w�y^[����3��e`���O���S�n�#�<� �sm�pEH�o�B,t�퇗�� \.��+�z��9��]�}�k�B��:B�酤���~-:�W�KӒ�4� ��3�c�f��a T&�1���W0�PSfi�?�]���o f������L�Jd�����|���%\�~a{�g��?�o��yaƦ���`�p�ߣ�x����������<X��XL�֏�<���Dt f�mm���{C��!�}DD(mÔ��\��dl������u��w�>)s�)x;X�1~:H��2ׯ;`�w 4ٱ��u����T�~�cl;�m7 Ǟ�j�T�l0��p�/��5r}vUb_X�#!~U{@���+�R�$>�_'_wO�S��]E*m�X%�>�'a�� *C�_oH�>�=$lb�g-���� �dʻ�z峈�*0*��5)Qxdt� ���Zd6<�@$�Ə��ְ2��2������2 ��J�!�Z�'s��7��i\��Β����N�i�;L8I�8��?�:�(&W1ӷT���j_�:�l��� �ٳ�%,�3�8q#����8�K&�K�Vv�&�4_z�\F���Lb��NO�(��=& A�r��Ô������К�t'��kS�3�1�7S䎊9O3��Y�c�rJ�.�0�����{�rл��~�tdnNF� r�,�k��!g�a���7L��ʎĤ;�Ɉ�Ď/���F<����B�q��?;HE�t��{�H�<N�f|z�L�s�-�O�|ۊ"+�u��&�LeT�g�����c�9�#��o�Yθ�~����[,'�)�U���� ��t�9�s�Y 6P���d�(���4R�[��V�����i���K6Dʼ=�+�MD��\T��^Q7�a+QǓ��d8�����^��ZBG�Ĕj� P�e�����x�\DT���r�}���U�],[���2 �"7���[��@�K^���xJ@���U~֒֏�7�����.K��u�r��6�r� ���Hx�{ �'q�v���� �(h�˺I�P($�~;C�@�����#I����̟k>�jQLR�X����FڼY���aHHl$jE a4���{c*<z�~Kg�ɩ�I�{��DZd���T�� -��QV�m�N�hfju!������"X�]��nY`Olk����"�=&�3̇�,����x� ?(Ko3��w~�S��:0� �� �+� xə�D�r�ɏ����B�u��N.�%o�'俳U�U����%v�_C�E�S�g�RIs�Y��)�]6V+�_��Z;4�@���r,+�^�b� ��䋏��%瀙Ի `O��0US� u����E���l�W����P��:�V }��Gد=���i��?,��?r��GI�)7�!���V����5��h��T�yb�H�n*y��|+{��%Z��3�X�;�Ƅh'���3�'���vTim�k��/JrchqX�*P���к�Zc��n'�K�O]��)X�AV��]�C�a7�ƋK��p��A{�3Zh_A��z��\-�}B�M�����0$�@g�lK�x)s�B%T����*ap�LS0�G���D�ݏ�j�4Ȉ0)Iu�]i�ς)"3�=��:��YeqW��.m[ikz�Ĉ�r7�9��4jr7r��1��}����;��)�y�����GN>��\��`X$|���S�Wָ�w�^P� ��k�~}K��m��!*��~d�~>D4V��yr����p=���F�=�|�)�x]8����1�W�����`lYi�KW��`G���� �h��#A\(n�I�C߸9���nqw�X���"0I1?�;Sx��)�?��5S��Ά��W�VP�q���%��x0 $�r���ZR�ge�\ t�о�W=[%V\����a�[��RÑ�گǞN��M���e�Æ��v��}%�=L����!�+ߜ��$Ȇj���Ndj��\0��²�β�,���}|p�9�y�i���� ��!�3Z°��w�������= �M��D�2ne����&���4!Kd�NZ�)4@q�u>�_XQ��r���J\�s�{�k�V8;�>��U����.!�4�J@|��s>��2w9���_�[��Gt�7G���,������DG����x>�D��`'�0XP��N�F�8Ee0�fQK����z%f�)��/'HWq9��� ��\��8�pK�A_1R����Hٮ����k�ppYq6i�ns|�gvY��%�m����iyb2XF�%Tt`ye� g`g+8r�wie-FK=�-�H7�*��(��s]�@�~���9�0Br�c��?�fj�7�Qv����{��1&���)C�Ԙ�����E�]�17i� \:�3�^;%����2�lF=�M��N8�(�qZ�H�Ԝz�]e��^�0�G�z��go����D6��u �z�J��d���l���bq]2��N��g���)5��(�k� ��q̦�:��B�Ӆ��m°nߔ����iM�d"��� Ȅ���������J,'����J8�-�'2���Vl^�:�%U���Lm���"��"����(������"��w=DEm�[e!3�RAM�i��;�1�E�W�h�8���t��i`�gP�~)�@a�q�-�����4����;�N$����W������}�Yg�z���Z��bQ�� �2�l�v�ī;^H�K��d�����z1d+:�*������_��.�7�~,DR>˴���q~u?�!�Ӎ�:��F�Wf���k���X�ѯT_�����{fu%����Oqw*���Ь@��a�&-XK0J팽4M�f���� P���<�����IvcŜlP5��֚�2�q���a ɺ/߮L��Vy���7A��,z ��xId�h$ӯT��@��g���߯<����XP��� }���s�cα=N�Ǜ5(4��S�0���W.��ԏ-���5o��X$��C��_�_�q�iMng�������O��?���v��-�`/�r#��D wI=�8`��^��.��P�R�{�۔<R���$d��^��-���6GQ7����Ly�Z
Behavioral task
behavioral1
Sample
a8c6854a59b8daff4a1c31805cf5cdf2_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
a8c6854a59b8daff4a1c31805cf5cdf2_JaffaCakes118
-
Size
5.9MB
-
MD5
a8c6854a59b8daff4a1c31805cf5cdf2
-
SHA1
50f68bc8e56290fd6166c43e0cee673b0df19f56
-
SHA256
1477b705793a0c409523f68c8efb6b2e4dc2360bea1dd3d9ca5074a95fa01182
-
SHA512
d32da03bd3793b879634261951e818c1ee1bb06fa7cb5eae42acc91ba12d1baf48047d4378980f5967838fd6c34772c50b7aca5bde57872232c1e5f5094b6e20
-
SSDEEP
98304:ZNOnThraJNd5VxBYDrXceOOLRSV0h0+z4WZlob7/4zmSztIJauOwduuD:Z6mTmrdSAJHYH/4zmsVuOwV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8c6854a59b8daff4a1c31805cf5cdf2_JaffaCakes118
Files
-
a8c6854a59b8daff4a1c31805cf5cdf2_JaffaCakes118.exe windows:5 windows x86 arch:x86
172750858dcc0719eed08c952858023c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
OleInitialize
oleaut32
SafeArrayCreate
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ