&����fTm�5̶���I��!Ĭ|�`.�̠��MPə�2xO[n� � �`b��i�k��,5sݭD&CT a�E��G- �Uc�~�!��f�ȽE���Uo����qNq Q;�pR�U6nƊI����͚���XæLY&"$����H�ZY�VV��2î%�����f�h�ȣ�xa�m�=9x+>)|;�<T �4 =p y��-�)�y\��y � `�<ojy}����' ��9锠}�B���*��&~��c'��w�.1�Tv��)�z�� �.$[o%;��oC�6�OP�9��[6�yY9>�IPc��+����~�<�P�Gk6�h��ayt3�ɼX����!1PTݡS�5S��w�\0By��݅�%ڳ�(К)ׅ؇=��h�W_�=�����}�T���ܗ���WA ���) �DN��$���$���.e���T2SBH��bg�%'���eFFb�[��;'U0��>��0P!1�|h�m�Z�`�1/�Q�iL����7ݷ�蒃����~����r~GB���il���`�b�V�jƾ��ZVR�N��J}U�����P����W{�ԁ���k$�O���&�ެ����6$V��ڍ�_�T��Gp��u��z��'�5O���}�/��T��O��4Z�tv�0���aQH9?TcVX���ZB��HZ>̓=|���6ih��|���;��� �24�6�\� [/�f6%�1w��kZ%�����&���&�������� �������W��a}���Lr p$��6m*ի4����ݏ�L[X�`�0��)�0�P�w��aM���3��mB|G���ȯ�X��ݵ�ٳrJ���C=���R�oK���˯^F���icJy�@��=0A46ND����W�G�){2�G�\��]�Ć���HtԱ=9�����Zg�BЄ7�OtNȖ� ai�N��j�8(�`����iu��ys���/F�t���z��UT�s���"�qJ��'��,���L���^ u��q��W!ǧ������Ṛ�h�2�N�(���iݠ�!��-��5Q�ot(v|�cQSy�v���T(��8�Yy��a�sI��nˇ_�`/���ns�\)� ���J�� @,.��ҍ�ej;7�5�j���L���Ƞ�����}��0��9(?Ϟ��v�M701�e�wր�[�T����" w����t�����+���fpN���ɐ��+1q뱩�x���fIe����d�������5=<9�&�������!��x"�S�L��-*gI�-}��{�@�"�` i\�f ����� �a=s���+���k����\��𦕇5 ��E��#eG����9~J�����4�Ӕ[�^���M�1�ӕ�կ�jY�%��'J���d�����T^����*�����%�G����-�Nǟ��zQ�̉I2��5��,���3:�B`I��J�M�����R��9o�$�����=5�<���0p���ki*�z�y6!'��F ��6��o[?���0t�P�`'%����i��SFG��i�#1��G�U�ݑL�H��1�:q���r��ň�3��a�m���YE�L$e�t}rx͠���B�A�DY]r�@#��N�i|�CL_��.6; T�+7��RZU:��v�����x��[�8����k�wQ�b�N;����K*��f�{�@��\Z�mk)VEv��C$|�#H(�.翩�חo]��!Dˇ�친��eĚ��<0���눰U�̻� `_�h�cp]��\$a"�x;#��#Pfy�Ŀ炙l����L��^�.Dݒ��4�j~Y��鐫4]�����-�9��~����O��Ck����7��+���Q�i�͋�Y�6�R+��z�>Q�ϴ�(��2��Ǹ����K�m�nE�c���}q��Q+��������p�X�����1f�������*���.��AJ�u� �b��&g]ƣS=�8�^�|g Tu�rYm�oU̎�O:�.��N��2�嘭���n'�-B��AU��đ`2�}{�ճ��R7�HڧTN����A��v����$��`-��Q�pƋ���*�j���P���,�7�w � �����j@� �s[c�\d�#(��-#ϴ|� c���,O���4ؖy���4҄��*nYj��vX�M�����U����sZVC~���EZ,�6�ӱ����A��|b�B �jTeۧu�B- ��J������0��� #������=D ��4i.�ԍ-Z�7�]l-dң�"�3��n7}ލQ�v�o����io�V��������t����窶�u</�1�@�&^F�Yl�׳<3\-.w�/�K5J1)� aFl`"��EA9��\�g���D���H���}B8lXRw���1'P���I�r�����΄��;����1<JCh�D�u��Q����\q��SRC�ari\���J�D��ݗ'k�ިA�+� ���V���M�����-r� kB h+���^�)����Ձ�����,.�� �+)��sAP���F���A�Q0���Q�R��\8�s�����_UE�~��=�Wd��Q5 ����Vԃ��N���$����%�l�|~#,��QN��X � 5A��S�T����� ��Fs %�A7�8^���&É�"�o�� ��P�E���f�Xw�{f�U�h�����ӿ6J'-��E�ˀw�oQ��G���S�����}�L.P�{�����A����&Xp��V��R�l����� ( �-p^�L�Yr��q#���D���b2�Җ�6�������,nI�FC�{���\�0��Iо�����-�'��v��[pz��P��7T�'��0~���)�$�k��a�{o n6f�������a��C[���!z�a��r�)��m�����S��f��~U���1.�C�v���ev�hf���c�Y�|'�����)~�4-ؖ���ڤ�-n9�N�u%��s��*<�1��w��9�#��"�~~q��}����{�w�ӳ�h~�=CIZ CHʿʟf��P��/� �]g��s��@�,m�h����e.%E5xD��M؉��e���I��]ٮY�g�D�
Behavioral task
behavioral1
Sample
83d4a11cca0b6cb4a56c96fbbdb87767_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
83d4a11cca0b6cb4a56c96fbbdb87767_JaffaCakes118
-
Size
2.2MB
-
MD5
83d4a11cca0b6cb4a56c96fbbdb87767
-
SHA1
7eb711908bfbc861f754947af5bab2acfe672147
-
SHA256
2ad02e8c1d8e6242bb40316f2aff01f1cc3957153389a8e1e71d2de8d4212a4b
-
SHA512
32ac4ca9a8e0adb55b6da7120128cea67eabace8a080cc7a53b8f4de7c70f65ba22f33dbf79296e1410de9c567ea784989f0ab95144b67b1ba3d8ef9920cd1c8
-
SSDEEP
49152:aqnEB+pBPGfSPuS7yDYgW3q/4qiWqEOWaEe:aq++zKuRS3WMq/Wad
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83d4a11cca0b6cb4a56c96fbbdb87767_JaffaCakes118
Files
-
83d4a11cca0b6cb4a56c96fbbdb87767_JaffaCakes118.exe windows:4 windows x86 arch:x86
663f361aaa427e6596cd540431b39e18
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord356
msvcrt
_controlfp
kernel32
lstrcatA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClientRect
gdi32
DeleteObject
advapi32
RegCloseKey
shell32
SHGetPathFromIDListA
comctl32
_TrackMouseEvent
ole32
CoCreateInstance
oleaut32
SysFreeString
urlmon
URLDownloadToCacheFileA
shlwapi
StrFormatByteSizeA
wininet
InternetOpenUrlA
psapi
EnumProcessModules
iphlpapi
GetAdaptersInfo
msvcp60
??1Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 455KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE