IgG�:;ۘaD�!� �b�1� ��NL;����u�q ��A��Y��h�F�q�<ăp���8��S�k��9s��>�܉�!Ā�pb�O�xM��� ��%�^(�g�܍�kp-B��,���4U����M�N5�g�O�Y��y���#6� ;��T�J��0��) ��Hբ�)��Dm��Y�P�v �� ��!~)����a�"]{����z�q�L�br�\)pJ9���&$��~JLꚴ�K~�Ԩl�jb!��������Z�NM���tF�ם�e'1y��WEj�S; �����e��/��6*�[:�E��Oò���<<���nD�5{�6j��#ѵU�ܧ��?��h��C��Dֈ��4��$& z����_;澙��S5�->R���+ӿ�#d�Sv%�����ˮ#R����0��_���u����%hRl�H���cѲ�{���>흴��*�]�ŋE�2�� Ʀ���XCt����(��a�y�e�k���."�x�9�� �Y�g^R6a��������7��e�;�����ߧ�q5���!J��E��A�8 ����� z�c9P�Ӥܬ�?�LM�?u��!��\`���������y 0�e>��*kd�jOŖ�i���_��/ � �t^�!� f���v�3X���lFd��/�~�jԴX�z�sI0\���4�4:Y��(�i��Y��Ӳա_Hݜ�������w�(w�0A�&����D�tqjTZ)�yJ)[q�V�G�6���J��8t��d��d�hlO|!��Ot�X��¯�#��1[� Q9�@"ݘUA�p����Qٽ�C>�o��{T�1�6=Gzk����t}�p_��/�|�#}�|`qePb����OCY=v`z�XG�k��Ԕ�ip�#�����6��";��z�a9�졄�Đ�L�6<f��?�y���-Ӝ��������4�^#��Ӹ6Ӓ���k��ͷtkd���mX��*� �,N}�X6����NR�u�Ah��j��cF���d��̧0s1 #f}��ũKlQx遜��CzĽ��4��H�^�pQ\��v�,S!��Z�/�KC��s'F`S aꅿ�=-#P�<��{������Vz*�%TI/ ����Xn�N[H��n/m�)>��g(����qig��#s���C4dg�ūw�Y��l)���w(f���'���N��S92Bb� /�Fj��)��R����u"p�7fY(7�4�RLW$cѷ{�:K���ӨQ��ZjD��Q��U�ؽ��NG2 �����+�Ȥ�K�0U����ћ�Ou�W*��$|l�+?Jr6,�}j���c뷡�����p�=w�i���SgKz!b ���"�<PJ�Yx�hk�\���hjŎ����"��z�J�(�@o��o��HRh��^���;f���3M�_>�)Y�[ͯ�<�oL�M���Zw��U+�w]���T��'� Î�WR�yA�W��\�B�y�ڝ��5�}�V�\3��i�̋�W�f伒r�Ko[z�9�-?7��Yo���ӷ����4y��6oM�i��� ��7���t��jv �ʑ֒�˦�F��^}7̓b���|��:��mPǙ�$@Ǹ��+��dM��^w N��oձ�Q��ѐ g���������ז���� �>�ϗkB��S��1];�}G��a��c�����w��!P���qe�P%9A�~��L^�������xI/��Y.�A�/%Ze�s/`�� ��CZ|�2@�l���48��2.���|U��וv��S�[��O�N�v�/:v{��dJ=۾��O(��v�+�#}�.�b�Vl�����g�L+��nM���麆̚ɻ�!���FZD{'��:`��l9 �*U�ݘxj���(��n��%]S��({�m�6��7�a��ܙ{�+�(�\߹������f �G�n��링{x��"���D���w}���\�����`�~j?�C�<ɼ)�Qm��F��cP�E��)(n3��Mk���^���3$pDP��رgi����R���P�d�o����]�!sW}�8)9j�%�D��5RK�����㠝���뢣��bZ(��0:������_��\�ȕu� ��H_{k�u�����ٹ�¤�==|V��2���:?��}�����4%�l��a�F���E�D0C�D����5�� ��x���Z:��EΨPgo�u����|�f9�����*7l�g��4L~�a2^�����S�?g<m� ���َ\�z�+�_��ؘ溺1�cn�]�������e�Y�UT^S����Kc��m�NM�[�ʼ�s�����d�\YjH�6��������s7�*�f�L_Jf�d%O��==���m�m�q� �XPި�����u� ��A�>E���z�a�UOZe���/�3��t፰B5��� �1�.ߞ$av�����[��q����a�%*d��l6���c�cv��0���tC ,}.�B����1L��a�ۼ�_ś�߰�;8��g��fJ������O�^+����@ÝS�"�+4�6�I:d�[��h=��o.����[�ϿK��*��B���f�0E�*P��Fg��#�x"���(mʊ&�h�|�IlD.�~C����l��G��͜0(Q�� ܙ>,��>�Зl�w:$�^?�Rv��U�h�2� g�ϓ�>�{ �'�P7m q1��_�-�p`��|�`Q^��W[UA���U��T��U<���}�G�nوYs�eH��U�]ΒƬw�{��gg����e ���ۻ@�A)��E� D8��;�ە*�cJ�k�&����Z4�2ׅ�e���\�3�� ��Q�H��)����l�h�� ��a)(����o���ﰄ/�Yx�6U��%i��l��%|g�ɾ�s%�e����}&Gh)x&Q�z�Kk�]�.��������]6���?Z�*]̼�6��h��Э#'�p��Y�<w����K����0\�g@�}���;!�y�P�� ���������p�7��+DϊP�b�W�ڽ��l3JWٺ�84 �룀"u���7���Jj��
Behavioral task
behavioral1
Sample
4dd33c2d1a2fe87e2f3d03e2ef223507_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
4dd33c2d1a2fe87e2f3d03e2ef223507_JaffaCakes118
-
Size
1.2MB
-
MD5
4dd33c2d1a2fe87e2f3d03e2ef223507
-
SHA1
0093474dbbc60a280ca1c7ff8a5e340e6a0ae713
-
SHA256
0ee9a92dea8740b15cdce255ceb428c118294fb87bc59af5b130809972fff298
-
SHA512
46ba08be008c944ec1bf6237d475eb8ebab687bd98bf88772cc2dcf30bbd52ca4eb534c6572bbf741a3b2af36a8d6c133d407980fa19a6de3c93dc431f633029
-
SSDEEP
24576:SVe2baR4nNvQ/bdjnLPo5KLFtBzu/R04Yxc3X0PRCt8Jw1F1Udhds:SI2O26dvPo4LduJ0MX0PRi8i27ds
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dd33c2d1a2fe87e2f3d03e2ef223507_JaffaCakes118
Files
-
4dd33c2d1a2fe87e2f3d03e2ef223507_JaffaCakes118.exe windows:4 windows x86 arch:x86
2a01f09c309f4fb07d46c792e15e6f10
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiStreamRestart
ws2_32
WSACleanup
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
gdi32
SetTextColor
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
SHEmptyRecycleBinA
ole32
OleIsCurrentClipboard
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetSetOptionA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 762KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 731KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 341KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE