@�rA;�8�H���7���6W��/�<�$��1,e�H�YO�!Č�_�P��$��r�U�d�_=`uuh�O�y�����Ӿ&�*,����@��h�P&ȑ~үC6o2u��E,~����q�/�5��T@Dd~�Ƥ�%{��`n07&�9;x��^��~Sr�C2u�x�7����@DáM�H.�m-g fä�f(T���w��]6g�!�H[4<� ʾfDž'�F�\�P� �(Z�r�J1���Od�����!%��7o���TcB��>�˾5I������/���Ta���rp�Ф�1��чD�V�1\��U����[ȧ#��G��j�������� �2\dOZq7�8Nde��f�n��\�տ[����$��bUd��h�G;Ɣ��J��\��e(N�Sl�?t'&g��M�����p���ID��RI�OG�B�6���f��o1 e�s�㦋��樷��B�/��QFʆL�ߥP�$�$Z�4�'�3?o�qK-'v0�t�|v~4>V����8���%D`R�!����ct.�A�#ТxS>]ӄ�:�ߠ:}�*�0rpC:��������6����{!�v��\#뀕�7�7��f�k�[@-Ǫ�.�dt���)U��!?��-��3�� �����U��Y$��}��Y˽�:���� @�C�e��/47������ D^9_�t��qgD�X�cd��a������,��"��s���f`��)���h��� y����G� ���0aTe<�Z1j �I�+ ���5 �y�,E�͔v�g�˚����t g�G̑%���/�S�m�>]!;�^8?�@[���N?�%����s��<,T�5ntg����u����������ɲ:��@kM����@|� �K��#���F1��q�{���TQH�B�����_���-��TzȠ?�������2�{�������� �\m&�/�q<\I�غ&G����n������d�=}h�T��a)lZ�~E�Iih/|̢���fdj��%��U�x�y�a8<��]e��N�4v��m��^R�v?2�B<�{���1�����/��2�I���G�w:���<�.��岇���1�,���5ȼ�֓������j ��J�ց���D�9���7�7\����(3�s腟��z2`8j˗�n�)���L��p�^rYG?A �I�3�u�x�S��,ҽCW�v}�2D�g�L�Y�bT +Qn�cr蘩5�˽[�V�!ؤs�o��?;���}ϱ/����uz�?�mȏ�PvZ�fH�p��(68ݿ��\"ù�U>�h��[�w?١�Vm����B�5������bڀ1��s|�@�άํC�P^�X� ^���d��\�#�BvĴ�-,U��?���0�$4�մ����S�"2<�;�U�'�5����Z����¬�`M����C� :%7�v�On���� �6s��~%�{D�P�-w_�����c���D%���0�����3��ܒ�](�b��v�%,�+@D$�!���]�gĿ�nU�M�HCg%[n����@���p`d��iKb(�)�F�C�2'��2�4��L�2x:��|j'��H�i�D����������`�Y{��%}��(K�Ċ��� V���UmM�ZhT����߲P������A(&��Q4���O���9�g�ih<����'�C��|Kw�:P�����6K6�x¥>1���;z$��x SE > �6̀RU|��YW��s"*����L(ӘBwH�u�ތZ��_��H�{�a*�֊J �J4LxA�������H��o�;ǃFT���I3"%�F����{����i�~�ބvFyU��� g�ڕ6�^����8,d�yڔmpTɺ���v}q�b�o���%��Z�W��������7J�%�%шA)l��|pa� ���S�#�'��"�n�/���<ɾ�����~Ѹ«�����;i1٫I���BM���copa�d]�a������L� �i�7GTcè�� U�l��N�g���=q�Օ7�_��K,6G�����;@rf!�3C���<Ϭo�KT��f!���ԥ�����Ƶ$���>������s&�圃�:��'X�|�gz��0.Ow�YD!{H[�rFDuZ$N���O���{�[�U�H�KE7��sB�H���Z�f�O��c-�R�������� ��1���zͿK�2�4.�u��Ȍ�Tl m�C��{�Ơ�Q�4�nkP��cT=���!f����3�˖"�e^Ď�b�aa��`��|Fb�I��k2�O*���(�<W� S(5�hC��v�2gV� �S)�����vd7_ߋ03E��������?��\�A��z��Kk�'Bîϒo�aO��l|��R��Z;Ca�� z�i����v�f� ���Q���}�Ť��O�>��k ��H��JW��?4��FC����#R�IJ���Yl������,F#aA?��h��'p�~���ne�V�1�K��F��{0t��r�u�>$���6�i��N�4�!N��S:7��j��c�̓U�#�|Ҕgj^���O-��XQR0K�\52��m ?�mjLlc��v� �T�Z���֦J+p�����8����#U��l.p��'�|���U_{�5c.xD�*���K���be�h9�t�U *s/���@��A_JPJ�gm�Fa%t�כ&��V�vo���%�z���v��F�~�÷A*�ī�C�i��![p�B�R����kl�[�f�;��Ge_ɜ��y �;V#���R �)�pAoysL���:R�ꦑ��e���E�7_���Iaاb��Q*���N�X����U���m�ސ�"��Q�D�ucM3r��V)�k�(�O���d�*��_�A���!����b�J��u�g�κ[VO�!YJ�M�=�#���1�!-���g���ݦp��%���@�ǥ)�Y)��P�Jx��(�bhZiv[q$k\i?6�'�s�^��=mc���2���M��YoA.��_�e��%���Au�"��y���}5tu�?� �_H\��Dd�"�q�rim'�a��{w�Kw ��|�}���*�V
Behavioral task
behavioral1
Sample
667825d84117061a3768a4c3ba010c21_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
667825d84117061a3768a4c3ba010c21_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
667825d84117061a3768a4c3ba010c21_JaffaCakes118
-
Size
1.3MB
-
MD5
667825d84117061a3768a4c3ba010c21
-
SHA1
e6565c730721fe5c5767ae69129abba9f9e644b8
-
SHA256
07ceeceb2b54c1d1570284af3e35ab247c69d8e5c25e414d967017b186ae5bcd
-
SHA512
0edccb35e6e665d6a1be03fb324e4723661523fcf806089b2a9b9037086dbbd6466371eb056e331dd9703ebaadf03e6d8c4e4433ff989001342cd1b25344b5c1
-
SSDEEP
24576:Dod93kBy6xMV4d9WXA41sgP0cnImX8IlqUZjdxa86k9GJeDcUeCpTy:DodEZ0qkXbeEpNwC3GJKcUeCF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 667825d84117061a3768a4c3ba010c21_JaffaCakes118
Files
-
667825d84117061a3768a4c3ba010c21_JaffaCakes118.exe windows:4 windows x86 arch:x86
cf7baa8ade29503ed33e4955f5d3e17f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
TranslateMessage
MessageBoxA
gdi32
CreateSolidBrush
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
DragFinish
comctl32
ImageList_Destroy
shlwapi
PathFindExtensionA
oledlg
ord8
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayGetLBound
wsock32
WSAStartup
psapi
GetModuleFileNameExA
oleacc
LresultFromObject
Exports
Exports
Sections
.text Size: - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 607KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE