�(�����@E���%��Ngto���r��m�o�DB�I~;^8�[p�ĭκ=�C�Z��b�T�@�.4$���<%��k����T�t��B�� �O��JȐn{V����>b�Z��*�� �m5��v|�`�˪V͆��8�Mp3Q�t�Q)����a�|�V�p�3DÖ�>���Y���ҨhO]Z㎭�8L���) ���/���U%��gI3s *Fu�@,C�H�b�u�x'�����ԝIy��!��S�nPQ�}>%��bۻ r>p��Q=�[�������6q=3)M��������]��=��-\�m@U��v�Vs�8�ЉmE�� �|.�f�U"i{(.{P���ﴽ�,���oL�%���ĢQ�G�H>�w�E����Շ7|Hw��V���>g.�Y6!{;������s!�������N�Y�m���GA�nWp�4��E=�F��Beh��t`X�����+�{���/8��r�D�]B����Y�Jk|c�Y��^�+L)"�ȱ�Y�������R�{�����4�TR 8:c��Zn��'>0;�n���Y}�p�c�p��j�-���S���, �W�#���@�*ZE�AȚ��&`�����d�:�j��R�r�CME��0B{��y��]�v���e��ص�4y�9�z��tz��� s�}�It���� &r��d��*���LDgߵ�㻆t!� k��mj zr����=��Ac?.b���'3�K�/1��l�ƴ����&�������ћ�Uu{`����d�7] �z��v��2�I7�|�`�>�� �,ϐ8����L�Ӧ�%��Rㆁ K��F���f�*��$�7Y�a}�`'�w�N�u��T�� �M�J���)��k��bO�������Y�!�?�ڤX~߈��oi�Hm?R����^���.�88֔���'�IZ2�#׀�Q��������z\����3�7�a"��߱�z����FS۷}U�U�����!n�1fO�c�u�^�m.Gi(/>Ӷ���G�����]FB��2A)���\yj��l�U��;�L1l��X_+��n��a�.�2ύ'�S�7��C�@M�g��{$�;���b��F8� �i]��;����t�|�����2蔁I�>xQ���MR�_ڰ��$��Pz�@��@J�]����(̅�����OJ>�b@6b���r�a��~1�x��.����w1^��i��� #g�4��Z�p�I�*���EH��J�r4�|��ؓOm��6�!�*��������Z��<�ɢ'�>��(���m�,�OZi�#Z_�����<�)�=jy����/L>f�^8�[�l=����"�i��m����kP��zG،���q�C�x+�j"�_����i������j�5\,�N7� _B@����הLߪ��@9h�2%ŖaCh�a-�E0���W�l�6�U{nǽfy�t���@���w�y�v�ǹJZ�N��Q9 �x���1l���8����:��u5�e"��6���@7s21���^�v��L��������ײ���U��)A�Pn3q� fk�7�3�9~�>�c�<��������b� ��=� �nW�?�;��������;N���+��<�T�9�D֓�A[q���H<�4�3���yn-k�bW�t0рZ�X]���b���T6+��p��0�#c�C�&�m%�*�e>��Z��J�L*-N�cVs�z4Y�6���=" �Ƶ8}~�7>�r��X���g�S�c2R����v�'+�)��Ω��K�xp�xCĠ@\-L �x�DW���6��8- ���Z٫h�������屗�0�={;�ک0�ʼ���.I{��a�h��e�F): o}�j/�9|�zT�f%��1�6��ݼ�o��W�Q�/n��%����Ǒ��7�18r�>�����%�`r#�z$��gYJj���b�~x;f9�s����{�cG<!�����P�p��_�C���,�R�U@j����P3t���κ�:K����{(�]�,}P���n��������!���ErJp�v����nI�!��&`��4h�wn�2UH�]6�q�f͠5�q�}.'��Km����~� ���7b�65-���P��T��V���#����K�V���J��=�w�>����K��@�ٯ�H�� I�@ߟ��=�j�(dp�!���δ��tVi�b@�R_�]\tn�s4 x��4��3��Y��S�,��w�3�,�2�����#�Q�IK���]9J�4E�����p�{���>�r*�U��ͼ~W(/��\�/^�.!61�[-Y~�USW0�Y3EF��uv� 4/�6i�5�E����r┯ �NJ�?�$�>��ĩ����fZ: d�VL�SA�_��W�k��?7����n�g��X�~0�/�:��Y0�F�J'M��B�-G��~W&t.�?&y�������h�毅� .`��F������,$� 嶵���[@N���{H9��Katm}��̮�3ׂ�Ȉ,/ib|���%�[*��#��H�v�r#���/��Y�k�]n��dU`�]����[^����+�>�b�E�v�ʻ�(���b�W��+�X��fQ��pg�2y������Z]��s�� F�v���̯"!��$L�g�8����0��O�%����������/�O���'�� ���͡�%� ���L[7�AŁ���eU����eP����g��@N&��߿l�5$&>u� �G���,��*�x�q��������$zu_ {m.��x4��Q������3��h$�&�D}�"3���k�&T��5���m!��\�r��-�يk;�ڥכyS;�$:3,�}T& kyE�u�âIx�����wf�\�#��� G9�O&�VG�|�$>�{���MF3՚�1/��=�QR�I�;DsђoF�yE� ��L}��_-t0�zz�b×�� �}��V �9��Ϻ#�����?��?U��0�v��]�X�OH��zW�/�����70��z)+m���d�QJH8��sk X�G��@<��?Y�*�=�:��S����Ff�q�L?d�HP�M���Lf
Behavioral task
behavioral1
Sample
8b1a5f805d1c58272e4938b4585025e0_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
8b1a5f805d1c58272e4938b4585025e0_JaffaCakes118
-
Size
532KB
-
MD5
8b1a5f805d1c58272e4938b4585025e0
-
SHA1
de17b606eb6ca8c330378da9eb82269ee4e2435b
-
SHA256
775475136bf8076586f1f9657b6f0b456d2ad9239893d2a40c8e8998e8c84223
-
SHA512
62999b5bca8d05a29a79fcf861bd186833716f3992db2ee8923b580203f2282f5216d6d276510938c7d455469edf2972b9e0f8586963901163b08e3d330db54a
-
SSDEEP
12288:SquDLFEK6YzRrFLtrj6bhHBOCqPk3U1OEWaVzNLPJDVMY0x:SqgEKFFLtroSk4bWaVtBBMY0x
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b1a5f805d1c58272e4938b4585025e0_JaffaCakes118
Files
-
8b1a5f805d1c58272e4938b4585025e0_JaffaCakes118.exe windows:0 windows x86 arch:x86
6fd5dcd485417f3107c436a26a7c3183
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RaiseException
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
avicap32.dll
capCreateCaptureWindowA
oleaut32.dll
SysFreeString
SafeArrayPtrOfIndex
comctl32.dll
ImageList_SetIconSize
version.dll
VerQueryValueA
urlmon.dll
URLDownloadToFileA
user32.dll
GetKeyboardType
CreateWindowExA
kernel32.dll
Sleep
DeleteCriticalSection
lstrcpyA
TlsSetValue
advapi32.dll
RegQueryValueExA
RegSetValueExA
StartServiceA
shell32.dll
ShellExecuteA
winmm.dll
waveInUnprepareHeader
msvfw32.dll
DrawDibDraw
gdi32.dll
UnrealizeObject
oleaut32
VariantChangeTypeEx
user32
MessageBoxA
Exports
Exports
Sections
Size: - Virtual size: 980KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 451KB - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ