Z!��$R|(r�(Zbn�Հ��A����Mt.g��?z54���0N���u�lc�.z>�JFY`�,��DG��U���`�-�<]6U�@�\1��;%HD�$�����W)եy叿�-�J��`�j�`f�h^��p�s*v_�\H[���� ��L\@V���`��HՐ�zP���g0k����4ã�R8Y�c��"Z_*�[�m�`�O��+:�"0F���5�,lo�H��D�V�<:@K�>��e��������A�BF���?��aTD2��l{0���<��5���̈́�ǡ'59�����#�5���;�dk@��)h�y�Ł�#�X��_�.4q�g�T�~_��F�lq�nB��)�1� w~1����!�ʢ �&���`Uu��)�����1��P�{ �i���[�4D���K���r�x�I�(�����劢K?��)� ��sk+x��H��Ӕ�������Lӓ��S��ot��U�-*]�A������E3{Z�-11���<���b!�î�i�*L�d��亘�F�]؋��$;mZe-�3�x��'��ƕ ��;OT��?*�n�@��l��QxSj�q3���Ԣ ��L��w�"r.j�E���i���B���d�LN��v�~���cM~ͻM^#)�����v&ҚL�Z��`Nߤ��c���]�V��B v�Y��P|o&�r0mx#ؚ����!V���Hr�Ҹw�. �u �K��>z���z�u� ���bLJ9l`�L����GZ�/�6$T�q�ٱ3�`(�5�]�x��e�s�PGr�B������@'0I!}.����7m1�����נUB���_��⿄v�Ht}�j����c+?�^�B���H���3�C�/��Mh�zX�m���%�� ����d;d;�X��P���o`�%Kw<EgU����� |� �?XO阳��N�c2�[���b�}�v�`3��I�%�j�������-��E�J����N�7*e�3���#��K�{��.N�� �[8|��^C ��iDAx�e��]�حk�s` 4�65߅��O���˻<�W�AF۷�|�a������GN�s��{j���!�`ē�c�u�.}�F?�BVf�R��[ݸ�&��T�s�b�� :����u-L 3�o�J�1��A��n��[����k���d'��7��轒6�4N��H �K�?�����K�w6v���Cn ����?367.�3�H����Ǒ��f�<��E�OY�a��5i�c�i��\h5=F_V�fV�`���>\�U�j����6��a�,��]r$J~*�"� �����$n�o��4@F@&����s��E�k��<k���;@t�XtKe.e^���B�[�Kq�aѼ�=�7�l�K�H���{�[���s��oa\<^{̼����:�X8Gt4vI@^�K��W o��G�J_��bT������0��f u��rl.��� �� ��xR��o'K�N�(<XfO���,z�g�w���?ю�T����K(p���$�B����](H@9�,��n8�#���T{�(V���M�d����taL�ݛY&6��,�/i�I��B�J �!_i`O4��&6!�9��q�_�-K����g�q��N~��<Ɛc�7�ۮO<^�S����8��Y��h:������ 9q\6�7�QB#��MKh�P1I:_��LlKؔGE�g&EQ��{_@$�Ӄ�p0��km�ov�R�«yI4��������Z���c��y������ͧ����j���� ?DD�2#7x��"���x<]�XJ)�c���/g38���8�CF<�k��K8.l�*l�k$�R�#M�{v���3�xҼ{�J�ɦk7�ٌmF�6{,0�zePg�f�Y^���Y��RiӢ�W�Դ�2UFcӸ�}�Q)�<� ��7Y�Q�[l�/-)�[�p�G����4��T�� �#�p��ބ��F��R�XmO=� ��/&�����i��J�RH^��@)|��4�b�pv���Yq����q�`�1��������Wɛ��3ΫX�d0�$�U��?j�4-矪�Bh�'d_N��"MUv������g�D ��������߀T&_��������P�#S�\"����mWO*�{�P��E*����ȑ�hE�uu�)4v��^;�� j�>�1��3d�A�eFo�ϐ�|5�3��V��=u������֛�n{v:��YT�5(�ט�=���?#S&�x�"m�/9����ab�uO/����b~�BK0n��b����5�s�f�������;?/�WJ��X�l��@��k���a6>/P�c[��z��C3�I�c�[��j���}��y��E�2&��I~�]�\�D��S�|��3��t2��/��%N�����#��=��>����v��.��ҳ8�#���{^Ь�n��.�yZj�:JA�l�{ m=�!k�>�� 7C�?����c*�Mo����&t� W����9�Q,��]8Rg� 2����DT^zX�3𰄻�jF�v 3�/���!�`^,kEJe ǧ�K��.[�G���:�� ��C�g���T��h�����3�����&�F̺K�]���+�[�Ry��О���7��L����W�p~����q�-8+�)-��A�K�:-Vw�O��0HP���Y���˲��7�e�3D�Щ]� �N5p@TƔ ��D#���_�Xh����������psOK���D�E"�������6�T� ��s�}қI�-AaRd�T���L��'`��z� H���p��%A`ٝR+n�|�쬯����@�`��V1�+�#kr����k�k1{�e������8�Tl��B ��U�eȭ�$(�f 5�=(���o�����5i���n�Z�g�U7xB?49�Q�0�Ӓ�#e�t<�aʍ��������'ﴽ������p|DB���@�7������>+���Ͷ��B U��(�<Zti��5�'�FA%D�~:�h�H�/iLqEZ ���kPP���9���i?͔c��-hla�5����s|δ��ԑ�V
Behavioral task
behavioral1
Sample
46f96e8472a8248ce00d320d6e649c7b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
46f96e8472a8248ce00d320d6e649c7b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
46f96e8472a8248ce00d320d6e649c7b_JaffaCakes118
-
Size
400KB
-
MD5
46f96e8472a8248ce00d320d6e649c7b
-
SHA1
dedb2848010bbb60079e8636f944d6a3d69c1866
-
SHA256
d12a4067c1d51d50c96df95b5dfa7ac3779818700205693eb6565493b36f0b8b
-
SHA512
47f64269b81327c69facdadc2136d60b468ec4c3b240dbd1abc6797800c67ef2e9b55305d2169b271064936a0ce73047e48a8be8b1728fdcdb77fce7d20ec7dd
-
SSDEEP
12288:fz+j7dstg5u1VltiU1YOwDyrDMwXt9Yi:L+3dstg5YVltiFdwXLY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46f96e8472a8248ce00d320d6e649c7b_JaffaCakes118
Files
-
46f96e8472a8248ce00d320d6e649c7b_JaffaCakes118.exe windows:4 windows x86 arch:x86
996079d7e1f3cd152987e5cb54d8e4ba
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
DestroyMenu
MessageBoxA
gdi32
ExtSelectClipRgn
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
ShellExecuteExA
shlwapi
PathFindFileNameA
oledlg
ord8
ole32
CLSIDFromProgID
oleaut32
VariantCopy
ws2_32
socket
Exports
Exports
Sections
.text Size: - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 380KB - Virtual size: 376KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ