��-.x$M�I�,��_F^�@����{ns͝���ybA6���5|���օ�gAyY�����@�hv�I����dヲ�8}ʘO��$���6��K=��ؗ��fo���,S���K�@�̧{6!ކ���|28���jx���f� +�48�8N ҸH��=��٬¸*�ÞU�S��Ճ[�j����o[���Ԣ/#��6�Rd�M����&T�4��U-�����Ў��:�ZQ��U�Y�s���g{( 3n�{xe���Il���GZc����2�W:������65!�ze���l6���o��<�D�^ٖ�]ҟm���}bz��� �&r�En��/�Z) m��?���s��e��l���iь�q��X@m'��Y�٣��$�p�4u�/�����M�VQ��'�r�eo&�+ڡ%.�L�v�-ٯ7�W$���E�{��M+�����6v� 0���L :u���!��,�ߕ�_���Du&m�C$���폕뒐�86߁���2v� �`�X���Kg؊�<��_�! n�B&:�W��j�[�GAn%�p��� w,y9N=�"�i1����s�Ǖ�����h3�D��p�B�w�X�I�g��.`���K܆Z��e�C]x�u�.)�Pq!�2���r�����=�3�n���Q3#��t$e*PLƾ��V���B6G�'��V:K|��g�1�Z�]��P��w�p+��RP����7��_���������݂ǜGH9��n��1{@�#NQ;aLL�\�D�[�Y��FsH��r�PHi����6�rO����b��#g��lY�;�M��>�&�%�V����o!�K5Lh~X���5�&�L��n'��.-�Ǒ��]s}�2�M4t�U���W�Xk UV<�������MM8$<;���}}���%O�w�p�g3-5��<���q��Ɗ)�ʋ���e\�L�a>�\Mvݗ�0��9n\���n���^�x��?���1�S���]Rd���v��y��dqU�cP�w�;wt�y0D&(4���� ������/�Z�6K�|:CKN~�x�dfz)R4پ]k]Z��NÕ?�u��d$��-��x�2���`�~)^��=m*�D��P�U���L�wR��E���C)!����@4J_��x��U��k߭e��g�s���&��t�N�JRjuU .�bu��2 )�:� �z�<u�jg��,�|�^|��3�D�;�M�np�������Dž�]v�.����)@v�~s �T�C�j�S� �W�M�'�!��sz �d���|��*i�]�m�1�*��r�s�"�E�:oB0���v�E��rhL{-a��a0nRkz�+C� ��p�X )�*z�93�,��f���K��}�Ȑ�V=�M4-6�T2.v%��Nn|g�5�k���uyX�����>3��\����ߪ�h���Xެ]C���4'QN�g9���B�F���׀q%�4� $1DZ������&� 4%u�-�����$i[;��� ?D� �éx��.��v�^$������0Y3鞯פ��ŲxgÐ�l��8 ���(�Z��������\�S��2�/�}�`��Y8��<fq�D�<���@ѭ<v {uNbN f+��=�eAV2x�Ծ@��}T��Y�>+#�GY �su,��ǻO3|�(B{���������7f�+��!�H�Lr���b �|Š�"xK�6��N��Q�1r�y�^��Q:Ͷ�d߶��l�H�A�9���� �x[�z����P$�D�����Њ�5:��)�|7��;v8�L��:��|�v-�h�y���e+<��y���ٴ�AR���� ",�X[~P���ꈔ�X�@Q8�*'����3��$Fs�T)r�� !�����ܽ��M2�����������!���1�<N���Ҳ����s��}n'��h��J�ϐ�+�nM�Z����,��B���g�W|(v</�4�G��ߵ�G��~Դ� ���5���Z��F'���`����!��#"k��1p�XkR���g�~���\q�wU�̦~�^>��t�[7Pښl�ٸ�]��j!�(�;K�� ��$�2۱HgAD57K�WN"^�S�����K�{�V��"�hy+��܌H��K�d��J7h�V� �[aC����)�[�T!W�Z�L�T�z�$#{�O��n�Ny�#�]�)4�u2��ym2��>D����wLT�?�m߁��R)��$b_�"��܉����ں�H?[8=Q�xEML� �5�VB�J� &�Z���<�N��x�ڬ�]�N������/��Jg�p�w��=j ���8fa��KZS���D�O^� 惋xА�9mpTMM�|A�.��㒝�$� lgSJ#�kP�!:B7m�O���V�z��cb��U�ڟoQf�ܻl�[�Ӥ��7���T=$�-��Q$���\�I\�����j��Ʉѹb�0��<���e��b��d*�>��SڟC��Q���������͖HGx ��7����SLb!�ɣ�k�Q��?�˧>�0��@�$���my):��UP����V��.<����Н8��z\�}Q^ˀA[�� x�������2Y��b���J�Z�8j��;��S;fB��۷{I9�X*(��<vӂ��b��#���k�.Ǩ�� ��sl�rI�g���{Vp�tA� tkcp�'߹��Ƒ.�Q�5�"�04C2�d��rn�O̩oq#�X6^���� �|�*����":.>����" gT���c�6���A��,�Q�&��R�0{Y�&)t�$�a�$ŴjMS)��y�� �:����XI�� C���a��r�Z�4�x����b�k¡����AXZ?hW�X���%�w.*D�p��G��AQC���Y��R�$���) �kء��EMߑ�ǵx�G�����!����H�&Z�m��\�z�J����t�� �ԯ�#(7ۇ�-Ao)X� C�E��h�$��Wp�/ Y��;[O�D��B£�TMy����q:�h�V����f�]�%�+�Y�X.�2����J!��#IN<��P5hM1Z?;�����
Behavioral task
behavioral1
Sample
4152b9a22da1e7e81cff87c25eecce7b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4152b9a22da1e7e81cff87c25eecce7b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4152b9a22da1e7e81cff87c25eecce7b_JaffaCakes118
-
Size
57KB
-
MD5
4152b9a22da1e7e81cff87c25eecce7b
-
SHA1
7f354d568187e975419fec87dbd613f50e899713
-
SHA256
d01e846baf0a5ac90b327816a00029d9ea5c6bbcdbc427fbc68069d46851b686
-
SHA512
cd504203a9114cbe9b207becb79b7b18a08a40270ee701ed8b589bc3e734d116281abd9c93b152a831679b3d9abe6098c0e877584cfc579b5392624de405dfc8
-
SSDEEP
768:0BApkUvHDsZCgsmsM+YeTPkp+tL55w3NiznRDnubYTcHit9k4mvPghklo6UiWpZ1:0BMhfRya55S04eLXmvsCoramF0d
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4152b9a22da1e7e81cff87c25eecce7b_JaffaCakes118
Files
-
4152b9a22da1e7e81cff87c25eecce7b_JaffaCakes118.exe windows:4 windows x86 arch:x86
890186d5d3e3f3ebeea26ea2e12d7264
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVolumeInformationA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetActiveWindow
MessageBoxA
libeay32
ord3782
ord298
ord3783
ord2656
ord266
ord3067
ord294
ord961
comdlg32
GetOpenFileNameA
shell32
SHGetFolderPathA
msvcp60
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
msvcrt
__p__fmode
__set_app_type
_adjust_fdiv
__p__commode
_except_handler3
getc
memset
fclose
_iob
fopen
??2@YAPAXI@Z
fread
malloc
rewind
ftell
fseek
puts
printf
strcpy
sprintf
strncpy
strstr
strlen
strcat
__CxxFrameHandler
free
__dllonexit
_onexit
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_controlfp
Exports
Exports
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ