����yc�D�)���?��1i�?���L������BI?����z��O)AP �e���Ŗ#��k�Y�6��X�g\�\g�q��χ[ 1=\P����0�N����Ϊ�Vm�;�#��`�__�F��A�����%�����C��s��ۧT�7���w��/`K�y[�`��âi���Ȭ�/]a;�q�w��*q�`�&u`���<�F"*�9��E� ���Rwx�8V�����]F����D:�@5��� ~˦��nB3�������ɋM\�;+c�&�#J#s���cL��f�>j���2β�nu���+ ��9Ȫ�ݨ�w�Q�̑+0<P�����&� -�Ŏ�g�mV�ƘK���|E�NoL��a���w�`_ȗ=Z.��KQ��8��0�����0B|$������iU��F��u��=�*����V��sQ�n�a�9��M7H�Z���[���1+*e�bA��Z/��W�ԏ���W� ��#X����ۮ��D:�LԳqݩ�$9P���+{9`q}�$Ei����-���G�׃��M���I����fJ(� �sQ��'jՇ}6 �6���)��x�D@���n!ڋd<�]1Osm���+��@����T��[��[L�Q�� ��ʡ���������i�*>�yoD��"8����&̿i�Tx�'�[�?s=�� �b�I��,} +c�o��6uS~����A���{w��m>��r�I/��̚.�l� k�ߕb�33+��e�NI)���T8�PE��p*\���{qj�O�R4"����y�Vl �� l��߲�he�uR�Sf>���r��RajK�+U|�k�M��/�m��áe�~��{8�C(��D-(���\��@����G�C�E������� ��(:G��=��^������x�A�DUbn�˾TZxP]垽��^�����_"-�`T��NBK楅�Ȋ0s�ɿ.��r��Lj3����r�F �]�"��������P=R��p��W*{��y�>���&��4��~�L A��"b�H��d�kk]#~ޖ�B��: �W��à9u�9K��~t @�8��B�������/nr�rȞ�1͌�P�A�#��:��y�� �$�5�� y]�ڃ��,�vdc���(�tJH�1H��ra�����z��MYD���Y���"����C�vy�m2�f�o�~ �Y��,�������hyv�t 2zT��K���eq-N3�A��u*pf:c٦+�?aX�/������Y�s0��������};�-~�+4������J��]�M�c���p���up�9e��|k�*���F��w�N[�����.Ņ[�6��,���-�Z��֑K1TLl����'țs��ߩ"��-=��k)�C�CL��-xKAUH5�R#����kl�k���� ��X$�=(��fuŗmR'�Q�:��O�zS� AL"ZgIʕ�S]�L�y�������P f��Tc�(����1����L�B 9a�u�X� %�_�W�}�m�P9X�<���p2����EN�hr����6G�z <L�WE�#�M#���ȍ��t�n��ƿ̳�y籧Fp}��e�=�(G�<J_7H!���{�~�V:���G�1h-l�rty�n���@�� ���#��x.���t�W���sP�s�Y�V?�7���ȿ/�~x�d�h���*�o�_[����Z�6< m=�P�:>,�%%�n��;���zuB+o�`�G��V�J�[)W����~�ѱ��P��ҧ�_����F9R�n���r��z��ˀ{Qb��e�C|E/&Dm �J뙕a�?@�[��%-�4|~|}YK�5dv��9��f���PHW!���T��NR���L*������}Ԛv)}DԀ��S��f��V-}�Q8w�jd�*>P˙eή_���Ɂ�d�%/����+��!�����8=8`��G�)\����ǩ̅�C��h���D%h2�x�"�{��F鉼>�!K�u�&L��!����8\�L��Д�����xcy���L�+�����Wˁ-zkK�+���ì˕=�����n^7�i�L�������-C, ȆsEQ6 ��u��c����٦@�k�L���|����(g���vD=yI� ؘ����h�6�t��� �.:��p5�ٗ/Ρ���9��su��^��G�{[�G�8��G%'�AgyMW��P ^������w��хR̡�i�"��z�����\Ȟ��`���Ci1 �Q9�6E=m#�b�M`,Ӂ8F�r����I�f:T<�r�����QP~%��������v��,��ת~?���t+WF�%�D,�W��,Uc�����X�T�����⧯t�S�s5�em`5yY��w}�V}L�uJfu�(��~���н�����f$j��؈g���G���4�!�����} ���07P1lzL���pF��*�rdpo �P�3�]�jK���1���t)U���G�wm��ד� =̋���m�����I,��R�Zs�ݱ��)�4Ld�V�۾����*?Lm��s����Ro��j4^�k�19m��{GY>��:�̏�����D�毴��ɒr��G;q�j����-��9e ���%��#�us��$�B��O������/�N�1�~�%h&T�g��B�#�W��/�Mp"oC\o�>�a��>�Ŗ ��b8'��������FNko�ӆ.��`8)Ei�$eɎQ�[�>]��k���X�ĕ��y�1Z,���9{:DjQ�zg��e��b��#���z$fzP�6���u~���.a\�!��Q�d}��&��g`����ec�u ͓�C4��Z�U�����n�Qv_��c��N2;%�(ضd�x ʃ�n�]w͖z�|�ԇ�T�������uw�т��dB/��p֡��`V���W~�J � fr�A���u�ɸDw|�_6�Fէ)ԋU���;O��W�&!��� *�� fh�8Q�</m�I2~� h-�15c�5���U5����!���S�L��a�3�h�������9��v��=K���K��d��
Behavioral task
behavioral1
Sample
71ac26acdc40f7a93fa03bb01ed56e16_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
71ac26acdc40f7a93fa03bb01ed56e16_JaffaCakes118
-
Size
1.6MB
-
MD5
71ac26acdc40f7a93fa03bb01ed56e16
-
SHA1
a7726293dce86dc2ba1f7bfb680b8179226319c6
-
SHA256
52770c64f7ed05f63d89b4599a85183899b85b0562f44cbdc2bce9d47b24a06a
-
SHA512
994f6dd04c8f061466e66a152f2c7f7e400a932d826b02ea61ffdf5ad40035eca4071accb49d8914a04754e6b50dad1bfba9fb3da480027cfe2375f67c2cc4d3
-
SSDEEP
49152:NHIY9Ct2y40PaiSsQDUp5cUx/raUbXCxIcSArc:5vIt4rsQTUdraIXCxIir
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71ac26acdc40f7a93fa03bb01ed56e16_JaffaCakes118
Files
-
71ac26acdc40f7a93fa03bb01ed56e16_JaffaCakes118.exe windows:4 windows x86 arch:x86
91274dda312fb221d4a061e6795844e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PtInRect
gdi32
CreatePen
winmm
waveOutUnprepareHeader
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
VariantCopyInd
comctl32
ord17
ws2_32
WSACleanup
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 461KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 348KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE