t�ڀ� ��т�\[��e�����#�]i4�����ҹfF�4Γv뚮C�G���>W�}x/�t�(�m�簛���4 �k8|ӉK�ͥ���"����⧵�D%0�)N�u*ڞ�m�a*��&��S�h�����Tv�1d���*b��p�8����ѠB.�Ûg���dž�GO�V�s:f�.�a0o��^֝=+Ʉ�!�pw ���[���ϙ�O���h�k�\M�,��A�!n9��1��c#G d�\�%����Ww\�"YD�V�#�_��m �5 OBs|�-rxG}< Eb��\v�5��M�"��z����~�<�Α�����nJ��">��r}�-����Y. �ByK����}��o��� �j~��wK[�E��`Pl�M)"q �4"��}��7�_�*�#�'��fʩK��|��uh_�� ���@1LQ��d$\i��P��H�.������d�/A+��q��6n��Az���PS�U��a� �"t�9�Ʀ��5�%���"�\��>5$���m@����Hj���ͫ�Aݝ`�0 �W��w�1���pZ��ؐbN��٫*rl-H=���qu\��+�M�����L�L���PGgT�*�aD��P�����y��A>�}����|"��L�{�����*y�k��y9a=��/��O��h�n�����%6ܞ�}w Y����7�~QcP;�&�>����r����7_lH�3x�Ї\�U`�M��$^��v�}ڢ��vC'� �ļ��njRB��W��`6LOn��j/H�7oR��ZDg����=�vJ�Yy� g��wY�|f��Z5����5�]�Ŗ����R�r��S�Z���Fp�m̢1�u�(�e����/�ݡ�DZp(S���:��D\��w�� u1�s@���J+���n�82G2r��I��PL08C��vh�w����.�h�ܽ�Z�ؖ8��|�sq^z��Ӱ9��J�Ai�乮��s ����V[Y��@���TuS:��:�RQ�A�J�0�g�l�zN:�+��:�Y��J.���2�:&�X�e���D�N�$5��|�!�v,��i�ޱ�)bH��7@vٻ�>o[��b�?Ъ��ݫ��$1�7H5t+�>>�r��9���+[�Q�8�0����<}����ڬ?�C�7B�l��g��������OGP��a��j*����{8��|�� ��A��v��� �Y6cw�@L� �F$r��PJ��j��B��M�h����~��lX;)��R����|��j��?� v��gb�����,��!�}#�`}v�i��'�m��j�:�.���`�������,����X�k����>��0�4���e��U�P��N��Hw}"`P�.��Uh�v:�-<n6Rt&H��`J��Bk'����?GZЄ�9T�U��)]%����P����"����>D��OY����{������K*��0������-w�o����g͚��� �ߘU)�����:�.���Q����3�*������$ ��"2)ŏRkR�f��qL�����W��B��)�e7.ԙ�R��`?y��!a����`z3B�8�"Pl�kX��L�֥8����B��.���2~+��w\��ib.����mU�L���i8��Ў)\S�� f��~;��.6ߴx��HE�L��8��+O���s�+n���V�q��J��1~�G�8Vl�8�`�v?�P��17`"��J�EM�Y���=��e㉗&X��D��j��k���|��e�б����+-� bL��]}o版�@�:�+��1�s*;��T(�=ˢ�.eɛtR�i�8�-�z�}���p2�`�x�|�#y��!5� �+gjn5� �e!��.Q�]�fӛEHna�N�r�x�ul ��ca%"J\9�����Y��0r�ļ��mF���sq���%�Ȁ%�R]�A���Pu��O��l0�C�䁯a�V����M;��e\�-�`U������~�)�<Ӽp������:�R�Ȥ�d��J���Á���$�� ��:!���H�`�!�~��h}^�v�tF�E���������í�w��X2�R�d�L����=N|* p�y��;ˏ���^{�N�>��[�[Gr�g�����N*-��?`D���~�ot�?��.Ij���|������DUq�a^ Y8����/Rԓ��3W{�Ͽ�A��T~lDs��S >��e�j�4�tI�|i��=������Kq���<�;���'�5w|$� SB��n9�M�WC��m���(���Kj[����Qȶf���3Q��.��M������>�r�G�n�\q���lh�E��d�&�̮ٷ ��᮲R ��Pv��S4�����R��u�%�o�E6�̿惕%�O)=����sJ�k-�]��D��)�����q�c7E����T� *�EϨs���kd��HOFdм[B��)xk�I��x眾�� 隘��%�=w9�j:d��LL�c�dg#s-�<��Ap|��e�?��i��ww���r��^7S����h��N�Yaz�[�R�{�,���CѺ~�wr7��u�10gAs���?6f�ѫl$�h��{��8P���L�R������<��a߿\b-�5UKK2�E�=2�y�#!�%S3>�� ���Y0pe2�k��#�����Q߁#Oxlt 3�0K��8'�K&����H%��A�^���2�����ij�������84������VȲ1>%I�hԯ����>|��;r���s�qכ��� ӱ��t-k�y�'-w.��[�b�s��[{��Pñ��+q� �����~���DŽ�0!�r��w��ut�(����cVVhn��� )�y�g�|=[��OR�?�A�^���-�C�&�Ý� ��T���zȽb߿�]�e�ɝ^�')�p�9e%�/-�Z>x2���� �'.W��//Fas����9�T��/��g�x�) yع�[�rR�klDa*h��{�1Y�&(%W-t�%���a� H��iѣӈj��Q3����7��џGlBց�X��B���Y� J����=����)��W�(a�<�TQr9����0�p ��)�~w
Behavioral task
behavioral1
Sample
6438bed41194ff955e7b5e7d20795bef_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6438bed41194ff955e7b5e7d20795bef_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6438bed41194ff955e7b5e7d20795bef_JaffaCakes118
-
Size
1.4MB
-
MD5
6438bed41194ff955e7b5e7d20795bef
-
SHA1
bfb015f3ffb51509135ef24f67677c24aa864afd
-
SHA256
90522b5299a0db7d8d08576d8dbfefd0a36fd683d7615e6d2d3aa346012a1978
-
SHA512
821950f86c8d71cc26d5f9972f394b455b40f92c6cf532223f5a03c7a45b691947ed64c462a5f177c2607973efdfb11a5759d05272efa15a85d733b7a66fd979
-
SSDEEP
24576:NOsWyz5koOY+4XMR+iiU6/MlXlPIOeakVmWkONNA0WSEoZunL2Ap3C6OCEtWqxq:5zbD+4847U6/OVkkWkONVQo5CSXC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6438bed41194ff955e7b5e7d20795bef_JaffaCakes118
Files
-
6438bed41194ff955e7b5e7d20795bef_JaffaCakes118.exe windows:4 windows x86 arch:x86
439154baa6e41b77155c09828c23520e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
SetFileAttributesA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetNextDlgTabItem
gdi32
CreatePalette
winmm
midiStreamOpen
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
OleFlushClipboard
oleaut32
SysStringLen
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
accept
wininet
InternetReadFile
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 556KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 605KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 518KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ