���N��Yi��R� ߮��ļ�%l*��f0%��쾌�zdŎ�Nm�H��#e�gX�;��X�1���ɠm��a:8p�n]b��Ɂ�(�� WSMJ?;H�y(�]�~��������v[{��z�n��< �p��jˡ��TSr8������'�m��me���/���C[�~������HRH�I)oky�C�<���ݔIb���vY͡;m_L���s��Ң�<�^��¢F���:5^3����<[��T�W����������'y*���<�H���~��)��Ι!�*}��Fq�b����5>��Bɕ���`Zp���u���3i�j���7R�h�d~��[�U���b8�r[3q�x��2�n�]G"6�˲��SyTti"@ =�oJ���%%p}ԭ�!?<E� ����3Iy�� �z���9���9��L��Lb�)-S7n�?+�3%�k��w /��$�ʷ��<y�������b�>8]����]�5� o��VI� �^�Ԣ���?Z����m�H�S��Ǭ����{�! ���߇*H"q�E�]��;jOw�aRS���ok���S�'G��Y�~��yT ����U6����f�i{�`e���ٹ��| 1ڌ}�!߬F���gqL�뤌y+0��a������P3G��&�꧑�+�S�3*��[�8 � M'��n��$ȡr+߯�t^� h�?��CՆ�x�_��G�9�:�`B�W���!�yp��'fT��ʵ��_W3/�_#��i����W�!�ҴLKI���R��EƸt~��:�e[��sv�b=ln��T���h#���2G�O*Qaïef $��^����*��D����a_����Axg%���i6�Z� �M���,�|fo���(�D$�Sr��a�ڋ�r*��^��G��D���Wx�4��t��-h�CY�4�����+�b*1z��Q��0�ݧ��y��/P��8�n�����87>����,a�V(�HX�Pv�d��p����bO���!�S��ѥF;��8N�����dK[P�A4���oUp�,��g�j��D!��;J���&�������h (�-��Ag�:�p��REnǃXkJ5��ZD�o�,��MH`�r�zd�����q����h�ܝ�PPI��Y{�x��W�L�ˍ������]<������}�GN #v�i.a�O�q��(�O������<���w �9��E#���o-�@�� =ά�p�a\��a}���V�"L�����UZ����ASwZc$;������k���Z�N�O���w4�5�ŭ��P��x� �k]� *���R�.|B!�w.fC���ZЖ�Y53*;�cj�BPFi�7���{v�݆�a���ª�nB\(.�����Ȯ��{�P�L�C#��v{@?��9l�`Q�¼C4i9����Z�M�b����S�a�J��A ת�8I X:q��^�"��(֓8�������88Ͱ���3̵�5���~t����� 2���ֹ���߸�k9��i(���͚x���8���8^�c��!�`gGqQ���u�P�@���,��E�SP�jg��E��|+nܼ`����X���{Z����)m�B�U1��2��C/+�@���,�qAe�K�P��� ];J�֚e��Cӣ��Y���}/�=��]���<h(����l�Vd�@(��-�7��u�վ�Em5����3��@��[���&-:f�_�{�?�@NoIf*�-Z5�U�G�_�����%s�9�X�3����ܗ��iMG���A�@�Z�D���Ω���p�o�j3n�sV ^D�u�4��'��Cτ\;C*�w���"+���*,,���L Ġn��(w%T�|�}v[g�OhC����;��_����j�mi�cK�j�p����3��G�����B=��mV��e%�Ԅ�8�����2�G��ͥr�֬Wo��$k�����Ȧ|'k�5��;Y�f�_�Fى6�7���)=t�J�t˗�������ķrH8˂�7���;���jhU�t,����o��ax%���-3 ���1��)���<��yW��|�� �����h�%��U��ڂ@��.���يSE�P�3k`~���ԉ s���f!hJ��tF��MDA�E�<<�Ӎ���:�?��Pp��U�����=�}��(3�����~;P��n�_��VL��!.�F߾���98��w��Z�H��V��4��hQ��m馌�Im~ �b�_�0<>#���Y����$fG"\�Iq�/Nv!J��8J�IÐ�]/�H^�o8�����G�B)��]��W��F�w@F�v"�71|_V�n��bŵ$9��x)I����IjrO����A+�Z�ƙ����N����D�č(��_DBy�H�>�*��ΐ�4�`X�X3�@"eӑ�� ���t�̞-����͆��LJ�n��p��⩘e�O��>�v4i������:��R'==?$�!�b�H�kz����X.}9(��Gf�i�Ӝ-_k.ѢB�E!^n{�3t�ѭ��*i�<�IfL��5.�����JTEr�q8�9��<o�6��e�uJs'X$�t��#���� �'_�L=H�>ʤ�?�UQV�� �Ȱ�a@�C���(�8�)�VV>�^�!�9��\e���(n���.@�JH�@/�C���A���/�j�����:�.�P�7�xy�5��*���&�v,{�!8�7A8� Ay���I�'��P�Z��g^ڳ8��b�����8�н��� ^�� @�=� �U�.5��7.�8M� �`��&l�/�L�36z�_���H����4H;=��;�Lt�.�1UMma��OaT�Q�Mɐ�%%�Obq�D�*4\"!�������M�H�u7S�K�H*����SNܯ����Yq�u*"}���I��s|��"�&�"��k$d�7��x_��H��A��g��m|�k�~3c [�i�8��_��e����N�sZ�T��н̵��\�eO�[������=�bP�Ά���Mf7vt#�� �������.��� ��Y+��壏��vGV��
Behavioral task
behavioral1
Sample
ac63700f01110c4527aab6aff7169025_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
ac63700f01110c4527aab6aff7169025_JaffaCakes118
-
Size
1.4MB
-
MD5
ac63700f01110c4527aab6aff7169025
-
SHA1
566b5447db27d5b04a0e98942075f0e2d891fbc9
-
SHA256
5dc4d2cb57db2b17d8f54f1fbbde2a830e60932c8fc695091c5c5d0c6fae7f2a
-
SHA512
15bd7ebca26e8f97fc5cc143dbe485c758d3b887fa4f40703a27229aa2541361375a39b05b702d6a6ddc94ea8d8555b0c3ded6ecd54c496f097c43543cbb3f94
-
SSDEEP
24576:7dHyV1ITiJ7KOBYN1bchyCEQQnPhmdVCEsHl3I5sgl7LVsRi6/SXKSAC:JS/DBYvbckCEQ8ZOH2k/WRi0SXF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac63700f01110c4527aab6aff7169025_JaffaCakes118
Files
-
ac63700f01110c4527aab6aff7169025_JaffaCakes118.exe windows:6 windows x86 arch:x86
9b07c63e93246a1065f24a3d008ff9f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoCreateGuid
msvcp120
?uncaught_exception@std@@YA_NXZ
msvcr120
_lock
kernel32
GetSystemTimeAsFileTime
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
wtsapi32
WTSSendMessageW
user32
CharUpperBuffW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ