Y4lqW7oQI4JQyrnIuSMWVgkNaB0fF13Nkrle7r1oUhFEzhkimHRDzz+:okgXF4p7ot4Dk5gkNaWF2Yr1oxazK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118
Files
-
3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe windows:5 windows x86 arch:x86
e33265cfed730906e1f2ac8bbf78dd64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdiplus
GdiplusShutdown
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ