���+�T��]&o���s��Tj[I�/��4�cɃ�<*K,���9l��u�����X�/�7� ��Ӑ�AS�Ę-U��������'�~�/�n�-2��wv���@���Y6}v����7^��;�� 6�C����Tn�R䅂�n�OS��as�f�jt8~x�Q����=~�c�]3���un�{+V�=:~���.q��e��{���#�\��Y��$�n���{�Ti(�������:1�A��d�y�:OR��"�|m߉��X�/����TǏb�l�p�'����ے�>|3v�-���P���bB���Әߓ����-^�蝹3VB!>X<�_j������J1t����ō���*� ����A����S�xk(�"��mA���ǒ=h�t���?;tR)�Xzu����Q���u��w����� �����dW�^���@�:duUP-3�y�Ą��SхX��5vLx�N�ѭVR���a�j������^{���f����m�I�z��f���#�o}e�2� �b��m��\�N �yX�����өG��:4?X�]�O��ۨn���U�iH# zD?8���Y#����[{��%��,]ў�g6�[ƃ�V�']��%�&��pZ�b��<����}�+���'��<9B�i�$�O,�$����!������v1u:��]S,z���n��_�������y�~�K߱��;깛`��ޢRq|N����P-��`��P"S�щ8�,z�G9>���5,����v3)��*94����9.E�Y���*�AD��ح����k�n��\ 3�"�l��i� �*���G7���{>�[1���D���sd��y��1�꺭)�!�4�G+E�pA$z;�g!D��]�TA�����>O\��Ĩ�J���£����\�s��6���h�/�� �Sv�v �oͅ�k��u�����?��@�@P}��s� e�ZҸ�X0?'�? ��zå�i^v����q���4�����J���D��g�3w�ݾ ��z@Y���.�e�H�}#97��QY�0��݁��� �6��η�n�z������wl��R���Z|�n_��b�:|�8��_�6B��tf�$<b�(ez��!9>�J ��fc�� �~���X4�����߷῾pĈ���� ��p�oh�C6�Bն�4�C�W�i� �4�2���"��%����Y?��{9�K�K�C?2�y��c�$� �6��v�J��N�.�>)����}�HV�����Ń)�u�4��6��.ȉN7�koMb�d�;�]W ������U/o:Ё5���{�4O�BMT*�����F�h�r�G�\(�N؈[&0�8�+)h.|K�Ķ{�*5�� ���k^+!����N��qr����ϫu&%+b]k�E 梨�I��؋Oy3�V�]�V��n�R8Je���z�5��S�L���U�a��́���z��8������i��ȱ�?�E������=GH�b1�`����B<�ہFL�� �y *��hb�#B㓔q>3�¿������ ~9���[HM|m�K��X�k&ۜ��sir*��ᠱ3)K��,.�����j�1k�`�/���1�g8o�v�vy=h����l5���eQ�@��O@�1k��S�q-s�B�<��CO��s��8A���wS��������0�5+܍�A� �Y��y�����e�����j�� sE�#�w��؛�͏����|���:;b��\mn�f�� ����4�m�z��*�}V_Z�A��Eܮр�g��vd6m"B�Gs�P��Iƃ� �qјx]��N���_�u]�\��ռ�_���>�f �,��}�\u+Em���$ԃ\Q�)�:�z*��������H��'E��Ʊ��ѻ�ퟅ3J�tA�L$�5�]�N��l'z�����ѐ�BܓS��"7K):�F�������"A�����<�����k�� 5/�?�������ӧ�yۀ'2r�&�I�<�8�h1����7��'^���wk2�Z07�W����:#�lE��c�cq]�{M%�z9B� D�1��*uUj��bX���tHA����'C�ċ�;�C��IŶ"���ZK��;�T�Tx'��f�ciS׆�E�˓�w8�MC����fk-K\�-��Ú���2g+��jwz,�E�k����b��T��Z�!o7\��ի�HW�_��~20!mS���:���VExx3�7( ��zps�z�7��>����|�f� ]#Ui��x��jB&c�C��~^�t=��I�2��{��C�cIL`�;�LH7XT�)`����¾t7֭v@��k�/w,���j�1ې` �:�bO#\aE`�_@�<do�ο5��f�[���WyE���9Th��x7�c8����� �ss�7�!�P�KC���r%[7��IPp= {j�#]���w�������F��Q��q>wX�.�6,9�R���+*�i8B�Iļ�"�e\$n�M��yI���V���6|���_�C�p@6h�V���8z��>5m�� %��y@z�Vw��8/���bv����L��ėn�}TuD2��؋-��� d����9 2A����p����(�̜��)�D�Z����Lv?q}��ݞu2iI�34��W����?���;�]�d6��Q��HX{H'�����p��_�����K���X�����S�;K�� _��+�Ŀ�c�]BjU�E)��=�T�����%�+P�Y�6���8RÒ�Î�duy��NM4F�=˳�i�\�n�*��9,V%0�L �&�N�'I?F5��~� w�4Ytsţt�ו���5�e�{�]�k��(��a��G�����_��Y�<a<u�y������y Ł���o���n¤�%�{~E0�R~X]/�����n�&�o6��⿌+�8��F�.�A�4ߦ/�\A�"سXC+�#��� �bA13�/,���ti���ΫF�1��\��x���&ޘn5"4��-�>_I�h_W���%� A���]5�[p��I�s+c��v(iR��ks�D�d�^?� ����w�����̓koyɱRRqP^J2ӭw���w*� x�)�x
Behavioral task
behavioral1
Sample
ac7190b7da063adb4d58a40a5d8a0fbf_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
ac7190b7da063adb4d58a40a5d8a0fbf_JaffaCakes118
-
Size
1.8MB
-
MD5
ac7190b7da063adb4d58a40a5d8a0fbf
-
SHA1
8e89d04b5259c283538242118be4c987251e98e2
-
SHA256
3d4b02c7dc136531b5c395e8f63437c77cd248307f30541481d581e4243aa096
-
SHA512
b4b165851b316a8fd02c53c4025e14de4ba70b32a50522f5ac3892c0474afa6c059f7aa2a3aa9847a1a5e512d2c14968692403754c085db7a3509ce0ca0ce085
-
SSDEEP
49152:ufPG+RBLveCwv/KoiLtqJTKb7MgJtNg2:ufPG+nepvYLIEbi2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac7190b7da063adb4d58a40a5d8a0fbf_JaffaCakes118
Files
-
ac7190b7da063adb4d58a40a5d8a0fbf_JaffaCakes118.exe windows:5 windows x86 arch:x86
65274456f658f4aa891a5a72ecdf3f50
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetForegroundWindow
ws2_32
setsockopt
comctl32
InitCommonControlsEx
shlwapi
StrTrimW
advapi32
AdjustTokenPrivileges
shell32
SHBrowseForFolderW
ole32
CoInitializeEx
Exports
Exports
Sections
.text Size: - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ