wm}��^�eʴϖ�[o�i����,m�e9�~���K� ����D �\�E����zgZ�.q��(bL��x�{ԁ�.�U�R]q���z��¯߅�{� ѫd���)���~LZ����z{?�����iy��1�6d�]����a ��b��W�(j!���n�m뺓�&����z���I�,������^dž6Q"(�&�Ǚ ����͟ <̵��q�I��<9��[���8`u�lG� Z�:�m�z��f,�3���r��^jacy�l)���N��P�DS�|ה�d���;��x�"�1l�yq�Y5�E�m4���dMY��N�b�+��i5��w�z0bAk �B~�E��Ci|��c2�һ�z 9���E�XR�|��(O&��6P�tJaD�N$�kw��(+9�]�E������0 ��y/ˊ�S�QAB�q�[�ձƶ�<�O[�f�4�(�Z`�"U�H96��O�����c�7��S #*�·���c��B��w,̑�i��,����}%�;<�~?��En:/JP]�d>;��ӈ�6�b��9�<�ر�H�����߳��D����6�DvG�/d6���/���[ &VD�![A�&f~W���Y�r��W��V���I Z�4��<:.`^�s��Y#@\�ij0����P�q/�AiU�p�*C~}�hNt�yś�a�`Gҗ!,�[!�٤3�]?3K��+��/�[������睘mg=&��{���Z��?٥��"�""#�������,�S�~����>gLno����m�p��d�W��6��,�P��@b'V�a�RL� �SKA_d0�dKZD�i��S�>f�� �/E~�5��`}V�5��A��]X�LOoe;�O[�k�R*Q���8�� nX&�lb��XgpÄLM��}���{,ݩޠ���gj����O<� ��z����zg��,�csv��?y��Qiy�6�� (Z�� SMU��oTGp� z�d��wWgtΗLd\oّ�6�K���,�X$el\���lx�uJ�@��#� ����5��������o�%(�P��p*��KB��X���Y���#�������;1��j��%�t�y�M�� o�[�[C��4f�K�L$����1��j���� ]8��!@mAI�h@RUy�L�Z�w�|D��% �[]?'�E[ �"0t���ŵ��-h6���k��8���i~��yf,&s<P6�!�ĩ2T���%y+��:ꛝ���n��F�r����hk,�y�J��"��<�����.iOl�K�Ch�9��;�1F�� qW�� �T��R��������m&"[��<F��{U��j�^��oN�8�Dy+^�Ag!��q��֚�8ܷ��_+:��s �3� �)�c�6G��{1\�m��D.���w������2?yb�m�5l�� ��${0�x�ǒ��>�ꀎn�;&����aU�9�X�5���~;��ҍEx��'ǘQkI#3��I�2���?/�͟�Ap :3z�/]�R�'��Ҁ�Q�SF2���eE_�Z��i`����r��ၮ�c�|�[�e�)2�W+x��K�����V��l`& ]��L�������2w��~c%��*&rO�ķ�j�c���#�q~J�CG� b+�qP���4q8J������o������R����#\��qP��j��U���b����G=Vő^�(m���eqj�<�o����9=�W)$�byTp�?�&�^��X���`���rPB�BgԺ�_���:�a����Ҽ}O����"g�r �k[.a.5 q�H�G"˜���R��~�2�����C�:,#V�6��mD2l[������ҧ?~��L���f$NP���%�EY������R��uP*�l�Q���/99�P��XXKF� �e-%v�5MO��|T���yS��sb�]�Xt��d[gu�mc}m�:ȳ�C��`�NjH�N��97�l8 �}3�m�9���K>�x�L���B��3��Y���}@@m�7���� �W ��zmD��M}meH��F���F<��9��H��L���O̰��L�����\�Z�M�ĵ��W^S��Qg;�k��� �$]�ޠ@$ T���W�.��U��`�t�:��PW_vF����@<��7���_�G -^����Yh=7d�A,%XOԊm�F�|�����W��Ly���K�Nj7BlI����y2cO�[��7I/�k]�v@ �E尕�����-v'b��{NpwQ�j��Z�G|y$�������X̲�`ټ�L\p"i�@͛�I���Y�Н^*Z2�S' ���J��s��y�������-�I�t���x���$�..x��gT�; ㄒ88~=-��y��*g0��S��_dPP����E�%�� V�����&� QN:<�o�P�E��P�@b�L��;Z]wR����b\~o�N�^��Q_k�K�3i��g``8FSjK��B� ��`v"b�M�-&���幩��v�؆7A�B�~B~�E9�Pq�®_)�dhX��~����̫/E{�4ׅef{}.m���u�d��-���'`�w��,EV�Щn/C��c��4����)6I)^��f^N�n+�7����w�o�� Gp.�н��c!�A��x�ejyq����C��foB��_'MC���U����1=��a���r�:r������R�0�����r�gG���Z�t��H�b��}8�J��ˮtdۛ�^�=(B`��5L ��f�IHO�>]��_-i����u�@�l�Mp�m܌�R���͟��i��䳅ښ�/� 1�; /�tǸ,�9#���8��'Ta2Wx���8�ι�/���+��m�{��"l�: ^AQVBi��#v1���YS�E�H �=�Mg[4]�$?;�u�|oV�ƽH�q�u)P��[7�g�'�4�j�8�9�����I�ol��$mVo���&��P,�tu�N��*E>��-�����9 ����>���۾���;!B)��ӏ�<ˇx.jx��_����!r��E�0y]�� �E i�'�L�ৣ �/�A �z+�Z�%����MBux6μ���o�Nfބ������^~
Behavioral task
behavioral1
Sample
60b426c35e16bfed549e2928220bf948_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60b426c35e16bfed549e2928220bf948_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
60b426c35e16bfed549e2928220bf948_JaffaCakes118
-
Size
123KB
-
MD5
60b426c35e16bfed549e2928220bf948
-
SHA1
d787bdc1e61dff79797976014bb44c7379fc29b4
-
SHA256
7c6a3bb7f614442cdf592d622cee3b73e17413c37723031ce0f8e997f28f3d4e
-
SHA512
591597d6894fe8e01c2432131bd02697ada0bd83348c57fce37bdd349cc67ef5fad8437f2127734ecd7e766c896f1e7790d4504fb2d3edff382aebba9157ff7d
-
SSDEEP
3072:GJd0lvQTNOCm202t6zDBJ6mRNhYz134x6mSYI/:Gglv1Cm20Y6zDBVR6R4of
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60b426c35e16bfed549e2928220bf948_JaffaCakes118
Files
-
60b426c35e16bfed549e2928220bf948_JaffaCakes118.exe windows:5 windows x86 arch:x86
cb0956ecc5fec9d5a65b60a01c24b08d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcp100
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
msvcr100
_commode
wininet
InternetReadFile
rpcrt4
UuidCreateSequential
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE