AH'�G�s����3�&u�u���c���c�B�į�ɹ}�N������r��i��܈D�a4��Vh�L��%wc��!O�t(��GU���S�-�5a�\+xPz�����w��䂆���2(�e;?.K��7d����8$wf���K�_"�j�m� [tۈ���"�Ed4��Hۗ[���-X�R�ٕ��cƩ��"�i��C�2>k�r�N��l��@,/G����K� O�/�����cu���_�~�=��U��,�XO/;k[��ӵa�?��V�%qu��{�y���R|-!�����n�/C��o��3������ٲ>�5Y�oa��m�%Lƒ#��Vփ��G���-���O��8b.Z�N�IDm��g�Jj�z�{�O����I(5�kr��'H>Nn�x��Q&��`�,b�T\��t�Ӌ�D2��P'�Sd�O6ѓ^��+ѢR�c��d��L�Df+�<{�aބ������ ��o2@zd�y�-F���kA�!Hؾ�]�oo�4;x����x��ה�Ģ�7�J]ȯZG_|���˼��k�ݼ���V��T-2��W9�����CŒ�D�sDS�D�v��.��&�+�]̖�����o%욊?�p��j�-�%B�HVǫ�T���Uk �X]If�`w�3���K��3�#�������������%�� _E0i[��N/�N࿃_)�l�z��nOT��Z{���x���;��aT���KN{dg��M+pa}��t��+����h_�'�4(C�9�e�V[�(ɐ�Яns�%�T�m�Ā2��WD�T[��Uw�����[g\V{˃����Xz��T�/쩾x��� ݝ����<��"ΧfQt��lH�Ĩ,N~�^}8r=ܛ-��Fߔ� (����d��]�2�"����S�|�s���'_u������K�3�5$-�{ji���U��L�8\�_���em`]�%�'sS=�� ޓ��0Iԓ��腩K�`:��Nj2v����D\�R�j��0�i jD�(�l���N��� ��;[ɵ(1�i����,ϒ1AK�5�����������l�W��h��-{�\E�n25\�q�WI�č3[:/�7�%Hv)��E���ħ���T����#I���+m�c&:cX�" �� ��L��ae�=�����4p��t�{`��@"U8b4zb�nI�Z�镽��D/ ��rU��ԣ�yx]�t�<'oa!�"]���$;��"�����߳<���x��3YE����ܬ�x+*�Ԑњ\��nص����c7�Vh]54C͢��x/š���Ux� Xm\Pō<�˚���%A������h��6�+Z�P�g/��m7�V���!����S�u�>������2#=j�p}ׯ�f�qb|��)!#����gI�pM�,y���o���'�����D�v7�[��S���đ<����a*��z�����q+I�U߳-#�}��c�/ >�:�{�w˰s�IR]Lx��z��������/����mg-�yA�nkQ��%�i����|s� ����'YO#��*���Җ,����擄�t|b�DI���lhHP�.$�]K��R�6��Z4�ɲf1}#N�c��J��E��-=%�ᑡͶ(�C��� �}T�@_��o������EUZN���b=�qy(L�C8w��o�J���M��7ts�W4�l����Iof`:.��J�k��WY����t=�+�V1L��S���5�#����uh(w!�r���D>ZB���1��A���q r�A�u(k�ol �ԍ_��fܲ������E��?��V���]6������ ���q��z�~�q��Lv5�lN=9���L�u~L�����+ rP�Rz�g�0Xz���ưC?L���� j�˄V��˪�@���E�1�P�)4%���Lр�m�ő�_��`���9�Zw쓒�<�L���;/)���bF���i� �L���\R��[��Nɠ3�h��n%���4��%,s/�̽��t:�� �\�5��+�Ȟ/���a�$�G�$���D�r/4�]��c,�g�l_���jw�H��s�h��%.�l���]��b����cf���k�e)�XE�K����z�O�T����Z�(K���"������$� � �&#aY�ɨ��l�#S�#�Ҿ���3vT��2��l@-}7��ώ������*�a�v*�/�(E�u���u�U��/��xʷ���J�ѻ��mlqbr�lr<�wޠA���wGj�O��c��Cӡ�`�� oe�6��9�m��Ȣ�?�(FI z�0�T��͢��M[֛d�a�2�º�C�Rp��đ�~cEh�SGU�{�Hg��G���Ή�E�Q[�y�+�����uS%7U���3�^�� ��5�F�h�0{�1��&a�b��[�;��\#5O�k���'�ɶzJi�Z�h��ğRj�s���S��ƄMd?ma�L�~l�mp�-66��� %���S0[X��kѽfҺ�f3�)�DҊ�Q��ϑ�/�h�������%�0R�l�c �?TE6�ދ(��9+q���$�3�[�ϓ�PWDN��>hVz�k 1a�! ¾ylo3x�IԖZ��*{�g�oZ 72��@�#,�V�q�z��Uq�'��L���i��([e3yy� �LA;���]��~ȩ&��1��5��KBϽ,!�L5a6����5�Ԯ�k ����]�.�f������Kt���"3���^�h�#TASK�������^��w �NwbdOC"/�.�~�, ��纲��2���w/C?WڻVR�Z��Rk;au���Ia��?��b�c��E��P/f�s�I����i�hj�H��ۧiP֠F����儣�+��Lv�9��S���u�-� ����ܭq�g�|��Lu��#��l�?�H^�v %x�����qkF�Q2^ׯd��;�M��O��2�%�Û������6� 3h��ON�"��)�@��P�(�ԕ|� ��Ƽ�Ne�n��F8�Y�z�rD<�@�tG�Hi��.�����d����u������G�.I�����>]��^%7�O\���sp� {D�kd��
Behavioral task
behavioral1
Sample
6a6c33c765dc14606dfc3a4690897288_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
6a6c33c765dc14606dfc3a4690897288_JaffaCakes118
-
Size
2.9MB
-
MD5
6a6c33c765dc14606dfc3a4690897288
-
SHA1
198558a26ac25abbf2a69863f32b7145aa3db914
-
SHA256
18a4833079dab78f06d71550f62ca99726461bc173fcf974843dd4461711a990
-
SHA512
ea620f68098c4cec4c49849f71ff1ab7a842296d48d37647baaaae58ddb0e9db95a1b9395f6f202871e38e1f33aff15ddf7d31f596e4b7d78e88dd834ea63cc0
-
SSDEEP
49152:Uhvj6dQbEG6IKkyv2rqijJGaTtOJFKuwUP6jrYNSKJpELdO2MYfUoYF/6eLhBPLS:Uhu+YPj2hYal+w4ijMWUzNtBz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a6c33c765dc14606dfc3a4690897288_JaffaCakes118
Files
-
6a6c33c765dc14606dfc3a4690897288_JaffaCakes118.exe windows:4 windows x86 arch:x86
88d383033b1ebfa25af33a806c68c868
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
kernel32
InterlockedDecrement
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRectEmpty
gdi32
EndPath
winmm
midiOutUnprepareHeader
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
GetSaveFileNameA
advapi32
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ole32
OleInitialize
oleaut32
RegisterTypeLi
comctl32
ord17
ws2_32
getpeername
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 537KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.6MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ