"�����qI��A%�n~�n׆,A�p������5�w����%=]1=����Y�Ɖ�?X��1@I8��Y� ��Gq�+��s*���7���c!��&f!��������#:�w¼�����Q=b}.�=�A3#����,Z�F�������G�}rfi]�O��[�ʶ������$�j*M͝�C2;�����"c���^���B;m����?���٘-V\��n�����=��y%��6�u��}(=f��h/n%��t;q�/�h@t��'�p�J��x�$ <�[X*:X?�M�ҡ���39�������9�Q(��T��t�����ޤ �̣�"wr��W�*��y�W��I�$%p8�B���{�����H1�F ������&��:�)�zE� �|���R��9k��O���b.���l<y����������57P*fPS-�����Q]R����8�Tቩ��P��A��W�( �� tyB��x����� �φ���ee��8��yg��x77�/����?/�3B��12?�~���ˬ�K`�]MBdl���+A����t�t���Q�d���߹-��$�F��Q����;r��� y`#�����+�[��\hn%T�]�9 �I����!V�����X�w�n�������.Ti.Y�L@��D��e��;���*�I�}���#:!�D{��n'7�Ht��&���c����)���f+yߔ�Ai�0���8OhTpy\�����������CF�oHE%\yO{�?$F"���K�������?R`V0.���t��_��|}|?�7a�l|>�h5b8�H�eOb���G��nW�s���ˤ�O�fvՇV��d��VQ�k2�A?���}�� �j�sZ g� �w{�[Q'�J,�C��⒕���U��^�N$�40j�s�J����_�Pʹ���Z�4|����t���KpI����,c&n���6|������t�w&4����?��r��TPy˩�#����TJ���5������_����p�_8QQ���b�f�#��[�� ���*4��<�J�f�c��D�����I��sc]�`��/Af�zs��X��,�&�xi�&�pϭo5�fc�i�����upF}4v���4?ά�RQ�[|�1���ہ}c��Ԕ:�+�%�/�i�Y��M?ȵ0،���f���$T��j��{>E6��� �cM�.������X;�r F��k��S-�j:ι/xN𗿻����Ⱥ��!Nv�Ơ��I��:x�T��P�p~ם�3�U��ۂ�YDU�/�����d6�@��{g���|!�u�Q^;�#�دX��e�C��j�����F�?b�pB�1����5��'h�:��xfH�!����V�S]�L^�&���'SpR���xf�sR�7,��#�YQ^��o��l#��� �Ʉj�e*[�N ���<n�d���VJ�. V/RPO�&&Y�T}�Q�E�a�;l3��(�נ��b��:���@��旕�`ʽp��6L���r�j��)���ht#,*��.��*�GٛZ���e� �Do]�[sy���7ﻶ�8��/�G%oo�m�VJ ÙV~ i�u�*5��F���?t�u6���a,�c��z�������͂���g�1���d/^6:� xJȁ�7E�M0��4���� ���G�Eu�_�^�ea�Y���*:S�<�y��&`U}��s(�N��҉�J䋉F�@rN�VX��DV�wV "잫������3��Pk�<�F���Y��i�Ү�$j�C�������!�[��0�������"և���*�� X x}�URu�>a��A;i3E����뗍4,��Ն�r5�G�p*��x0��eҘ�q�?y.^�n\���4��&��<#��y���9����~}��k���;r�A�Q}�-,�j���Vq:&����Lu�e0�3�Z�/��>��3R��m[~X7�%J���D������2�n���M��x�~*�V�tF�IS�D���i�м��IO^Xy8��a�̶Y�A����#����+UH��?7��`&�����c��S:Zz0�p�~9��A�(� ��6��3 W�����w3R%oK��7!0�&��i�q���a��3k^n$�A���ʻ䷀�p_���t������0�z��0\1D����x�0�ߦ�J�Y�~ ;!m~�OY{��ü�Yc�۠]ljmy���1���I*���To�o��f����G��8*����j^Oț} �s�2��G���#�TO�����W^ r�0��Kίϡ6���0$=K$,#m��$7�D��Zq���ل�m�Va�8>�*���㔩d�8w�qNI��K��a�!/g?�l�M�l��o���ަ��hH�=���Iu7{���T�j$�����겨xE��j�%A���_���=�����������Q��潏����� �pJ��z�H��ga ��iʞ9k��p�7ϙ.��y(�p"��D�S��g�� yc���d qG�����C��|���o.�\:HM�����_#3� y��N�N��<մ<~h��f��� �l%Rg>H�?�AݽTE��n����wx kzKW�}�`]t����U �1��uK����=��D�OG�(�Qk#��6��Vo1���䜏K�Saw����tx`X�@�FGk�� ҠϾ�g�!KE�mJ�³�K*�*����str���!n�-��/-�E�0�&�?���j��?ۛ��A��N�B�FjO��): >w"W��u�-��=a4b9�&� :����Mـ!��A������9bW������C~h���K��:�<E��>4}�+�:ZjM�����Ǻ�p��L�ϗ�F�=�:�� �C2N����ve���ٯM�L��Sw����J���J+��̮$�K��=&�D^�kGӧ��W���e�xp�~�%/Q�76Ȕ�O�Wg(6pP����r�6p���*'y�lP5ɀ OX2)�1�Z�ȯ�5,�Z�øoҴ~�������ړ�T�b� m��,��̷d,��u%����'�&Y���3z��
Behavioral task
behavioral1
Sample
b10f6d7182a2c5a9b2e78b60e721e09d_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b10f6d7182a2c5a9b2e78b60e721e09d_JaffaCakes118
-
Size
256KB
-
MD5
b10f6d7182a2c5a9b2e78b60e721e09d
-
SHA1
e549a7b559fd6404ebf041b1da8d96c27909e3a6
-
SHA256
209496c0df3fbed69d4a46068ad92da638eab6ad5a7e981dd30b33259a766efa
-
SHA512
0441e0d3e87c466fd4641853899645146fba90e51c9037064ce760d0134345c581bf08b40f1344784a1a4fbc432cfcb013c6aee7e4b66ded39ada670d0d41b93
-
SSDEEP
3072:lxS8+J2rdPPaG1f69M4YW3dFlhwESsPf9CQf+4OF9831KeR/2gOQotpl3viwArs+:lw8+0Ap9Z3dNGsX9O4mu31FXVotprAJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b10f6d7182a2c5a9b2e78b60e721e09d_JaffaCakes118
Files
-
b10f6d7182a2c5a9b2e78b60e721e09d_JaffaCakes118.exe windows:4 windows x86 arch:x86
30f3afce38ca97270c19a1fbb9305555
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualAlloc
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
VirtualProtect
HeapAlloc
HeapFree
SetErrorMode
GetTickCount
FileTimeToLocalFileTime
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
DeleteFileA
FileTimeToSystemTime
GetThreadLocale
InterlockedIncrement
GetFullPathNameA
GetFileTime
GetFileAttributesA
FormatMessageA
LocalFree
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
WritePrivateProfileStringA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
MulDiv
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
LoadLibraryA
SetLastError
lstrcmpW
GetModuleHandleA
GetProcAddress
GetVersionExA
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersion
CompareStringA
InterlockedExchange
MultiByteToWideChar
CompareStringW
lstrlenA
TerminateThread
WriteFile
SizeofResource
LoadResource
FindResourceA
LockResource
WideCharToMultiByte
CreateThread
DeviceIoControl
TerminateProcess
CreateFileA
Sleep
GetLastError
OpenProcess
GetCurrentDirectoryA
SetHandleCount
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
UnregisterClassA
RegisterClipboardFormatA
PostThreadMessageA
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorA
InvalidateRgn
SetRect
CopyAcceleratorTableA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
GetMenuItemInfoA
InflateRect
GetWindowThreadProcessId
ShowOwnedPopups
GetMessageA
TranslateMessage
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
GetCursorPos
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
ClientToScreen
SetWindowRgn
IsRectEmpty
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
EnableWindow
GetForegroundWindow
GetWindowLongA
SetWindowLongA
SetLayeredWindowAttributes
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
ScreenToClient
EqualRect
MessageBeep
GetNextDlgGroupItem
DeferWindowPos
CopyRect
GetSysColorBrush
CharNextA
UnpackDDElParam
ReuseDDElParam
FillRect
LoadMenuA
LoadIconA
FindWindowA
GetClientRect
GetSystemMenu
AppendMenuA
IsIconic
SendMessageA
GetSystemMetrics
DrawIcon
KillTimer
SetTimer
CharUpperA
AdjustWindowRectEx
IsWindow
UpdateWindow
InvalidateRect
GetParent
IsChild
GetFocus
GetDlgCtrlID
GetWindow
GetWindowRect
GetWindowPlacement
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
CallWindowProcA
DefWindowProcA
PtInRect
SetScrollInfo
GetScrollInfo
MessageBoxA
gdi32
GetStockObject
GetDeviceCaps
CreateSolidBrush
CreatePatternBrush
GetRgnBox
CreateCompatibleBitmap
GetBkColor
GetTextColor
GetMapMode
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
CreateRectRgnIndirect
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetTextExtentPoint32A
ExtTextOutA
BitBlt
CreateCompatibleDC
CreateFontIndirectA
Ellipse
LPtoDP
CreateEllipticRgn
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetPixel
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
OpenSCManagerA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DeleteService
ControlService
StartServiceA
OpenServiceA
CloseServiceHandle
CreateServiceA
shell32
DragFinish
DragQueryFileA
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA
oledlg
ord8
ole32
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoRevokeClassObject
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
oleaut32
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
VariantChangeType
SysStringLen
SysAllocStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantCopy
OleCreateFontIndirect
Exports
Exports
Sections
.text Size: - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 228KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ