��%w�� ��G�аk��>d!f���ٹ/��� �;���������K��&?�����J!�]O�`�,��i��L��}M��1����g)w�@ͽCCG/�`%��"��6���vj�Ǜ�od����p�U�QQ����<�L�>���=ڬ�pj�1mj��o~�N�gvƁ�Wů �B��u0P�`�=O�`D�P�B�v�̆ab@�'�J�P�PK��.DJLެkQ3��V�0��<q�^�eꐂ|dk�}a���q���4������/Q������T�@c��%����o��L\�:�I�>�r=k������w�|V�4�� k-ȭc����ϾO��Yi�@.�'gv�����ňxKW���+���:�B������c��U4�hWDH/S�����Q�~���=��9�}�\.,���쟹�]�Oljrϲn���WXCxt��B��y+(�I����핎O�`��e�a�h�L#��:�a������_��j�V�� ��9]KK�l��[��v���8]�YE]��yFU�Y��%dƿ����/�z��#��C`4�B�/��#>76��~��O��j��l�~�ڹ���e>czz`i�UQ*ײ��q�v��n��y��ا+��~*�,���9+�ym!yS)N�,%7A���#��vo� �u�˓{�E:Ġ8�l*R��ӹʶ� b2��qz���~��:fY�\��}�}�C�柄6����EvL`,ϱ 9�-�e��#wP�U���:һ�6�鶥I�����e�u���ӎ�p�p)�y�D�R�`*���T0�(���eb}oU�c5,�&��U�?�k���{�&]�8�������(����������1�Y�Q�g;�����j������4s�����H�����l������5���Ba���"SqX:�%��'�_�B����͒����-t�fJ=&�N��<\�xA�>Pޜ���8GA���?Ģ�:aɧj�}� /�z74�$��!��q�Y�M�������<��o� D`�t�)u"��R�\H�����yӚ ���!�X`Mk�n �;�s�#���@0!o�&���>���#�j �� G݉o�����Oh n�N%~�3�����A:s�nT���r�<��hM[ֆr�ic4��W���*oL���k[�������p�9f�/����m������A��gbx��뭋�[��nY��[H�3*��ٝ}����L?���q.d�Y4�~�,�%���u��/6�?B��c�l*������w��#w/MF��I��;�W�sR���s���X[S�'Ò�2/�ޑh���5�]YP��xPL�T�� ���I�D�u�M���1���(�p�p�ס�\|'���h?�a M����4R^�LK?;�=�R4�^jˇ*���s )�N�GԐb�����/���}E�fB��I���G�v�����R�6k�%�pi�L��Ow��xў��� Mj�z9�g&��� ������<���W�s�1����-,7jDs��~��D8V�P� �I��{o&�ϰ"��w���.��s����o2j�l��KI��a�gv�i�⦶�Z ��u0��P�'�����=p�ʙ�#����S�C;�Ф����w˽T�H��Ú��n�2�"�/)v�U�MA�&�n�r@u2�"��l��|�,돫P���("=x�{;K����x'2�ءi� x=��pͱ'��qV@IJVV�.�}t�և+�hK��f7�(e�5�u�&��Mut����6���VǾ��fK���i�w�=�r���ɶ�j�zP��M;~v~�Z����;zZpk:��4�-aߠ_��GO a_��!?3�K-g�)=oW��C4��E�<)�e���SX�&��?�+m `��[��ʄ��'�$o�L\K� �D�X9��@O�0�S�`L���hLU�g0'���U����Ơ-Q�kr9��A@�W���7���l��v�{��O���gSi��u��I�����~n4p,Of�8�M�ޣ�d'ԯˊvi[t�E�,�3g3��A�Tq�g=��ig�n�@k��"͉��6W�O*h��`+�����R��F�O� �=q�m�ʥ3.��[v�O�@[�U�W�m�Dy�Nm������~;u�~�1d֔3D� P}��j���eLUJ�^�Y���F�Œ�Z)�-������N����9�`#j�H��З���@�Y|j(�w6*��V4�39^-R��@̪��W2��l�-$3�g��M��B�����{�el=�ՎA�#$��6Z \�ߗ��}�6��!h��h��(M{1�CA��V�k�+&v#�U���y�¤D�=�s�$�1ڲX�4���r˥4*��(��X�\gq�J�r�K���Q��ӏ�܄aԹ:KwAo6��jW����$�Y���P�"�'�C,=ɑ�>�dB�*���2�#=�~w�����\�v��N�^Pe�!�rw<�>LQ�gӇ�$;����k)��k�f����^?*�b�'� ��I^��j���\?#���סE"�}:�6�"w�|�b/�(e2<�ň�3м\pa�4KM��k�]�*-QnK��qW���;�����Q�m���I�>���ֽ"���t�Y��dIc�7���X�`��K���y9�k��ml��l��KЕ:4���ߠb�:Yt ���xA���^�\�����LHxXjϥ���f!����x��>���'���X�uo�s�� t��?)����>�m7��,#�(y$��ɰ�tE����r���Ny�g�D��4E�|����(.a�/��4��^���;�Mgax��;h�2|��[e ��ݮ���7�t!qz��� ���I�RK�P>Ij�;7<O�1Ȭ��� Y�2�H�fH���9�S�k+w�jsۛ>��[��?U�+n��I�T�eU��.�%Bt���Z��g�@%��YaE�aV!��G���1s0�#RB����Z�Q��P�7c�:��p3�f�C ��;���g@��Y°�p�koߦ�)8� FUğ�DL�ɥJ{qB�.�lZ}�~=|ך㙩F
Behavioral task
behavioral1
Sample
683d851188a147aca5c9cfe0e653d9bb_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
683d851188a147aca5c9cfe0e653d9bb_JaffaCakes118
-
Size
216KB
-
MD5
683d851188a147aca5c9cfe0e653d9bb
-
SHA1
a0e6d4c028cbb65ba2d9af8a9cd5415ea31324b1
-
SHA256
c1d8906dd38eb1a6d46d7c5c6e9db9412ed2d5f5242f11e163cfc95f4a6943bd
-
SHA512
00083bbe6099df4c26efe988f81aa96adee7576d904f1e7821a321d26d8c37a4c39fea78af986507abc1e45328549a85516f57c42af3b45cbec5a312fbb81854
-
SSDEEP
6144:VTJTZZClITAnHwjCFMNrs/gIUfOIRtCStL:1QVHWdfRtCCL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 683d851188a147aca5c9cfe0e653d9bb_JaffaCakes118
Files
-
683d851188a147aca5c9cfe0e653d9bb_JaffaCakes118.exe windows:4 windows x86 arch:x86
76ad242e57feef53e5d2bcc32df4f880
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
LoadResource
SizeofResource
GetModuleHandleA
FindResourceA
lstrcpyA
GetModuleFileNameA
GetSystemDirectoryA
GetWindowsDirectoryA
GetProcAddress
WriteFile
GetSystemDirectoryW
LoadLibraryA
CopyFileA
TerminateProcess
Sleep
CloseHandle
VirtualAlloc
VirtualFree
MoveFileA
HeapFree
GetStringTypeW
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetCPInfo
GetACP
GetOEMCP
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
HeapAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteA
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 100B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ