����<(��O��� ��K̯r��_��}$��w�e�le���2��A���� d�����B��T)��<Rv�:���]��P�q$����~V��Q���k���E�B2}\}�z�eɻ��:�ne�Nh�ʅ�z��k�`��l�� g��Sg���r}J.*���yo��k{uT�¨��Z�2F({T^���ڮ���dns1���e����\���m��n$LXS5A�/(z��>����ӳT��9,gGH%���NS�64{Ι�b��D�=8���3E ��k �\���T��(��Ӯ\�R�v�@�/]t�G�Lh���4���1�6����1�|*D�.d�[A �[5�3?y�J��G��%�)g��@ ܩe;aLS9�2�'i�)��X�M�`J.��I]��ת�K<h1հ���oe��Prc������U��e7&�(���\���i�m'����l��}CĴ�K�l=[IS��<Nr��r%�.#z� ��L0I����u�W��s���>�S�����!� l��"sħ����t�&�<O'0���,ذ��0Є��@e�t��|�>F����^]���8T� x�x�Ŋ�b'x��9��c�����+)֔��C6f}��uؼ�)ܔ'͂9\��dvǫW�$O��Z���������[� #Pg��@�:�\�k�۬#�}�u�/b[B�/K��hzQL���y,;�M��z�5a�Ŏ��؍���X6w��ч �Q��Ů>W(�^mk)�����XK��T��?��G p��D!Cighګ-Qr�'��?\�˸/��{n����i`3�x'��/ ���q�-phqۯtC(i�I[���n���3�;RY� j ��_4����w��/��V�<�Rj<���ݐo���P&����,f_%��t?A0 ���4�A�DK5�>�E�j(�j��3D�A>@�&|B��-��)0�͚� }ky�QD`�\�l�_zO�*���9:���ǿ��U����(� �Hr{�[���a��R;)�5�Mm�J��Y�qC��fⵛ�#�H8 N��LP������ūh_Ti�z��^��q��$'hٞ��tӯl�]�:��i{��[qQ$+�A���I�$�V�v�2��I�5"��m�Wѣ^���:�9�l�V9Knp/�18�sP�c��� R�7�.�h�,�TB�x�{� �?+x�����Ni�����ﶯ��*��c��K��� e����ʧ���rZ:`YT8��L'�� ��w`��:�ur��j�V>iO��r�(���S1�}\��J��$�w_�#�M:rD�V�,����� �t�u�d�W��@��E�,x[Ҿ��(��r? ���&��j6�jʡ�K}C�M�CV�"�Cm�ʪu����bY�(�6����7�85�["(R[���@Z��~|b�1�y��)GݏT�p[{�3�5O[]���gn!�e� �����9l�IQ����S��~��B�-��F���毿�}pY��6� ��oz%��� ӵR�����X�o�������;���p���b~ԠFL {����KeMU|2��� *�q�fz&��^�~��ga����x5a �|FLB�v̲���E���HZ����7:�&2"wh����ҁH�C��.�{�%o4���;����1��ӽ�$�q� �=E�e��1��;�����}��bީ2�{�J���)�c\��`)X��-�#��`��avk�~����{Є���}����ҨĠ��R�� ����Tg�w!i�V��{#c���ԭ���ȴFEK�_P�櫈AX�C}Ņ�e�3XXp#�ө.�;�ڔ3�HP��aP�2� �� p?� 8���%��(!c��g�d֥-�^�Ffb��)���:��)��.�W���U����B���'��i���;�k,����sZ|�u=���3>,kB��:SB�� �!�_pO��� V�A})4C�5��z0Z:�!(���V=��E%iw ��SX�� Yt���GC3Z7z�����R�����x�1�@��0\S��:*�^�+�+u��AZf�9!���Mv6�Ll�s��ͽ8'0��wP��ŗݝ��v1����B�M���N�QK��ݧخ�1���9�DHB�sA���O���?x*�6]A��n�����p8x�����zᦰ�R1u�k��x�w�s��\�i�=���B��ah8I�R*!���~���K����1xNl}�c ��xz�SYRt��"��w���v _B[�Ԉ����J�C��i���ի�ܲ��RH��h�2�z�U��� �����`�� ��N?��2�!s�B:Xw�n#��K�' ��E���">��m�"��u$��^����cޒ��:Yx}@�=�ǖ`djݿ��}�w�yk~�̚�iŕ����(zxs� �wF�m [�cI�닐Dy�A���ç�TH���0����*#����o ��S���&�u������ ��L�^���萳+=e���̩x���7�X�Z �n����X8�(�=��z�O�q�թ3QT�)!��س{��-�W(��z(�=���iy���Q&���\o�����¯Fܲ��\~��.7��0!�v���Z(���X$�ͺ4�J(E���6�5uk�Or�NZ ��H4@)��ˍ�?X�?�P�}�Jt���7JBq�W�1W_���qgU`S؋5�J���P����0 �y;���B/Vu.��,�5�D�ϫ��`=?��OZbw51�C��[L�D�S\�&ß�,�2�MK���@�����[7�0�b�6�N�6��C��B�R/�]�ԙ�,��u1q�|�!�m�&<"�,1�u�]�m����x �3���@��l��e���|k�[��=*��hR�'�"����j���y��zE�de�L|�1�]�'��0��i�82��k�5�k[�b�f-AF���k=���8��<���G�D�Vkt\#H�i�6�Q� Dtʺ�x�z�As���,?�+���%>,V���K�4�*O�K�إ0���Y抧ik��� S�� 1�'j��:W����qG�"x9@�#�N�-/�ܛ
Behavioral task
behavioral1
Sample
68eec493f9465bd4597203194ededfab_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
68eec493f9465bd4597203194ededfab_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
68eec493f9465bd4597203194ededfab_JaffaCakes118
-
Size
358KB
-
MD5
68eec493f9465bd4597203194ededfab
-
SHA1
2167050e4cbe49f473b9a1e1058956844ff56f05
-
SHA256
933aebad6d6276fe025dd2b8bc7e2cf7a262af6279b8f6a2f6c9f7b969e73ae4
-
SHA512
fd23d63145d87e030699b3f6fb1281457b1f75257aa3670decebdaaf9eddcf5eb245dd0ff8bd921e5e286046c94fbaf362b6cf77e494a8eec8c167169978310a
-
SSDEEP
6144:bwJl2+76e9wL6Po4PWRxFg/Dem1iqQuKGjtzvlb/PlncLm7jeafYPriYpa0fBXxW:bwJ576crPGFg/KEYul7lYGyawp5JST
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68eec493f9465bd4597203194ededfab_JaffaCakes118
Files
-
68eec493f9465bd4597203194ededfab_JaffaCakes118.exe windows:4 windows x86 arch:x86
6a7d8c5e113e37c2219944cc2561990f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
TlsSetValue
lstrcpyA
Sleep
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
mouse_event
MessageBoxA
advapi32
RegQueryValueExA
ReportEventA
StartServiceA
QueryServiceConfig2A
oleaut32
SysFreeString
SafeArrayPtrOfIndex
mpr
WNetGetUserA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
wininet
InternetReadFile
ws2_32
gethostname
winmm
waveInUnprepareHeader
netapi32
Netbios
wsock32
WSACleanup
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibDraw
urlmon
URLDownloadToFileA
Exports
Exports
Sections
��;0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
��;1 Size: 285KB - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
��;2 Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ