�r��/QGLJ��fh��B�߁��G`K��m��5�.�k�����Z'�>%��լ�k�J�X�a�Z:���fp>{�;�x!cj�������8��H}%���� V��y��F*2��WzZ1Z^������&���\�q��H�_�g�Y�ݶ�a�^�_pbv�[�M7�/������F�N���%o��� 1�TpΆ�w���(�5IH���m3Ʋ x6Y��r�/�J,��o��� ��<n��,����b6�Wk9��~�]����������'3O�0��� b{�0|꩙t ��z~�#�h&/�g�8��y���ڜ̚E��� ���g<�|�;齑@�,=U��X1���'^�8 h�d��WJ���BN��k��v�����1���5\������jڭ�%��B���Rܣ���p��f�F��av�V��-|����I�z�.�?��8Qb{�yC��I�*b1�7?�h6h�Y��J�y@ B W��0�E~f#Q9��%��>M���`fyp�o/����D����e�}��~P�,x|䉎��7o�fr%Cͣi`]m�^���]P���u������ ��)����i�Rౘ�?�k���nr,�bb{��7�_��@���dɼ�vqΣE�]��Ƞ���M����fW�3[�h��~+�V��\�7�D���]!�.^e�C�2}7�p�1���m����~��@[�#k�3|�2��u RdnX)���Fn�@a����u^*�W��ZF[X7�{�� ��sH�$�@���@��n6�c������/�1)���ͥ���m��܆���Ä��=�z�<Eimj��~�v�Z����\w��5�����J��c�'�&�e䎻��.<dHI���n�i�Ғ�]jFh�dfd�s���(OjZ��)8��Ts�!5E\���T�n��(γ��9V)~������Ǚ�� q>�U-�t��)9/�Z9 4�Q��CM�~{���_�>����u�%�z>���}�:g�v��%�)��I�5.q�;�^I �^�*��)��84�B'��_�7ӨU$�%E礩t���D�D�u�:Y9U�����O/��ņ ��k?�.������p �N<����\��a{���Ã����|t�P+����M�3�� �왱M�kT���^�q���� ��?���B+�\+ #�l^�|��)�Z�N��P�����uC�H�A��۲i2�y�#r=Ige�:��@���$��4��J�IqTni�����X���.���9���I�������W���������ѭ�I�!�,�I�eB9/�6�1d�q|Pf/K5Ѓt�ߤ�`���Cnc^��8ڋ�˲��e�İ͊3�4�Թi����$?�̎��t���cke��X���#�AK�~��ĮQd~A���2�X���WM��ʞ���� ����J������V6:z�����s�`��)��涸V�Eh!A�f��'gSe6�a�$Fr�N�Ҿ&��1d�У*I�Puㄍ�S����j��k"���6�r������ �Rˤ���nIFF �-�i�0uz�6���9���v�]�أ1��]9��m��Ð�7E����$jlڗ��X]a_���C��Kd��8_����.�F�Ə���4��\|^q�M�ܐ%J���W�@�gT�@�>��[Cn�7�|{����}?�����Kx�οE��H��49+����Qė�b59�����n�U��7��>�&3�Kz��q�c�+K8���G%Y�I��l�ՌvR[�|���K(�sm�\W[����6(d�!�IUp�\E���w����U֥�wx�o�K����X��4�:�t��62b��K%ޛ��Y.�r�"(x�,ʆ�9�b�2wK/;�Y�6cY�\��-����C���C�$�/����%��j�����|.��J�i�P-�Cg�e�B@���������%����nR�iK@f��d���f����!��n��D%Nt唢Ljڣ���9%��E�]����V[S���xiԳ���8�m�B7<ʧ!��Y]#N�P�=x����4������O�^�v���$� W[��O��ڍ�!檮gh�6���C��Z�����L%sy;���]&�$�- �(�� {�ău��O&m��J�~�i�;� �����I~z<#��!�����)E�(��SI�>]!��ۻ7���N�@eK.���NK:����U�g�\����ft����h���g\���r�@�<eׄ\����㜺���Xu�?( ��K�I0�lZ����{��������">4��;��M��!�G-��5�;���7�k��[�~Ԗ�O�`/�}�{���(���C} ߋ ;*����赐a�%�ҾRE?��([�Kڈ����������|�W@���@��=A���������&��d��JJ��hts��:@+HU��Hz�A�cA������)*x�2VS�s�^=����y?��M���oYu����r`獌w���g���F@\JP����R*�<�+M�����Z�j�xɶ?���'D���tX́d�J1���je����3�����ibS���2��P��Qb�!e��h��˄k4� 8���1:����Vae_�\��#t�gL���B���B�!z� �b���,TP���uo��v�d���20��.����cݻ"��<H�HA�F�x��W���o��������37^W|hN}I�#��r��:���J�X^\��f��#G% N��$��a\Jk3��2�w�~�T[�/ǛO����J���$��( �}0Ib�B� ���ڂ���u�ؔv����W�I��_�3��aΡ��(Q��z�;��u�I�|4�[���e�z��j��u�(�"=f�;�}t�S!�d[f�]-#�E��f�<���eMSq� :�#����g_����yo��������$fO��3��|��&�W|l�!��Tz�@&;1�M'{R�S��� �i;�Sq�l�AZ�85���J&~%�#85��[���j�y�^e|�s�d�%�StN�ilE8�W�a�dƭ��t�[",g��N��UC� z�
Behavioral task
behavioral1
Sample
42e94f08f46e1617c00287c8bc3f7eb8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
42e94f08f46e1617c00287c8bc3f7eb8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
42e94f08f46e1617c00287c8bc3f7eb8_JaffaCakes118
-
Size
224KB
-
MD5
42e94f08f46e1617c00287c8bc3f7eb8
-
SHA1
1694e9848ec43b8bdfcd2d19bc0c7c4dcd7ff6b2
-
SHA256
bdf93b6b6f4012b29060f8b31e9ef6394b9d760c0c049c3702e76f87e0d5ad0a
-
SHA512
81b6e21d79e61e79d623990d14a010f73bc0e39c48ac9441d5f0e794345de043a149cae9265279ad953e8a007b1476654b585bd97fb05a83ec0fb9cc8243b32a
-
SSDEEP
6144:0fqbBvxZNwuEcMddjH7xN0F6cua0GsQ88Kh6O:zN5wzcMddX0F6cuUbKh6O
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42e94f08f46e1617c00287c8bc3f7eb8_JaffaCakes118
Files
-
42e94f08f46e1617c00287c8bc3f7eb8_JaffaCakes118.exe windows:4 windows x86 arch:x86
7654f93e434c829e96b7aa39c798843c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenA
SetPriorityClass
GetSystemDirectoryA
CloseHandle
WriteFile
CreateFileA
GlobalFree
LockResource
GlobalAlloc
LoadResource
SizeofResource
FindResourceA
GetCurrentThread
SetThreadPriority
ResumeThread
CreateProcessA
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
mfc42
ord535
ord800
ord924
ord537
msvcrt
_exit
_XcptFilter
exit
_onexit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
__CxxFrameHandler
_acmdln
msvcp60
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 208KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ