;��*�,�K�10�ϟf�d��_x���;�>�[y#��{�������f�M)|�(��,�z0��%��Cyxea')k�3��i%�Ⱦ25B_wT|��v�5�s���rܛ����ƻ��:͖�����Mu�@}izd6)��!��U�`죾�}�'0O2�j�C��e(\\f��*P�@d8k�����` �;:��˭����ԭ`�d!3�ܻk����!���m�p���1-��k"��4<�dj����U;��f�G� n�Q����m�Y�$qH�'�W�)�q�d��3fa켖���c�(u��̒��)"'����S �CQ(6��Jh�f���<6]A-N�����(�������d��X҈�x ,(��(ܷ7��r�p냢��{�}�� ��CT��0'�5��C��cGV���𲆕E����ȺغgEGf�%wu==��,�g�[�����es���N����gtř�:�'W�N��>^��b��Y���꿛������=0;ћCPXWQ��8"�g�s� �˽s�;��&�����xH��PUo��DY�ոXҏ����kP��B���7$�D��:H�/���=�[����@²�f�2Й��3���]��`x7�A�X�P��"�.�L�z�-��^!v�#�s���� �����iY���"R�Z����b4ʬ�N성�^x���h\�¢'��/�I��kSf]��4��7eԮY|����D�|v�-��k$�i��S�n�*�]A�7b� �Y��@9װ�X��{���1���n����Ԩ��<9����F�G�\)��g���� XsO?���-��yW�h��At0t�{��A���ZWҷV��2D� ĆO�f����LX�3�o3�`������� �w�1L%���&��ZDb]����wc_m� �<$�?2��m0ê ��f��o�W�|Z2�9c�v�i}�U��b�{� ���K>��a �Q�~�8��6C7�5��\T�gAo���0+c���-�������{#�����zy�����jsm|�|�v7���6����4��3�U��V|�'2X p��|}�i��8�y�"_�f8���j�����S��=AOv;�V�����iy6�)l�#wB���K��vx�%눿�����W���� iwh��jY��:���"��oêy'qڱ^F����tF��#T}oa}�(�k�}[g��o������7}�^g ����{��?����̒{����/�%Q�<͍"�R��b?4j�盁.����ՏB�>������&�3��� ��e��n?���<�Y�">� S�bX������(Z��=�8����T<ې�^�c�Zy�#�z�5�=�L'�{e�������L������_�i^�����ߘ-���r�EH\(��ā���ǧw)�7�֚�.;���A��,�����y�W�!�����b��.������_������5^Iŵ�����iB��D�?�y >�c(��2g����A�~��_R���mU���I��U����/� B���Ջ�!qݰD����=tJi\3���r �Zx�2#MW�h��k-˞C���/(e���aclIu'�;t��:d}��W��7�$7/�V���X�27��3C�>≣�s6FzN�^���[�t^1]eK�f�w�+o��K����w�nIh�)��_���5�m�ƓC�@4�04�4e3X��m�%w� J�����|�S�6�Q�D�� ��ZfEo���Dҽ0�����;��ִ��@�CC�48xԁ\��M�ĕ�A���r��Qk�u�l���z��9��l��\�p�����T����̶ F���K��_J��\�E��F����:E~���aZ�\Q�t�*�=g'���!�`S ��Zy�?&2���㞲ˈ%��o�T�ٹ�y�X�x�Xm�f#�M5��O���U���d+$�S���҂?��b���<\+ߍ#m���� ْa)�=N�vݛF�X���_�x���2ק�G�{�� o4� �}͡�������q��"ƹSȤ\B\�䟧Qr��8�Uޫ�b��q���i��Ht6�.�?�g���<���t�_�p���;��I�uu4����*���&˨T?V��Y3��CC�e)�@4���&ΈO���P��l̡m�=� y�kv%V��=o�Ԯ����j���a�����L�Q#?[O�+����gp��T`��UFq��|��<�q�}�AU��;��v�e �Gb �\�����zM���y�ӄ]�G�0 �� � �q+����Kw��T��c3��c�����W�aKV�&���+ ��^����6�UO�R�9���^� �[���y���o�lm�M��d�E�� �r�U? ��6�?5�5VKg)�>Lk}a `�x������D�#� �Ԟm ��H�M��L'nu�ك�`��J�]��t�����hp��/��?#��{X��<N���g�Zм��A����O$1w4�AI�T�� ����r�1�"�y9Q�k�ά��:��� �㨎&ΥB�r�V&/��s�����Dj�̰��_�����k`�'r��대ܨ��ӽL��E�۲���Jns�����!����a]��Qr3�`ʣ��K�G4���>�2gLx;|J��d�'���[��4��s�.Jd�T?g�^�����<p�Z�G��m�1QK��A���}m��~��o��qH4.���5�mH�w�o;�����]&��l���g/�K� S��OV6�0[�W�O����7�23/"u�5��G��Ay+(&��%�; ��m��E�J����Lt��c��$Ǔ�*��˭�����r=,�sF��lZ�?8��s��nl���I;`A��lx�`��1��d{�� ��DG��yq�@iu�ۘ�^�D����)<"�ZXc��=4F��{τ�l���R)R6��h�i�x9-՟z�f���V�:�w����DM*������g���:���թ5<z�/8��5���\H���c*~5�&Gߧ�C��/ ��k-�/�Nv��
Behavioral task
behavioral1
Sample
ade2a28b73634c8061716ce2c9c2887c_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
ade2a28b73634c8061716ce2c9c2887c_JaffaCakes118
-
Size
1.1MB
-
MD5
ade2a28b73634c8061716ce2c9c2887c
-
SHA1
00651fd672ed12c3e9d34e8da714cae8fdb2906f
-
SHA256
13e930da93d26ecfca29385486da0d04df4588011925bc8253fa21a23d8e9f19
-
SHA512
2fd4ac512e9dc9c35a825feca4f67bc98f07d1d8ff71b1bc4dea8f136e5e63c8fe4425ad5b328716085966a390f78a788fc8282a20fdd59b33d48a8a753ffdf5
-
SSDEEP
24576:mWvMNMs2vgWTbEBkNn5UApIavJYBE/N2GBuTwk12fh+MH:jvC8fmkNnfpIzefYM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ade2a28b73634c8061716ce2c9c2887c_JaffaCakes118
Files
-
ade2a28b73634c8061716ce2c9c2887c_JaffaCakes118.exe windows:5 windows x86 arch:x86
4bf27abd68a2f7d5e1348cc4c97688d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
BeginPaint
gdi32
SetBkColor
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
psapi
GetModuleFileNameExA
Exports
Exports
Sections
.text Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ