�_�J3W�*�od����J�zTc�j����<��y۾����<�T�k��60K�B̿��[��MFa� ���žy���� t7 ]C��b��#螨���h��:q������~N���%]S��>���P��������D݅�Y4zQH�f�nK\��)�jE�E������-[�=��r,�כ=y�ٻx��.����3�F^�*z�$�u;e��`?Á�L&m��e17��\�z��T��������k�O�c��CI���-�6�n���*3ۛ��N�����;��;��d9�/&4���+���WV=ķ�l�j�>�`��!Ҁ�T�@æ�;�s��qx��-����� 1��"_���/��Y���B������w%�9�l=<�D�~���-��A-�6��-�B��HU<W����n>� �>7T<u�7&���nj�d������Mt�2[��D9lA�� Ր�*�y:��}IҒ�Q�_��0����K�$�l,������m�P0��Qb��*t��7|B�����]J�2wP�O�w���);Ne�G�in8�C���>q�����K�B|UN��� ����ز3z����AmU�a�Hł��r��]"�"wZk���v0��b�j8��*�����h"7���c��|�2�ӞĢU�����(�X�xs�y�I��'�dS�������]�� ��X��s9u���F�ޞ/������� JH؊�=ם�1w#�(X��BP��6��}�~=KU�-���<d�$������x+��Ρ?:a��WG��gB������R�t/�r�%����� ,������^�����.a8!A�NW��Gm��g�v������Za1�Mo�-R�y�~�A�F�u��LQ4��[z�����q��A �3˨b3�r��RP}�%M��{��1����Q<��ôw��*�����KJ�����-m�U65���2�@¨�����^m�i3�2���^��P���+Hg��@J�`.�An^�QI�9�;]uR��pW��l��I��Nc �{�7�Ar��$���pp�S��� 0u"I1�d�綁��p��W�y�J<��U�*�J�����Q�y��7��Y~b ��iД3(�"l �z�2��� ��y U�KD��B�0���%A���7�G,����V���� @�'"�}��UXcF��vT|aW1)xA��ia��y �$dI��5�I��A��casxЍ{15a[��iM�w�ĺ�l�m�3����c5�휄~��_�ˬ���������n���(�/��bY^Y���μ�nƙ��������Ӓ U\����9~� ��ܬ���`�鐑��h��W�_Zg?�n���S��]�6�j$h�@��5f,nޗa2`G8M?����d�t��Q?5�iY�TE ���Y�Z��0�̄%�E5���D�T}K*%��1G��{�!�R�����oG2���h�� ���ګ���ߝ$�\ �-Hs֑��5�����w6�-ໄ�Y��hj�� ��wMM�ׂz����Sy�?�`U�:�%���\Dl��c��=����Lhv�'�,��Y�`#40�R;H�}�N����Ѥe%�}�"�9hs<&l�)�V�yу8Ij�,䒱C>1�aK���0K���H5�"+�a"<����\I��0����?��G9���h]�������ዙ9���N�h���U�Z)�]]���'����[�������#��>�7������V�5�p��5��c��_�pM���`|�J��^e�J�b�� )������t�5����wI}�0�}��bhz�+\�M����%YaR�H"� ((�!9��֣�Ĥ�*�U����+!�#�;�,�'&7^�*�$���>D������T�]�z�����at#!Y�"���Wz�3�GGb`���P�Вhs��Z's�Leo 4��N�t�@��[�3. 7V��ҨML�z�t�6G`�^��s�S���}��]=�����mK��{f�!v�+έ�0�x�߿��&؉U� h��.^��ɩ�r鎦���h�jAZ�r\�����l�TU���j ;�"�^�zv���2� ��s��D��z_���3s����ܔ\����u+3؍K�K�D�����-!�w��5E�Gz;{���B&�E֗�Ҩ�٫�u�rpnTx � @Y���yoKeMy���(3P�|�'(V�eb͔��G�|'��R�/0UHy�7��M��r��ּ�5_�v�c��Nr+( ���zӒ�"�?�G"t,t��|�ulȍ�=�5��ed�g�� �ʳ����� �D<�f���IJ��}�#2ԟ�ÂƐ������6Z�\x���xI�p2m�c.�k�>v��Ͽ�z]�� ���W`]�%�1� �J�ބιg�~�E9���b��C��o���c�4E�6\����ӌ��;���7�^�!�-�]�ן�zd�TP�V���0�=���~������p�>�p3���"�|TF�T_q�og�����OCtMS�j��"Z&}�.�@�i��%��B&I��=K*���[z')�x�7Lr��&I`��E'r]�g�7-3X��*[��`<*$���g���c�M����o�0��hp� �1���F:��@`Ƥ]ᐿ6�昏����s�U�+�v�i{|s/���4�`�6ʅ U����ML�a�ŕ�PF�L)dM����X6WkֺW��*���K���������2��g�*�y�$��*<Cn{��v��Ë:����F��V*��5���ѫ���)3����w���E ��YfV�R��T��s�"K���k~q�(�/�7"���w���:�V%�F�^}Y�� �6��m�� ʕ�a�ʃ i���%����"�Y��d�Jl�*�(���z���{:����3�5� �lhen��T����%{$'��Y��*��y�1���A�p:��`��i�ѿ� Zi�F�Ix����s嚁Ty6�j��Ɋ=��C�9�� ��fR��|Y�՟6�h���m�=zNJ�&��(ަ������fɨ_�����ԬA]�
Behavioral task
behavioral1
Sample
6710dd52daac0bdbcfb5d6b2861c3701_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
6710dd52daac0bdbcfb5d6b2861c3701_JaffaCakes118
-
Size
1.6MB
-
MD5
6710dd52daac0bdbcfb5d6b2861c3701
-
SHA1
e2235c847f147acad68a4dc36767d870c87de96f
-
SHA256
eb4e0eb31f059960abcfb19dcc9b80d1ac054df2e93ed76be79904a480a0e30e
-
SHA512
4e11ac1bc2869a9e96cf405230b615d2e1dcc3beeb1d971c737e8853c107ae6972f4ac38993911fe7008b10f0e43c33782dee230f476d3807ad1c9982f9a4ee2
-
SSDEEP
49152:nl4nYsoovjzR/7UOx10qQY8qg4YXfemtsJUY:l4n7R/7UOx1ZI4YXWHU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6710dd52daac0bdbcfb5d6b2861c3701_JaffaCakes118
Files
-
6710dd52daac0bdbcfb5d6b2861c3701_JaffaCakes118.exe windows:4 windows x86 arch:x86
60b15bf29b0c9cd2718446c1a2b6f8c7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
getpeername
kernel32
LockFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
gdi32
CreateBitmap
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CreateILockBytesOnHGlobal
oleaut32
SysStringLen
comctl32
ord17
oledlg
ord8
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 478KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE