��v����]�c�B����qw,�^?�x�N"��Z@1��,֓����k���]P��-C�T�J����3ui�f\v�̲�+�-$zZ�W���;��U�-�Ş�F���f����Se|y�mU�1t��;�oMʬi1sXHr����&�},��� (>�}�߭h�{ C�i+�������,lB]g�(�H�N�ڋ���زel#��O�| �W�^� o(��b+��q�D���Ds\%ɕ��� ����#!�o��N�I�����PWO��R9��f��wR ����{�R˒)�?m/�V\A��ڱ �@.�mʪ�O���U�݈q��{n6R���;��KsD� 0!f�`.�m?N����qt0& g�a�6�}� ��4�'�)�f���:�,r"Bu�U>�Z���G�� TL�� �6�`9dH 6e�VèL5Ḛ���������<�~W���&wv �;o���a���A���t����_fe��N~z�\v��,� �Eů�YN �_~����+ >�o�B͝˺��B<��e#�/�ҋ�軸*����3�W�{U����#��{2��F 4#ZiIoL�{��fr28���{ �Y��LrasNN��p��KG��@�����t����fм$�v^͌�A��$����Q�]�s U�M �Ì!|�+�f�a�Io�k�=��D�Zm����O�����إ� �YV�8������F�����x�9������8�VA{�I^����86 /��]�qq������#]����ʗ��Q��-�Y��ωۑ5� �@��P��".P������GXlXQT]>`�O{���G��w��R{5'tU�[${��sh�A:Wj�cm!�����NÑ9sВ��BReq� C�-�6�F8�hkf��]km��� PZ���Z !^����:��š?�xZ-�"&��\K��e��Z��1Bf����Ε_Ld�f�S7u�Z�w�WA�G��xU�)n�=L6��B�ٟ�� �C���bxd��a@9���� ���1�t[q�1;[ ]! ��N ���퇶߃��xG��9�B��1�Z�}o���Ë��ڜV�^�?��X��x����4���MM������T!�8*�4d�x����+�+ȁU�$9p�ϼw]�����b�Nn�[P�#���Пj(��[֗����c�;!�OlA�����]�6���7�-��[����//�XR���F��p��]ߐ�Pk�А���V����a'���9c�I�=Xe�b �@ u�U0�����m��Ӆ������t)C�p�6���Y��6���|.jx��s�< <d�D���"��>���6�����VH�����0�ѫ-�w�r��>J5?����Y��B)�ł �7���a���_�������霽a�p��z�@���>(��w�m�uzU=�+!/�?s\)���o�[��]Kz���}�^b\�ױCe�b�S�±6�pЇg���\!�s���k3�5�z���ϭO���&Z��8 ����-�P�DŔ:)3qO&^�D�ߐ����ۛ� ML�o������hh��E�w���׳�S�M���4�|��sr��I<;֠���g���,��& V����8�p\x^7,1����*��3{e9�H��u0�9���[e��5S�RO�;��#�j��ӳ�p��pj�8^��d$WVqh@܈8����Q��s��x�S;�ZWl4J��B)X�Կ;�N�u�~��6�%''f������qXu�/[�ʛN�N9$���x_�!Lg�dHҫ$��5j�{&�N�%�[|���R���:�%���/S�-��h[swx���ZX��tp�������gd̄�q,K�p[�c�ؿ�<��Yc��n�#`�<}ϣ�&D?�(`>�̄�C}���*b�ӓ������ �f"��3K�,�K���LK�!��s���q0=�z�JJ����ފ㨂�ծ�N�'Y�9X��tb�����4�^"-p8DvB�/ b:� ȟ��U_^m-(ʣ3���w�<r��(Br �`�X�U]߬��Gt� ���G ~�A�_2�+��I��K�e��L%��_��PTUR���-����~���a��i�=m��RP� �/�g��)��IU���J�tR��Y.]�gF�aZi3��ǭ�I��ʂ>���#����\�i��[��7�IE��y�(Je������A���b��c���%���'�ϧ��j[��ω;� a -ARw��<�!c��<���Z������W�z� ����W��g�m/�^�.Af��W#B�J���Gi�x�Da��_f��Ơ�۾�КV�K�b�a9{����߬ ���֪+a4��n�p�E���{(�n�������%� ֗3^���^�U��>Z��e��P��(Y��MYŵ;�����A�]ΠmY��"���A�+��6B�� �To�^R��{���� �?V�r��Ԋ��l��C*LH������I?۔^�i�+9|����)K�$�����7P�IB��t̊��.L�ו��y��/��>�;���*�B�"�RĀ�;�'���G�L �U9f��o��Ew+ׇ�>���I:-}P�l�70H @��Ey%�I�(�+��;�����$^"Ӆ��[������҉�� kP��$�����}���8��c��lFe��#X��~�:i=Y�_����*�|���ܴؤ���D��1���c���7 CP�sc�{�9ġ���*��h5ps�\V(�H���|��T�,�*�(��o�ѭK��N�-�z�Y��Q�$�L^g��9Ȁ�;���ވ����j�9�d22�е/�f}��阏�.�J��-{��]�[=�K�3X��D�/7�M�����֞���֠V:���Zĺ������E�bR2%��wɞD��)첔��xG��>� �Zu��� `zk�4���Y�e6���F+��8���f1��Yl}P����;����۞��D�@�5.V?ͷ�i��n�e�;&���}٧��v;f����C�Х�3�ty��VӜ�.&�43��;���.���w0VɆ�-���Q4��P)c�G��|̩��ؘ�0
Behavioral task
behavioral1
Sample
b11bfd64f9ef6cdcf8c3ddd3c53fd160_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
b11bfd64f9ef6cdcf8c3ddd3c53fd160_JaffaCakes118
-
Size
5.4MB
-
MD5
b11bfd64f9ef6cdcf8c3ddd3c53fd160
-
SHA1
1fabf29b98645658cd54fd4866db26b7e6199d48
-
SHA256
feda96e3108122a9c3b05cd003e117ea2150aa9d13c063b7d7e10fffa5be3b05
-
SHA512
592a6f9994441ea62fc9b69aedf3c01038ba072168bd490da7bf8e63703f4869829ce3b01a8a0a398d0a964150a3faf54d5ddfa824ba922f467368e651ae9ee9
-
SSDEEP
98304:zacD9xV/2CcXNAdMTBTwNw8WF0XCgFDUmWYomnIbM6k149y/YNrChHFqv:zauncXmGNMgMumcAIE49hrelK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b11bfd64f9ef6cdcf8c3ddd3c53fd160_JaffaCakes118
Files
-
b11bfd64f9ef6cdcf8c3ddd3c53fd160_JaffaCakes118.exe windows:6 windows x86 arch:x86
effe5750453c1e74e19a7770a23c946b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
frexp
api-ms-win-crt-time-l1-1-0
wcsftime
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ