T����uJ�<���63�B�l���F�;!@�>65^\�s��G���Nl�|�6;4��7�`<h�.���AX2�v#`;�1Z1��'{�4�J�(C ��V����uL�jɅ���~�IV7D�Ο�[.6x��G�,k�mGv:ڤ�M�%):����*�O������JP�����r�7N�0��M�Fy�I��ZY�� "�� F)����>�v�94�א�V�L-ʿ��+\݃G���aE� Bel=ɜwoNsM�&����c(2�~��e����r���o�[S��5M�4������B���,V�Ϡ)fߙ�^Zl�s���ˎ�� H��>��N~]E5��R������à�V��m�'b�$��ɦf�����U�&m�#~{J��[t�sU�0���M?]I��0����X/����v~[��٦��9?s2!J�aM˳Ȣ�8<�67$��0�"���kR+��c!L��-��ic��d��;����@���t3��W��D�w>�V5�?�!�7�K6�Yb�<��El;���Mr�HN�,%�L��9���p� +�I� I�����ٯ�G#֔���>:����b�#� w��+���J���r����n�ˁwV���5=vUa��҂+����=_���j��QG�r��p�:3$ɝp@���J��"q�8��I��r�L�p���&%��[PO�[ny1mǠ>��)���-T�e���w�6Ve �n���,8�2t|����f��\0�j畐���:d��r��Ԩ��"G���^R�L��L�ֽ7� �"�?^�_Z�����?�1}�yip75�(&��lIP�T8����婛c����� �#�^�V��{sA_To���;��#���Rf����Z�� bxv�4�o~#�Օ Dv1N�Q��gԊ�}��ݸ���4�飈 �Zd2�F�EsŃL��(��JS��� �e��S΄'?u�� @Kb��q.����)�L�l+�p�[$�-N�RP!��(��08σ�n8�� ����Du��3��ە�"�w�b�{�c �ci��n;�2��9DŶ��5��H��<�2��ʿ}�w^q��ʷq����s��C�u7M�k��Ubͻ��/�c���z��^Bh7�&�|Lu��ͽ�'f;�a�i�.H.HCu��|��Ӝ&���D�sr�. Մ��|h;Sl�|h�d���w\dM��`@5J��P]��RB� r�_� �Q���x��{ǖ;�;�L��[Ή��C�:���A���5�j�'j���D�����;@k�����-��9���1�畸��35���o��LI8���fj�[�y�*��@���>�T��}��Kºon��zk���Jm���6������Rv:�i�cºl��C�GZ�� KyH�ɂ�+n�to|�gɡI�o8_��6�RGӼ\sԗ��C�1> �۟�|]dqMV�Y�Ӳ����2�$f���fd��~� ����s�D�L���n=���N������X�W��A�$�!��&��P��k�ŵ`A�H�o�qLh�8���8��*1�O�h^s&%�4���j���A�\�x�u/B��_�W�~H2m���=D���14XX�Rp6�߁WVӾP��Y]i$;�p9�#�&�k(x��a%Wb�߿��(/��H�q�����"(JM*jx�QR��M��7��wk��^t%�y����7��P(A(����;�:'��Q��h/s�ʰH�"����9��[�K�C�R�����a�ʭI��R��>y���}��s�'���ߺ��"檥`�#8}�������G�d���|4j��� &Pf�� �מ��9�#,)���)U���s�6���S9�dILjtȎ �ӿ�p�\Iq8��'��I���b�����e/�6X�<R~��]h: �Gn�`�o�-�Un nE����C�L;��B@J�ѩ�N����ۚ�}JP� ��z���uHK�����tr:�QHݤ����71��<L8�cj��j�`��E�=j�\N�"]����d4���me�8��8e�V�Q� ��<v�U �k�@y��aS���=D�i�,����M���eG���0���� ��d�Ċ@�l����EX�ʼQf'h'K,�eZ�Ƌ<��Eu�s�u�E����@{��%@[5A V�$���n�p��'��)QX[r��Y�!���;{�K�*�|���FvS�,���y�#�L��:�sb2N���U���X� �����&A��5����$1r�I��3���Y��������P�s^�yw��/�$��bt����M�a ���4y�l��l?}��9��0�^ǁ���o��CB�.Ef����u���Y�k�J��S�{��߉5�e��q�+��)��(s��1r%����Z�J?������D:�{.�^���k�b"��3�����~H�����© ���s��$����}�O�)�Y��h]_�"M����F,���o8��!̰�0��Fv�%��;4�5^E��*N��ĔPs$��� ��(E��ٟvl�#Ɍ- �t��v'T���#��Q��=D��S�Ў�Ϗ�e�}���Q]K���I�b�n�>��|z�!��s]"��4R��� +���S�\����>�T_ln �g�'�r�����M�:T�-��z�G�W�<m\�`m�1�n��4�Xo�H��uC�lp�Ԭ�ա�;�n7r��\���CJ#�x�i�aJ�#�+f �2rk��'5+���{>t�.��U�U��pw@Q�_��� !��,�S���`����裙u{�bā��,`j�ծ9���[�hL�����C�W��fυ�k��8���G=�F2y�x7i��Γ�lI�3���25TS�yG ����K�D�'U�2��a�i��j��`�^�Gܪag�ޑJTI)�-���O�q�M������F�zDH�%w|��SφЛ����E���7,��#�L��Q�5���D�u�� �UG��:�����҆`�E�����=Ϋ�.q;��!A��F�"�g��Ի߸b��:����pg�-�f�ٜn�w��=!s�K�����
Behavioral task
behavioral1
Sample
a6e465f56d10818fa96e0e1ba4a8509e_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
a6e465f56d10818fa96e0e1ba4a8509e_JaffaCakes118
-
Size
1.2MB
-
MD5
a6e465f56d10818fa96e0e1ba4a8509e
-
SHA1
19226c78b4550d74517c3ea4a617fe67fbd4d8ce
-
SHA256
ff6ab3a4ec688c438e71522787570bca839f4138180fde5d8ead7019b3265286
-
SHA512
abb8e14bf9e5486bff2855ce204791d66e3c332099305017e2c8017934e11856b0836d7cf3e6cf47347de1ab730ab6cfebff1421d8237a1c3f85f5a1d415134c
-
SSDEEP
24576:/I9GBWRQIW77VtO4/pZhEWTZSTWo1hJaDR5Bw5tyl9Y:gbZyjNZ/o7Jgoyl9Y
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6e465f56d10818fa96e0e1ba4a8509e_JaffaCakes118
Files
-
a6e465f56d10818fa96e0e1ba4a8509e_JaffaCakes118.exe windows:5 windows x86 arch:x86
bf11eb8b90d2c959b417a4145acaed56
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegQueryValueExA
kernel32
VirtualProtect
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
rand
ntdll
RtlInitAnsiString
user32
GetMessageA
wininet
InternetConnectW
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE