+��03�L��/�<.P;~�|��e�A7g�S�+%��=��ޙ����hǔM�`_ ����iӠ�كRb�ȫ7S���*�$�����S���?�PÕ�#��I��$��q�0���6���wź���-Z�C 24� �ڋ���`dv/[w�C��� ݆�K���eu��Y�!;��ʳ��X�Jt�;���i+��B�1Ö���'*��M�c�� f\���\|��[��#��.a���5�qP���* ����k�MP�� �j���yl1%P"���t���� ���{��|�!�)[7䶨 y8b�O`�4v��Ld���4ܛ��Ӡ��O���c/o?b"��@���?��*������^hѱ�n�,���ӳ�l��j%ȼҸ�x��Y�)�� �(�4ɻU=Jv�������0xm�|��u�et��� �FbW��t�y K6_ ���ㆌ�?����ޙ��(l��O��ȮD݈��Ӽ���?�ʮ@�����I'�i�\-��Q���%��rM���i;LP��W�q�| .��0�Pd_)�Q~{���CN�t��4�R��8Ys��f��f �N����Yn6]b/iM�L��?X�h����ؙ}����3�����ۛ�jzSu~������$�i��M����fg�O_��ߙ�q����J��^��6D�� � �`A���]�A���l�N��4��F��~ �+�c;F�7�0, a�3�l)� �p�<-��v��}���O���0B%'���`���7���-L"�/ƚ�=w;$�3R��`<'�����y����^��j�ʟqX�������&_���p�%;�n<Ѹr��l�9�uE��B�(���@�2��}��O08ױ�Aqsu�}�9yK�}���!_:,q�1�$zc��>�r�^R��S�D�$�B�~ j��a�{�&��3f���]\jRv����s$� ۫Z;V�Š\�����[���[O�jn|4�~��f����圉�-����rē�#�ی�Nw�d϶�;uE�>���<r��ъ����4�x\XФ!3�Pa�䍜�[���1���ANp��D�ꕝЩUYI=����ig��xqeg��P�;�� ,�p����-o7�|��Wq�/ώֿ���Gy��הr����~Mq; ��� ��>��$�+"����mG��u��e��O���'{U� �̪�wvE�|�&�����:B���_F��<��J,5����M�pn��4$Ew�ݯ��2a%�5 �[R\!��M�ߴh��0}��6�a&a��1>����>dZ����n!��� )(�9�G��E*��~��xz�<h��#�ِ�sׯ{�<��4��=�QFW"��j��I$�֛b.���� S��`��� ��q �-����Q���ű��lv����3��sN���R��:�Pèk��KG���J|���7�-��֭�����l2х'ǜ�����r*nj�s��,���t.v{I��%��mGE�tQ����d�[�t%g<�_n/�}�@�;m�+K���Uf/�¢$N�H�^������PIb��D���1h^��K�P���+�f �nĆ���)e!���yg4���o j*i>�e�-SZ..��[��i t5^�LLD81����[�z���L*L4گ,�X�� ��*��ܹ��/�$N��\��P�J]i���("y��s�aڠo����D��@�������X��[������~\���%�E���&������#�12��͏c9p͝뜂�t�і%��]KlX��R��=N-C�@D������<�Z\�}ܓa�t����2��7oθok. ��¾:��w��f��/�s�U@�g�X� �zn;�Q�P�3gu� ά�Z�x�^Ȱ&O�8�#����C�yEv��D�T@���/|��G�!��$��+�n�Ď�, ��ھ*9�@�Wt�+8�������g�p�:��Vn�ɽ���ϣ��i���ZJ(v�=�%�xo�����q�'Ҿ���j�+����� L*���4��1w�c0-]D,D��γ"a~`u���;�nw�?�W�rh��^n��z����u�g��A��}��% G��՜�E��6�Pc�m��q֖�ݞ!c�2"����Y��g� ��C�~�������lۯ�Gd����S�nk�Jz�7L%�����ҍûo�#��g���"<�-���f��(:'����l��,u����R�����k��j��?n��k��X@Z�+����3"� ��. �xf %:�h�D# V����%ǖD��"���~�����4ڦ��`C.����/m���B�lE��'����U�p��.�V\� ��D�h�{_vA��*:���(�H��RNtR;�}�@��(Jܶ��,jɗA�s��̥{<��n�|����|xB�������(U:s�V�����tb� ����]Db#�����3������moo}i3 ��$P�<���A'��Ƌr�~OLb�w�!�ԓ���сr �~���y��=�g�[G@J�9i�BB5�+��C�msL'W���$��U*�P����]�����I���h�?r= ���썒,.j+�� t^�\a�{��b�6��S��6K�7����c�NB���n*�;����V�G��r�A ���h]�H���ڕ��R]Nw� ���҂=��A6$��&w �@&�߂�!�T���r�^�F�Ξ�.�Z�������W�)=��3�3����]�2��A���,��!_�93$Fu��A�T���.�Qu?a:v��m f�fJ��ӗc�6~o��b�F��Kj����=.�V�m��3��=��u�����`�����B�@�+NV�4f��(G�Q�:�b��i�,�~ގ��K:B��} ��R$�y��5 � �.�ݖR?�W�#��3P�kG�dx�\I&u��rW�����e�7@tbo� ^19����;MWiC �1&�q��>>$���:UV�"��0&R���Lr<�U�����]��ł�W���2YAA�>p�2ئvy� ���л��l"h*����%,?����:�:
Behavioral task
behavioral1
Sample
44f590e72079d9db65b0fd6cda37eeb5_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
44f590e72079d9db65b0fd6cda37eeb5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44f590e72079d9db65b0fd6cda37eeb5_JaffaCakes118
-
Size
1.9MB
-
MD5
44f590e72079d9db65b0fd6cda37eeb5
-
SHA1
a3be03c4624fb6fa2e110693d151b41cca7fa38b
-
SHA256
44f2962fce3cafad860ea86fe8890da2ff3affa4e3c24515fca61fdfc9fdc5a2
-
SHA512
acc8db728fc7636788a519d6d59b599234c6ba2d2e6d1fdd90ff970ba609a19c7d2b3bf8019b325a6079e7f2588a24df5d7870284b4748f826d41a9bf5794187
-
SSDEEP
49152:w/k1H7Db2+v56vUs9ycgYxmk8bRbS9h8ytof:igbFvc3gbbRmHof
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44f590e72079d9db65b0fd6cda37eeb5_JaffaCakes118
Files
-
44f590e72079d9db65b0fd6cda37eeb5_JaffaCakes118.exe windows:4 windows x86 arch:x86
aac7ede202c70c99ed9e1fcd0b0887b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutPrepareHeader
ws2_32
ioctlsocket
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetPropA
gdi32
SaveDC
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CoRegisterMessageFilter
oleaut32
VariantChangeType
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ