k��~T2�Nb/ew�L��"�$�h�D}��J��h�~>xwar�N���,�1����RW�ꦅVQ �J��>�`Ypآ��t�K��ڃ�ѽ���|YZ�n��A�gb˻�SF"�c���,O�T�a�~j"W�#xm�Մ�,pn`��P�m��l���n���w_��}�mFm?�����[R���Jpن���5�qb-�-2��p©����(v��pи,�S|�\$!��H�$Nb� �W�0XH�F�g��ḇ����D �"�eP8"���o�E���������Qhl�(y�{���9���ӄ��R]i����&k��[a����L�/��c�z���HU}��5�Ҋ<��곓�{��Cl|����@���Z��0���Ȝ>�}��:�>��C|s�ѵ8֦y\zR��;-�|J�?�e�yr���=���*7&�(N�;Hg�+��Z�er�;H먂�R�I��Ϸ�+'a'�����n �c�2 �p�q �j�uo 5�C|�ڗ����.�_�$��$2��/=�3��R #��-4�% ��Q���gu�e�HU��CFߞ��M�O,����ϑ��}����DN�4�:�pm-����{�u��[��H2���~�]ޣ����$�O�)��J4�]҄=��o�&��stoC���ȗ��Du%�}缉���r^�����1�����֭������Hզ,�KL Gӌ����85I.) �s�u�E�E ��n����%��Y�e��l��,h,�/���vd�5J��#�������{�C�������)�?�9E��=��WZ�m�������#�e���:(h��Ec�ښѓ����`�K��q��-���f4�?Fl�A� b�{Q��HC?�vK:�3���<������D��NGE�Y�:&G�I�䑗�ۤ��:���q�0���#� L0+0�F~�ں�p{��k7l�]�aC|r�j��M0��Ӂ��M�؞�H��Y�n�@�ݖ_T�����B4�Oү���f�H݇Q��Y>���[�L���}e*�v��=1(�Su�I ����x��ѦR��N�f��(�P�l1�,��֔L����5�E�M��j\�����:��&<^7}����^.�b��Ec�J�i��O������ �JA��,�DW�{v^���� d"P�����钗�˒���[�H �]y����L�L���o�8☱k�+����ͷפ�s�]���gm]��V�ݤZ�$D�}��c�7�h��H��a�*n�:�o8jРj��BcYY���L ~��άK�����w����rx���_/�$�N���������c���I�'o#}�G��[=B~��I�M��b2�6�����t��y K���4@��L{��Y3�q/���R,7�Rݜ���~�T�<ؙJ���������%|�7!s�"�C���2GwZ��O��p�O`�?o��l1��v�9�9R��Y4�J�H������@`'��I3i�d)ͻ��B��%/aS����,h y(a_#b�Ii}�G��s3���po���z�Drjm��od�!h�p�b�!��m������jt����Nk�o6��g�9��:����=�Mk�>Iڛ��YGpk��r֩�Q��@|�*mN� lю��BG�t9p����+#�Ѭ3[��Q�)=��(��t���ї�`B.��Z�!�6K� #j���B�����OW��ֲL�� �/�5�L�}�Ʉ��N@V��)LHY]e��|����_3�$�&r���l�8�4���^4Ү����w7S��~瑋�s3��n#��xdA��w�/'�u�O<���خ���Z[�+��9X��c����_\�x6�M�{&Sw���Y/Փ�����OR2�E X�o��b���Ҹɴ�%��Z[�n�N�t�Pպ��ȩ�G�S���������٣��-�l�&��%(�a�lP�f�����B��%��ϧ�Lش%T��F����������;�� N��w�0g��]�ѝ��Ë�?~'ȯ˸c��--~����D�V4^G)�t�M��@bо�˺hH�x��^�@/}:���;��D����@��J-'i�!��|U� �W��� ��]P�N��i��-�/����&���|��5�b�!;ݻ�k�e�a�#��>�nF��m�)���v����|0 �Ok୦%�P��K2�t����z������r�G���a%�T�m�nj1O ��La��f0�j���L��ZmYd�Ø,2K'A���s�l b�����<e����=-|@5�J���V�Z9���{XG �`�h�8?�LYL�ip�ZI�5���#���Q�x,ױ��;�T�@sa~{Y���#`dX�9����U�l�?TO��%��Gn5���+D���OD�XX�dh: �)�v�w��J`���ϐA�O�X�e�G;zT������@� TA�~��E=N@J��L��X���n @d�=��e;���u�qץj�a��,�*k�J���ro��%�)�Ny7��D��1���~ ̐�M�65 �Ն�-�����q^KF����� 0`+z�/����I�b�)V'�@��]�.���e��JD���.>�ZnVQ�H��և!TTx�ՙ����]�u� ���m$U@�� �m$�z��%`ItlⅯ�&��Nz����(����[�!�d�j5��&�<Ƭ!�\>H����'���� �:փ{m�h�d7C,����2JL���UI�@cd�3�PC�N��h��2&�G��?��ڌ��TZf[8�Ө�"��s��;Z4�pB:)�Ԕ8R�c��������?��G&G^0Qmܖ*��̣����&���r�����e��E+)e�N�uR�����Q%ٓ�6��&�GuA�G�與z;me���2�Y)\`%� R�pM>"$u�i��{p��Ɇޛ@�C��Li �F9İћ�T4"喇#o�����VX�_�I*݀��)Jץ���V/���<��q��y�kIG�a�{T+��f9��F@� �Y*���4qWh�{��An B��I>�n;���\�^|��e�.�OR��-�$t��+h|$Nz��`(VmbLJ
Behavioral task
behavioral1
Sample
78c313fe2bace88425f5dc7515f1aa4d_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
78c313fe2bace88425f5dc7515f1aa4d_JaffaCakes118
-
Size
899KB
-
MD5
78c313fe2bace88425f5dc7515f1aa4d
-
SHA1
5772e34def15045338a7767b702ac497364a26a9
-
SHA256
30932854d5f7fa7f1e704f64124943cd217af8f65dfcf3d31857800250f509ea
-
SHA512
79f2a7b8a97b6b800f5326478af3c6784a55971867fa71e3ba7a9db15db1dcfca423aee1a0eae142254d16526316c85b9d28f7f0881248c8e02c83ea38cf1d69
-
SSDEEP
24576:3mUY7rBUXdDtUvtaiRDkEUkuaGUg7C4nd:2UYXBUvUV5DRUkuo4nd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78c313fe2bace88425f5dc7515f1aa4d_JaffaCakes118
Files
-
78c313fe2bace88425f5dc7515f1aa4d_JaffaCakes118.exe windows:5 windows x86 arch:x86
568f7683a5744456fa4a5f5f7240afa6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
kernel32
GetFullPathNameA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CopyRect
MessageBoxA
gdi32
GetDeviceCaps
advapi32
CreateServiceA
shell32
DragAcceptFiles
comctl32
InitCommonControlsEx
ole32
CoUninitialize
wininet
InternetCrackUrlA
atl
ord42
oleaut32
VarR8FromBool
ws2_32
setsockopt
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
rasapi32
RasHangUpA
Exports
Exports
Sections
.text Size: - Virtual size: 457KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 482KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 892KB - Virtual size: 892KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ