`Jh$t\�te�HC+�E����D�)�נ�`��__�ǜF�F�oY�6\d���L���@(���~�N�g��^��t�⏀͵F�� fq�;^�e��f���è��}���FV��O��E��������҅;e�����}���B�| &�,,M6�2�0���m��mJ��\����9��G�=�����;x�y'<N���o����|./ϖާ����k�^N�������q �{7�+πt�#�q����Dq4� ֟��m� @#��`���,,��u\*�@��"�i�ZAxPGˠ���}40'Nz�Y��=�1Zg��(��jS����3+�� j"��c��N�;k��G@S���]��U�Ǎ�a�-Tgbw�J������:I�k��jR���-�Re�$D���_��A���O�F���z���Z90)nj#ۆsV���}�ˌS��y�w��ձ���cT?e2�υIt_�����Ij�w�yT���#f��d������i�1C�Iew�Q�����Cwm�Br� ���(SYV��gF��o���:��}c�Td���atlqR����dl���)NR8�' �`����Jh��'��Cz� I� A��.����D6.Ik�����.p\:��3X@y����h�̓)u��W��+���vϜs7�B 0m�b��F"�9�����>�Ǻ���g�������r=�`��wU/���h�F��;摅?*�h�U'��0�X�^�2<�L��܁[͓��CIL�h�č��@ �B����^�쯏&�~G+0���#���6��N��K��K�v^i� 4T|xƂ��y) ��N���S��#A�N��{���k���p��{�sQ�fk����,��u J� ���:�;�Y�I�I�D���Z�����ۄ٩��`\�s��vQD�|[�i�y&,�Kx��+�X��)͡��VE��X�j���D��D0�,���n����!� �����a��_ݪm��$���ߩX��u�X�K�3�Q>_JTd9����I���~��`��jz��Q���V��G��tN���}i��ro�_��ԫE�a��j��A�aOR0����7������y!�|s2,yxCנJ4�R��ݿ8��BkS^»����4�Q���w�+^x�:��2���/YF>xx�Z�B� ���k<6��)&Q��*3yi�l"Y��h?p#�z��6�4�f�p�n��ީ���{S�j� ��|�IWZ� �2S����w��E�!�����������env��xC��8��y ��~�D�n�$���'LB���C�z����7+�\B4���)����ht�o�D�Pzo6ǚ���tM�=m*0ɝ���2�|:s&��î�kP�n-�w�Vp 5��i�t3��as ���y��⧷h ��:��Fu�r��6������c/��;��j�i:�?Q���T�6��3�-1yH9����鄕�(�������2��������:�$546����Q���qw��)�ӋX�mt:�v��8�f?������[��G^����3o���kSd9�$�����#�=��-W��q-2N�Y'�߽yNb���W#Ɲ�rb(j.-ӭ=��R�����"m8�r�x~}Tn;wH�H�ԩ������� U��>2<[���y�M�<�C\����|@: �'m+�xMgG�`6V(t%#�y��XN&�T�C����qE��=�U!1���۽^�ɒ���q��������mF�<�u��[��O�L����㈜��l�A!��?k��� -�� ,S��J �k�� 3Y ]����g��r���>�o~&�ZQ`�Gl�r����+�{�E}�'$���҇���4�e�J�a / ��B��n���DJ��ye\vr1�z�ɻ�8^���L{d�H��B�&"�?��3 ���xk��~���iպ����V�D+�v�,F᭔ݳ�L0a2t�R��6ˁǝB8������Y ���P�� �a��wv�������7N�-%2�G���H(w'\��#n<01��1��kCD2-�p�?�jk!�)��?�X(�� +D�~�х(���E����ƹ���4>@�j경v��-M���ol�j����K+��ԢU��� ��p&5���D��z\X������h�����N*� e��f��_��e"����e�eh\7� �g�,s|ғ�37�Ɔ�9�����$CMhiĄ�؝���}��'�#k�d:��8��T���[i�x��WT��|Wo��j/)�r�X�d�n���NOZ.9H�/�6 c1z����3��0eʼn��J�T�T�mx;��]��4`Ex8H�x�(Vw~��3%��9��[�+� \ş<jKg��+��yٟ�G��0]�o�IA�Xd���]��u�S�@q��ټ�Uv�futm�Rz+���1�=��%�Ϧ�(} �{bq�KYM5��Wq��� ��xA��$�yߔgt��wZy�#��b �1A���~,8���dzK*�c�"�a��;%w(__>/y���(��B� �k1�ï�8�Jd��w+��7����^9q�}&8�Ǚ�}o>Xaf��4���HBZ/�-��i�EW,Y�'G�>0՜�`��=�LK��k��yw�-�ą��8�1�Q�k $�7e1����dx�&����9����ה�����.��'�_��3`�C��|+����M��Y�#�8�*����h���:y�����u�9��wѿ)���(����\��z�@�=�� _P{G��*OE��i���(�T������°S�Q��1"��1�]O����.�hr�6�Ǔ�� �����Ьa����]J%g5�g(��4jl�H<3ND�>s}dd0����`�\�O֬:!�B1��Je=��y�%� }4��3Z+���0�.��p�g���/Cz4� ��=��V�Q��6�*+�����-6Z��O`��=�=3��Khl�o�%���xS(�a�μ�@��E<[bޱ��EXx Z"�2� �,4����&���j�f���t�ٶ{*9B����s���i�ut�q�M�����S �І;��B�<�a���:/�Ϗ&"� E�
Behavioral task
behavioral1
Sample
a89d9a509a4b6cd307d197852d285772_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a89d9a509a4b6cd307d197852d285772_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a89d9a509a4b6cd307d197852d285772_JaffaCakes118
-
Size
4.8MB
-
MD5
a89d9a509a4b6cd307d197852d285772
-
SHA1
81ae2e7090429631ec7bd7799e2341b0f474a380
-
SHA256
eb55f8898dcaf6e09a52fbb97b2fa814d615273ebdeeceae6e8d1d9c8ddf07d7
-
SHA512
aeb9e9d50246cfa404b859211b089e58ce8b0aec49eadb4d475a2abe62fe7d7258c0a3803e4a24b762c747104723fc07fc4513ab105944927fa2458092cbbcaa
-
SSDEEP
98304:62dFjGUdtHGPfhWhJCvjHJdusaLypjVOUtP3GP0X7FGKfwvs:leS8f8hw9UVLkP3Cg7dwvs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a89d9a509a4b6cd307d197852d285772_JaffaCakes118
Files
-
a89d9a509a4b6cd307d197852d285772_JaffaCakes118.exe windows:6 windows x64 arch:x64
f7040a3cd3a46e0dc28f1ac50659b4f6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleScreenBufferInfo
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteExA
c0gnito
GetHardwareID
msvcp140
??1_Lockit@std@@QEAA@XZ
urlmon
URLDownloadToFileA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ