VU=2��i<�Fg�Ur�A���o�v���!��Nݧ�?�� ��|u�DB�sj������-�}\�d�lq�<:���aß�퓆���0^�];IQ�Ӱ�븇0�C�:uS5�g�=w����^I擓5���ㅬ��oFKo@�5sW���W)��tf�bn�]v�@"Y�7TL���N�nje�2�X���K^��·�g����jK�v�W�X Q*���8�g�M����AF}��>�e2\�)�^Y-JDr��B|��[&�3�T�ǠBp&F�u��K�ɂ����@N��oy�T��\�Xcj�V.��,�����'6̊�[�DdҔ,ݰR ����|Q�ֶDIy�_DcU~z����篪-&x�� �gT�F��_=�8Y�[�lʥ���js����q��� ��}�>����z�����w^H�[�������]�b�D��!�>�7�7�dØW*nt�tU*ʶ���@��Oы�?��M� ��"Q#^O�9妆�{����U?}]�q�N�:ra`]K���w 1ߕ�$ИiM^�G���7�Biψ�;I�2P��t۱G�)�[.�!S���2���4|E�G3{��w~a�v�� �����H�^uj6�0�C� O�R�q;�6�qN��衾���G���s�����YN��ݫ�/��,�&n��6&zT�ʌa>P1�ɩ<~��9ʢ����\6�f͕��V�Xu��Tc ��E��_4�}�� �� A�]{�.�0aT]�)-3i������1�=���c:�ㄫ�3�B*�s��2Z�-�G���+�W���"{�[T�㭲~�:�H1��.;� 2uTUC�����B�l��e��1҅�7�Lq���/����^���V�@eE2u ����}E�̟Kӡ3� Gi��yǠ��6���&��eBu���jz����d�F�{(� Q(ѤD2-����GIHy/"�PU&!b���� ��� !d���-��q_T3QDc/��ُ�T� {l���3�����Z�;�lO��v�j�:j�(���ê/l@fiB(;Y��r���m�3+1S��o1�>:U�J�usya� 1��O�A�;E�=�_��/��p���ǵG�K *L���ڛ�h�$-�`ހ����O�B����A''ˬ���Kҡ`�H'�=���\��2p{ d8��@q����o���\�C�8G�t��b�0��Ss�WAȸ!��,��F%�.� ֝#�@�п(b�����@�Y�3�f��ۿ��/_��N�������Lb��PaߐR����<���� �� D���:���CM{��R�X�r�oC;B�OSm+��#r%1��7�z .*X��lZ��;oo)*�R(r���s ^t��7���3�t��C @�8P�k�Q�z*6@�Rbѓx�-`D�U?<\s�G�)��<�G�}S�������Ų���xk��?4\N�hf��?i�A;�f�5%�}��^I-� ��X�)ZB��s���btx�#���o�G�G�Q�l��uo��ߋ�ws�����EYU_���W�'��;���wۊ����"cZ@+Ǎ ��&1lS ��'�q)�LnE�XyzEl_����d့�\a��8���mf]�b��<��}�H;F�IR��X�O���l�!c{�O(����$}C�hU(��!������r���Z��8h���B��#�H�����j\f�W�r'6K�2&�_�F����:��:����L ��7l��q�c����;T$�C}�pX��to��\���t�6����$u<P� ��a��΅樤���.���H�>a�h�P���5�FL�u���̫� *������oO�ן+��a����9�\��jH�EŭM�y�V�>o�i�/�'0�����b� ^��;�.~������5~]�ʼn�G�ђ��� �+'�����q�*ֺ��6�D���u�!^G�N� ^��Pv��K�5�����ٗ�.f���Ȥ�Rz���:�`�]�I��ma�%&�e�E�_$�՞;��Zϕ8���쭌�L����g�fM^n�б��֗Br�Zc�;b���3@n�5���qP������xU)��t)� ���4���Ys��l{+�TLN�uM���b]̩���6. �p[���GE���Fy�6$��B�txШ�H���S]�������u6B��OQ����)�^���W��c/���ni'�q�2�5�U��:#1&�*�TL������e[���V��H�����}���N�37��:k���D-B� ��R2�!�h:Ι7�T��Y���F�V|S�m��<;��L��ݛg�����~� ,{Qۀ5JH�@M�j����+�$[��O�ނ�'.�}/pi��}y �9QP��m�d���]�\���@U�(�}��Q9�^��0�!,:����r��s���-�G�b��B�P!��$���W��� �/�1���x� �R|(�]���ԧb7�=<|k��3�lw�oE�wm_���ʩ=�ffX7Jx���w����|V_$�l��b�K�/��o���7r�������YG�NR]������X�:>��t��݃Spؽ�:!ʝ�|���w���E#��:@��zPA������[C���g0�G�E����+�/Z�C�<�%���v4G���0���N�+U?@�_>bߖ��~Kz�����̛$!�yH��\�[�w�����ij ~�r�~���� �xc���Z9�'T��A�#�Xb.f<������D����P3�����B��$\��쥸����CD���`o�O�S���68N禎�-�����0gT�,�4�`^�9������L|�*�"��=t7�?>�T�tUH��>���\�4'����M>N�;wI�½Р�ט��G4)��ct��[}�M�\o=��3�$s<�p�(��ǘ���JU�x���6�A��,��� �� ��JY3f��R�,(>1�H@�365YCB� ����> 7�t��P�2E�>F&�h?��;bh�u�IŵF��~�T� �$%^���ѕ�7�����"������.q<�s!�\��7Wp���B�[���9\H�wa���x�
Behavioral task
behavioral1
Sample
5dab8a8c14bcd8dd9344535afb12f25b_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
5dab8a8c14bcd8dd9344535afb12f25b_JaffaCakes118
-
Size
128KB
-
MD5
5dab8a8c14bcd8dd9344535afb12f25b
-
SHA1
bc38c0bb3a0ec6137743a14ada937efe2f39044e
-
SHA256
fb040f88ef0b1238f04be52d703cb5c46a8dbd50be26af0535f6756c858c0c63
-
SHA512
aca4dc99320f9156dddfcae7293187d7932e892caab30baaa1515432a4017fd2e9820ff4ba18003d98fd3507c84e0b5b8f163d4da5bab2c32eb0114bcc760c44
-
SSDEEP
3072:aMKOC5KRWwomhrURwrU2lbfjmBzDZFjSMZql9M8izpur:Y5cWlmhrUCrUcjmBzdFtclRGpur
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5dab8a8c14bcd8dd9344535afb12f25b_JaffaCakes118
Files
-
5dab8a8c14bcd8dd9344535afb12f25b_JaffaCakes118.exe windows:4 windows x86 arch:x86
82af35534cfbca5dfaa27303401f90c2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
CreateEventA
GetProcAddress
LoadResource
WaitForSingleObject
GetModuleHandleA
LockResource
SizeofResource
DeleteFileA
GetWindowsDirectoryA
FindResourceA
Sleep
FreeResource
GetModuleFileNameA
CloseHandle
CreateFileA
WriteFile
LoadLibraryA
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
LoadIconA
RegisterClassA
LoadCursorA
MessageBoxA
gdi32
GetStockObject
advapi32
RegCreateKeyExA
ControlService
StartServiceA
RegOpenKeyA
RegSetValueExA
RegCloseKey
OpenServiceA
OpenSCManagerA
ChangeServiceConfigA
msvcrt
sprintf
rand
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
Exports
Exports
Sections
.text Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: - Virtual size: 77B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 112KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ