9���y{ѩ�ɼ/�m�OP�O?���D}h�q0�HdX�M�h�njjF��!P/�i����b�)�r�QO�N�n��!hq84��>��&��, F�AbG1�F����N�o�������{W<`˵�8�ؕ�])���q�i��nx�0��]���]϶4Um��T�3��7�x~.��Ƚwr�ORv� �1�$kE���aS�!����E;*Ra.�����#57��kT�I�>W��F���4��*�¬A-,�2�� �/W�[������xE$d>f���b��S����� p%�p���� �Ή������~����h�ʹ��ѫ�A-O �ӿ`�a+�n���@� �U��9�����X������ϥ�4����zO)J�"wˀ���9 ��▱��G�g���'6v�1�v��mv�V��C���\_V��4!Q�M{�U2E~�Ft��F�� �f!�(��I����1G6-33�~��ؾ��z� �V,�>���v_�f����k���#$b=�!�-��]�[�����P��i��cs:���=J>V�41��c��0(`ٜF�^4-Ue�C��������31b���D=L�,F� #^{n3��si�X/'�,��1�h���cM8���#}d��1 �4JU��+?\�ht�,4�[�iJ�W�9���q���bt(������|�z7���N G�]���\�c$ɳ?�eI!��Cձ�F��x���}�c�cyc¦`U?U`O*��:Vq!������_2G�LR��/@��ޏP�:IHZ]�LQ���'c v<l*]9�g�d'��t����X}�ba<y���̿O����'�i)�%�#�ͥ$��^'h��������? �����P����~=�@���w�<HEﶙ���)�6�p�˻AZ�~����N�ϙ)T�>��s�ꖡG7Kr����Rل��`~w`9@? (�i�C�]mZ�Ӎ����zb].�؝�D4���g��|����{���ðp2J��V��sWr����M�S�[e��k=u��t؝@�"xIK�C����>զұT���~���a�R��D7�BC��;H�><]v�P�3@�ũ&̮��T�ۡ&��+���<p[��A*'�/�r<e��ڐ�/� X�=�t��Kqɭ�~�y?y�(Du�UW+�E%��&�`4,�6E�j�:ݮ��y��9���>bʶ���0�6٪�x�\��م������3"�Y�ĸ�-�+��{hy�a���룑���~̮� �!��12g�u{�4���b�Ⱥ;�{|KK�J{4f26���Y4�������f�S�/��Mx�cFG&�� �4�1rç����on�%���{\����s,�Ω@��^����r{}���cY}��k�2Z��5�~3��]v����߽0 K�� �)�NZX8̟�>�m�������ыYd���Y��PN���"��4Yl�;��Z�%R{i%�Fܴl��u�z���Cd�l*���9����-� tuH=|�����r���Ġ��K�q���K7�3{=�А�趩*~IÎ9��3���8dv�F�4�Zy����Zo�yM9x��.�)��3s�j�8P:x`$����g�H;%+�.s�Xu�6V��tD6 ��c�S�8]��tŚ@%nhL27��F����!�4`�>�I�yr��se�yo%am'�A��3�/��W�7�t#`���>�M�Fg"%Ӟ�O���u�.�k���V��qs�?1eѕ9�8�N܌ǎ�!�,S6��ڛ�y� ����X���'U�W�h��͢nM��Ζ����`�����u��n�����z,q���Ԧѻ[l<}-73��n&o6t�gkgg9}'�g�L���Å�# W2��ܠ�|�Η�=��&s#�JE]�R�b�g`������ͷjΞ�L7���6�8e���q��Y=Sj��{�1�}�l#�ƔJ�)CY7�u�S����w�H�ƵG�R����y�!xz����M|t*U��q�����j`nb��Y�/�}$a[u��A�(��;� [�׳=p�ܫI�?��^�����P��k��f��'y�'�\9F&���5�9��/���ﴽ;W՜��K�p=�/�1g(A��f����m��cҢ$��t�9�X���l-N.����d���9O��P�Y�x� ݠ����y>%��?Lj�ҵk�S�5]����D�4_�q�n�UsW���+����1���[ �� �����0 ��w��-{�w�\-��$E3{�.;��|�Iߔ���À���̱�;/>����֤N*UP��8�p�Sɧ���'�L-���U�)��:B���u���F��݀s��~�q��Nh4��!�Z!�����i�i���}�>o��ѷC�vX�]?A���mO�c��B�-�0»ݝ#j99(��z�Wl�?E�p�2�P�uN� �?9��1KZz!�Eo�~ۍ������U��1W��ٓb�k{�E�/�>���hz^bS�m�0�[\��ӡ��yZ�v1�Q���x@7�� ��1šx��݇�v�.�ɮ&�v�3�+��j2�a��j*�^��=$�L7kmI6��}���R��$���o��}��J����J��Y0�K&7�>��2��D���{;����������]/MǶzN6ע���p`��L�&�:W���04!*��-UN�iA��9q� ;���{�)�;f�d K�.�U���!�#-��i� �+���y���G�,Ik�����m���d�f��Px~�>mXH�0"�]K0�ce��U�k`?Ҧ�b� �I=t��������.h.eOP�V��-�m3lD��7���C�܉�ux� �Dx��|�#�,1�/�HqK�/�z��:۾�������K�n~�B��E(IP� ���ȟ��zeY�}X^c����u�1sR8�� �K���g��FSg�����a���ט-4~��M��i���t��'������E�m��H�4K��d�x���Ì���/�/����,;���Ȝ 뎫[�����#���$wj��^��M7��^���i
Behavioral task
behavioral1
Sample
75fcea753ea147e17a915f801a131455_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
75fcea753ea147e17a915f801a131455_JaffaCakes118
-
Size
1.8MB
-
MD5
75fcea753ea147e17a915f801a131455
-
SHA1
e9c1cb0b6f7f4c9a9342cc9185df6c81a9700bfe
-
SHA256
228f3b88959f6fc37035867b0af7db556e75761b1bac11eeb74c3c0bb6be9b2a
-
SHA512
7abb6a61958566a01f584c45333ddeeec9df1dcb4d179f12eb8ad41ff7760715122d5c793b73b061af1e8e700a900b297b023a0ac794e7be9c43258d4e357703
-
SSDEEP
49152:iVTYH9C7EOl13ZuD9eChKZn099RGJalRYLMNKV:kTClOM5epZ09SJaCr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75fcea753ea147e17a915f801a131455_JaffaCakes118
Files
-
75fcea753ea147e17a915f801a131455_JaffaCakes118.exe windows:4 windows x86 arch:x86
49ef989d6436782003eeb71f78d87538
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
waveOutUnprepareHeader
ws2_32
inet_ntoa
version
VerQueryValueA
kernel32
VirtualAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClientRect
MessageBoxA
gdi32
CreateBitmap
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
LHashValOfNameSys
comctl32
_TrackMouseEvent
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 835KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 357KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE