`�uiÕqT�ݖIDz8�F_��f�� �r�nm��%�"R���k���v��_Qo���x��.S�������(jӱo�ص�R�~������$����?�7�I� �{�t]�Q`��=��E�3�?,Jҧ����[T�ᆌ�r�z3 ���$�?|ʬ�����<k��6"���x�����KM�F���~FO:N_A�,Ws\p;��+y_5��Q� ��Rf���^:�'��m��P3' ^F[���c1M���h��j���� վڕ�X��'���6���<�N�����Q灶�������k,�Zf��N3�"l�!.E�4�a��kED�M�q��ԉW+�CE�"�����d�?BN}<NIP`��qM����A?�K a�f��-���Z+۬�����,��Ā\ia#'�X���ݔ�k.���@�[\�{3�ޥ�����.<�o�db�{%x� ����I{�j����rC�X�Y~+V+�p4�f#��R�{}A�s�P���5+D9ok+��mM� (z��g�Pi䥃sO{�P�������I�Ik�����K.��>�iq�X�sqp_��2 T4���C%�ĂVp���xT̖أ�[Y�a��q�2t} ��.��}y�y�, ��-FO� Td';=�Eɽu�)�XKK�=ʁ��N!t�7<��.��v�`4B /Ak�Y�ᒍSD��ų�՝;%�k�bDY���d\��b�/\���M�I.�t��I�퐱�y�u�nćK���n����t��/Į3�]���1G$i��-��Ζ�����gnO0-��G\u�m+��Ģ�.�mt��i�!����ݻw�ߝ��3)�n�&���!O(�s���&dy W��N��ٳ�+�?|�x'P�i7������mJ����ഹc^t�I�;N|�@�;� �$��|�!'�'#R��s7%�&��f��m�@�צ��r�9�zHCV�^��gst* y�^6`�yVӂ�������Tj����A�!ξ��)��G!��d�=ƾ$w�h�P�>+(����U�2��)"�)�:&�S�y�1@m��[c�L�:B�2A�yJ9�����ذ�t�(G�ʔ���B�q#��]'hm�������#̣��%:��Zet��sR�1x�٠H�����{e�|N8-a���ϲ��҅M����M�b��<A��ɜ%+A�K�a��F!��^yO�iY��juD[��À �5��k�a�<�t��3�{>� 5�찅^b M.ð�50�VX�D�������R�H�黁*���ŠF��������At���,>ZX�C�u��%�w�ӷ�%ژ���[��� ��٪�(J���W��K�O>Q�5LX1��y#�E� B)��i#���њdֳ�ͿpKnEi��>r��@ue�7 �W@tپ��$e3��М���&�A�Q-T��6��1�a�w�6��Dh��qꐞZ�/8I9H8�N\�A�3�ҭ:��ׂ$KQ�?9����wJ�<��iZ�R��y�\�q$Wqn��bZ�[]bH%���ּeŢ�$�wg<��k���m�6�N�A�ܾ����r�K���g��"`cǸ1mJz���F+H]�����@[xj琉ŐU�H�D/���Mf����D'e��V��'��6'��-���+�i��zZ���iDfhN�Yn��]��xOA]�3=���X�3j����)ӐR����+BZ;��M����?Ze\��rj�HlkH��/ĮmI|���6|k9�N�(����8Kk=ٶˡ�a�+bi�V�擈G(W��G�'�?[�硆-h���Z?;��4er���Ѵ%DO<2ϣ��r����4�TE�EpSY���bQsj�4���c��P{��7^QO�=>;%����6G�z7�҇-�ŋ���N�F�??����y�Y�(�0ɐ��������Rh_������9$8��ifԜ�;���bc�'�E��F���$<_IHV�Ձ��kR�G����D�CT� ,�� ��������[��B:W�?g�I������1$ΕΓE���A���aYl�����M�����$i;_8���Y�/�l��O��E �����q"��-!�U�����v ݆)���3M�l�_��|,�U3�43֘� �Z�"y���l���ۗ�+Կ���!��,����� ��T�QV�m��ZE-f��_LSQ��Nma�L�=�8���/�p��c7FK��h�}����9�M�F�δ�<�&�'��G����JĠ[�z�[R g�~���u��!i��s�<�9��/xJ���V��+h&�6*���������� ����):/$����lv+Z��]X���`�tkG@p���W���p�8���Tqs�ΓݚqH�&S��r�M�f� \�7`��l�{��kJ�A~�m��u.��SൟHޙ���_o��]4ĥeX��*r���R����*G�>�_�������z�@�}v�x&��2�H�| #-A���l��o�)��6��˽ bO��;&�=*� �\��e12�!T���=o���vr� ������I�fL~t.[�ռ$drŲf8FKQuK�j��1Wy6T紣$�^�b���C>��F�Q��~�2��)QW��S��]@�I0"�� �pX�J��͛Bo��G9J� �U��i�c�RaEfC�6s�Ǫ->D�]"�cy1��}U�� �[��;�j�x�f~O��:� ��U�I\Db�(dSm6��U�~/4hzQ* ^�:`H(�&<�Q|7�Խ�&O%� ���T��>/�[�ot������hJط�T���K|+G��� Z��Oi��"��N|��+L�Ъ�Y!�� �:����~���4�ۓ��*���������u�]<����4�����V�����B�G3�n�_PON�?y�Ҡ��uj��e�%)��(&����ܨ� ��`�pE8_�|�qK���������!�n}�-�st����ϏAa���Ҡ�O96�0 (���RG���wL<�0�@����g�?R��,�������5��$��T�f�]+�Οe?{en��e_��s��t�����
Behavioral task
behavioral1
Sample
72c09f92e5e9a4e61ac770a890be6880_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
72c09f92e5e9a4e61ac770a890be6880_JaffaCakes118
-
Size
2.2MB
-
MD5
72c09f92e5e9a4e61ac770a890be6880
-
SHA1
6ce06e353d6b3f07355ba8a404866298aa9f9509
-
SHA256
45e0dbdee5402fcf99fb925a69076ec838902a5de836444bb61fb02b5513949f
-
SHA512
0f239126b09bf5bfe2cd371d765f0f61368a97095f8041b5c4f13db366cd5699ecc64dcd7dc0546d98e75fac773148990b8604d83f50f08500b3f153dbf2054c
-
SSDEEP
49152:8xaaaaaaaaQaaaaaa/RoI79jr+LiQchkL5QuoDr8Nig/xNRE8UznPS:8xaaaaaaaaQaaaaaa/D5WahUN1NREJz6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72c09f92e5e9a4e61ac770a890be6880_JaffaCakes118
Files
-
72c09f92e5e9a4e61ac770a890be6880_JaffaCakes118.exe windows:4 windows x86 arch:x86
aca59b317a2da23eced16e52dc781de0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetFileType
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowLongA
MessageBoxA
gdi32
CreateDIBitmap
winmm
midiStreamOpen
winspool.drv
DocumentPropertiesA
comdlg32
ChooseColorA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
ioctlsocket
Exports
Exports
Sections
.text Size: - Virtual size: 625KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 284KB - Virtual size: 302KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 405KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE