��TY�<qzH�U��W���lZ���2j]��YB"��$�m:�+C ��!18ԛ6]bm��6��n�ڠ�د���wRᦍm[�b���=����+)O]'�ݜ�a�k��WU\�_;�0(l��] �S�C�6���R`��o��EA���*���!E�"�uc ��PM+�wlݞ�*e-̰?s7}n�gu>����F `�� e*G�߬�K�e��cQ��0�����|��8+��zD�� ��T!�4��wf(Dl����<A'�}j��F!���c ����nC�]h��8]ڝ8yV�֩�F(RH�*�j�%#t}���bni#����C���9)>�����%�*P -l�}.�1�Z��/|Y� ��F��ϼ믷tg^@�\�0����X��kH�s���l!��,�s�C�*����ч��fjS��:U$����46�Xj�V�#�:�[dV���Qlv����5D���u�F?�1�J����@�B�)p�֝��S�1��u����࿂��\��j/Vu�/ݗI��E� ��^(+;��7��N!^��18@5�)�QhZxG��Al��1U�;Z�!��CKg"<�m������2ib���I!����@k�_��>Av��.㌢��V����E6-��҂0���I���]�'6Ԑ�����>1�|EB�ME�q�"�\�����J'���3����\8M��V���lȘ�G �n�Q��� ��m��E����Vj�jd<u�Z9���� � l��������Q���٪k��X�P+t�m�a�� 2����J���:#f���=D�[�m�E����� a`���Oci6�G�%�z~C�B ���������hbeę�юD��]`x�Ӆg $JցS>�M�J��:���p��b��H����;NJ@ZE��'���;����S�W��!v��$_��7��,Ĉ��"C`<\e����;9O�1�؟�\�ƴ�����,�!D�\��"0CҒ�C���L&�Ja[_�ho.��߇q���z(��`2���gۑޙ��D<I-�#��It �$������\7�'�s���6 $�Z���l!'e˷��St�z��`=a���Jv�X���Ԍb�h�cM����L�Vy�4;8shY�<�@R����Y+�#eA ^+?O���x�g5��-6�ڭJ4i�Ha����h�����ߎ���=��䭤��/nm�B���kT��|����Ձ�x\N�^�̝��^R^w�7���\��܇ñ�-f�v��'3�m:6��Y��R���, J|� �,����uy+�ʔ]����ҙ�4�m9R�|�s[MZ�1ȟ����2�cH��Y+��C����ӆ �����}���|� �iMowѧU;~<>���b�r��xP��ڎ��#E��]�� ��S���}��{�@_�BVfD���H��Ԙ�2�8�k#v�>XY�J����e�T��;�)�i��W�#8�BβW>�N�v}n��㯼[���eItX�������Ao������Z�4�9r� ��:���[����'Q�+�S�����o����#.e��*X����4�*��`��7�#�V9��� x+�E�[+��Ǭ�@���j��<�+��r@-���x+g��wq����sxl��L��Qd4������\n��:~[}?��FӮu��@�Czg���K��1x�*��5`ܳ�i�ɓ�%���ѥ/��D��Tl�ȏ���& d��I��D���0�q�:)��6t�]�9������9<S�|�費���)�MS2 H��0��FpY�]���?ʅ$�ˁ��p�}E�t�1�K� �P;��h�NJZ`d� ��U�d)��h�[}+�@� ��e'}��W#V� v� &����&�r��h!5��R''���%��t1�W=-'4=3yR�&�DRR�O�=����H��I�j=K�� �I��N� �>��G������{��l,��u��c��j��ia�� ����*TP�2o+����4����!gSR��1�:(O��y���VYa� �:���ɉ�?�����o�[a&g����xr��V|4J��'C. =�����@���w&����o���.h'�o9 ��S\��̯���;<txfK��c�A�M���g��/�6M���{C��N��W�Yp��v�x�������n��Js����˴{;ץ��<t�����$Tl��P��dY #��X��8A�a�e<q��(v��Xa<Ǭt�Vp|";�$����C �xk:ǫ��ݣ�֧��~�z�����wB���7��=*a�Cb$ʌ�^�M�-�w��pٚ��������i�6�|E��|1 ��V��(�s�x��UDAB���\*�m��X��A�\D�,"���l|�A�p���X�_?���6���Bɲ;��3�H����� dz�\��S4�����Q�z�7����u�����|�3���Q�vo�~�l5;=�+X#�K��>�l��(o�Y~'���"�~o�'̬amo��)�����F�!�ǂ��J�(If�$g�&�q~N0x>��?X�g�$����4��8�;��d�^y8T?"�&��}���C��ɹ��2F��=G�����R�h���Z�������*����X�HK8�@Al�S���C|t��f�k4�>H�$��HtP {h9��s���\�豎��ț��A��~��]�%+�6X�Id{�����E�m�������(��k1��B�X�K�)fV�K1�}FG����S��N}i�Q1!�2nv�r�%�7���FIi�gp��ko�Q+�/>N��[���h����Ř[ ���xo��g���6��N=y�2I3fր�E�)���T�D+�i˅vʁ!��[ BOH�ׂ�|��E����Q�R|ӛD�נ�{�nxM&��l�QG"�y��R"b����K�,��LX����F��ͻ��K��Э��!+/����>>��K�P)eZ��k��S�A�O%�z"͂��_S�C��� ����K7�0]) �(����>��8�]�/�Ke2v>��D�I��o|6��ثyN��t�⏘G�~���o�����/��mՒg�yωE�g���v2��Np
Behavioral task
behavioral1
Sample
868dff7b6aa4d53213c31ff7929b6b74_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
868dff7b6aa4d53213c31ff7929b6b74_JaffaCakes118
-
Size
1.4MB
-
MD5
868dff7b6aa4d53213c31ff7929b6b74
-
SHA1
2433485a78061c21ec47fcfb75846f6e8fc35b2e
-
SHA256
78acee63a48686a13776135c6c1fd23303596710283a42251a29c4f835920c4e
-
SHA512
9975367db39676507bf8aee89f334009bcf399ae5c6330c992cde43d86c93cb5637eb292fa21dde8e3a58c1ebd49a9492ddd0a91e92ae8074cff96e0cf4d3c91
-
SSDEEP
24576:nXuCu89CTY7Sd5/bXIowAwhUCB6Y0qUAERHwKZPMFDWbBG:nXnuFTWSdZMowPBv7ERHwC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 868dff7b6aa4d53213c31ff7929b6b74_JaffaCakes118
Files
-
868dff7b6aa4d53213c31ff7929b6b74_JaffaCakes118.exe windows:4 windows x86 arch:x86
eb7802fcd2c3c459feb122c23a16d7d9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutClose
ws2_32
send
kernel32
IsBadWritePtr
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursorPos
MessageBoxA
gdi32
CreateEllipticRgn
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
SHEmptyRecycleBinA
ole32
CoGetClassObject
oleaut32
SafeArrayAccessData
comctl32
ImageList_Destroy
oledlg
ord8
wininet
HttpQueryInfoA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 543KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE