�Q^�kN3�ۂfli]�IQ�6�`�[�#O蝟~�F���p��!����-!I1��(�+s�B�K!n���YY��L�&Ҽ�/R��{!��HV��?J�B�(,j\)�hw\�}7�4G�L�����iˇQ�@�toR:f�(��������E7mRD����7�X�X@tDC/Q# X(��@����j$\����\z����^[7ƪ� Է���h�:'�~2^\2Rg㫀���Wf5)�j���fU�N�� �K��"ɧ��dT;�������p���|}�G�H�jW�����>��B����h���q�w�&�����NKZ���8����d���(���ͅ*R�_y�4�����*Ҩ��k��, `r�����B3���X��kY�#����W�����C{Fj�16��\���CR�Ki+��>�G����f���ƛdqo������+�{�ߝ�� 3��5\��.Y*��q�6{��9\���D{��e�ז�&���I5�2�U��I+���R��������]��sG�������g�0�1�Mv�-b�5u�� ���|߯��X���Tt�E}F��2{ �>�3�j�"Z�[V+>��;~~�8�~�� ��4������0�:0>���#K<��O�s��0�bñ�� )��}�[)E��Mb��r���o�d������.�5u��L��ku@ ���LPc�n��?�{���pF��A����x�S/$�ġ�����͝$g�����c�k�*+E�Q�-*Uy:�.$��5� �E 8�m.���S�Q�P�mQ��KMC�-�����H&�ǩg�T��]���$P��e��J����p�L��Z�Y0}��t{ǴIB:�q��n�LjƍX�údsΕ��_%d�;�#)us�M�]&E�n�^���8v��ns`�hX`���̓����w5�>�]"�GQ<�c��2�]dFG�[�8���?H��[�|>0�5���$�������0�X���q��au`|X���Ot��(#�X���Gq�C'HQ/������Fv��l�@�7Q�����~^����8�Q�����n����1�P�d�$��qR*x�����x� ��\H��&z�����++���r:�]g:�jɝt��4V�iY��&A�R�M�"4�q��ޔ���a��\�$�H={v7O�&��be�*��Y����$^�сި��̆�{���p}��n�1�iR��x���^Ek~7xp��ۨr����$��.�VH�L���J`�/���;���XS�0���#6��2� �i�ȷ���Jpl\���^ǃ���-K�>|�^m�f� 4��Jk�nD0����:��4� ��4�mZ���yKb�ֺ���[�N��b�q��V�X��,q+�*���ɳ1&�T�G�3u��\'*�͜�f�[_��Rk]&����_ Ƙ y�����[e�;4��Qq�����(���(H����!i�>�v3Qq~ը�Y<^��Ku`�\*�L�Ƥ-c���=N���A��6�[�V��%����9s�e#�5�\>aAr��<ْV�T��&�\j$�p0�KF�5���r� �{����<�����33�tZ�1� �G:�"���dwԆ68��E��<G� ����"a��,d�H�!����@�C����=�Ҟ|�o�i9� �qM�V�.+U���ޙǠ1 �OLB�12��e.��O�q0ɨ�d�7GDa�����������{�8F�p#����m���=[:�)n�D%���T�ռ->�1ِE�4�~�W<��m�`�!xHz��S9,S��ɴGhB�8����q�~PK�x��51ŕG���V-�4o�$3���"���]fEO��j;c�G���`]!�Tmaa2�Z�E��E7}���}�ڧ����ak˦t��vЛ1�=��#��u,+��_n�l����맅�Ah5p���š��²%��M��aFz��(L�-�Ҏ3y�S���LZ��uP��7� j}�f�̏H� {v�t��zNY ��_�9[��{� > �V�&d��w���� D��{:���Yo���q[p�N'�J��_M;��lֵ�Z��ȉ�7p���j�����U�G�l V �G�O�&ٕD�3C8��u�vNq�3k<��~}���qk?�����6^�4 �]����;�\�#�?��F�3roZ��x�.����vR�{��E3��H?��l�+��٥mwU���#�c5P!��w�5������C�o� ��0sJ$=P5������F��W�@�;>^�n}�Ι]0������|���IlR�,��39n�vK2��do0n�F]0���aX�09� p���[������)�_ƚ�ƎǤ�Q��������4�ec���!c�{FlT}ո�.9��MI����NZKl��@S!L�@ ��& {n�A�Ku��(�`)���ǛݭEO��c$-l�1�y��hA��21҃<ԣrt ��Q� �hu>o�X�T ���$��M�H��.� ��c��,qK#�� �@m�*����B����/�S�6�|z�b<�ub�~F �PSN��юS�Ҍج��r�D1�h�3�,�{�G"7�f�ҩ�rgh�����g{\WjX�o"6��K����t�&?����o=��]&&=`j%(�ky��(%�6v��5� �|>�¹���s��`��"<� ��g.�C;f*��v)�<�<\n��w���b?��RPM#���%�c#�,��1ZU���������H)}���u�$h=��=��Q5\��$|z����(�RUd�s1��6�S�������R����Y�C��C���\��d�D��K �*3�.�C�v��U_BՍMQ�9 V�]�sT�b�I\�12rr�Z�X�l݁!�-���܍l��R@�_l�\�����9�VjZ����{�5����귍6d�Yd�r;Hg����<���&�rT�u"li��Q�F����@��'8MEW `�@8,�Di��ߵ��ŏJ��b��,v���bO�%ّB��$���˻&���Bo�&�K���َ
Behavioral task
behavioral1
Sample
42a4846419b9dc5de45c3414c0534eb4_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
42a4846419b9dc5de45c3414c0534eb4_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
42a4846419b9dc5de45c3414c0534eb4_JaffaCakes118
-
Size
4.8MB
-
MD5
42a4846419b9dc5de45c3414c0534eb4
-
SHA1
1397dda4d8d42cb79b90db33eeadfcfbfafa29bb
-
SHA256
bbf83d3fcb92b60b9aa19e69594c948e39421b4de6fd40328c90b4aae067bff4
-
SHA512
94c205d77f778f22cc8e471e3e88fbaa70ca9c7b2872c828551a1d96e6be8ac5ef256715f3cc0f965d2563a73377be625a85fd00568551a286c4042d55eaf300
-
SSDEEP
98304:ZvCrWsjMZSPLfMaTAaKmUccCaqDQ9yy/yI7mph:ZvCHYoMaTbKzcZao7E70h
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42a4846419b9dc5de45c3414c0534eb4_JaffaCakes118
Files
-
42a4846419b9dc5de45c3414c0534eb4_JaffaCakes118.exe windows:6 windows x86 arch:x86
6a0db990c3ebaebe5b3e293dbf9957e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ