��m2o.m�߇�h���vO�F�6�6��8M��>������D����G�ӝi�9��{��!�N�c����`�EV�g�|w���;k �#վ}a�x��|u�#E�Y�A%S�r�%�Y<R�ζa�.i�(� �S��)�����߶v}j�뽌�4g� ���8��_���=U)�$5�Q��f�:���(�+�ݲ�Mn~~���2Ɛ���Rӣ�uU��G,�Z= qnxu�Ϻ���C���t6�3���+�eTq7��������5�����nO�W�DCm��B����".��h��� �ܾ��mpEx�<sh�.&�EQ�����Ъ={�t+WD�Fd���]@�m fO���'"�#mu���S=�jԑƓd��_�*x�Pˢ�����Au�(�e*ca$�1��˲�#�*YNJ�3%�����s�=C+G�#4���ϑ8Ӓ>f�a�����>���oVµG���]7q+�|*��G�)f R10-1~%������W����t��!W �yO��C��s� T�:XS �̂��o��N���N�KC�����m����%(�C�R�|CjQ�*Σ��u�Ol��{+Pٺ�����@�'P�:���v�~V�/B7�Ê\�bx�ٙG[�f�}Az����1�tTƷ�����t�f���_Kڕ��I��� H� d=ڭ�p7�Q 6>Ux���Uui�����)��J!2��m�Ε^I���;GH,.:qch� ~�w-��� I�&2�Ō��8���|9����a]�����;<$��eM���H������)�.蛲� ���A�4zF�7?�2�>p$|�6�[W�|������s�id�����|V2�I~����Q�}� ������TH����r:��MiѽFiΟlX6��|���������~�|U�n$�]fo|I H`%I�ʓ�b��I�i��SД\��~�o�[��V������1������R��K~ �⏯��)�m���@/�Ó��=�k�ҏ9���]��k�[ԥ~,0�&��u��<�qh��<}U�ʳmҡ2�Q���Q;��C�Q����='z8�q�kb���_Ų���F���ې�2�Y��DB3y`���#�R0�݃�� ���ZiK��D��h �EQnF1�;�����>�JR��Qgxv�����"����,�}N� �"�ܗ} h������ �R9�����nB������.����:B������o���ꧮ��k�ؠl��~��6^�YM��*t7Aai��l���`�ڥ%�QTMB؝��5�ܬ�߄����0�̠f&E7R�Ȭ�^0������4 !�]��Rj�������k���}վ�e3�J�v����t���Cߪ��Jc>N+K�6]�`���j���2����T�]�|�&8�H]&�v�e�Av~,��I%��n�^��j� AziH��UI�1&�Iu: �s4*���M�a�X0j�U�����@}1�i��W�l�(�wOAl�M+y��%T�g�x1��J�,���Q����U�hA&D�� �/������C(�P�N� ��jD7A�"��م���J���%�z&f��?呂���"��0�۟#��ٖ��N�?�k[Q�A[���y���7�<�/��K=�:���e�"E���çy�S�u���w�z�����S?f�����^���p�@�)��ճ=�!�r����֚ ��MO��ƚ�0<��r;��83Q�H����,��ޅ܀��qD\@��O��3����L�´ӊ�q��Ji�������N�F��s�f�V�; Oro�|���.Z� ·[�;�Qy�����h=@��hEY��3�o1b(8+�2� �c����� �2f�ʕ��V�$l\T�W��#�~Ϸ��O�1+~\�USj$��Z��B@�L7x�{C�6��#��� �.�N �T�r�����������"�AS7&nK�ω���r�_dzLd7� ��}bl��t��G�-_��O�;����C2�g8� 1b�+�U8������2NE���ֿ���q�W�v��J�Xxd�~ i��߹�~E���#Xq���<"���n�|D<T�E�=]G� ��EQ~�6���H�f����%;_y���ڡu�c��d�%�� ���S`>� 8�:y�D��" ƀ��-^?��Ai��y���e�|,?�ZU1m��l���KdDV�t=#N����B�oJ���9�8�u���~��\����y������2������/��VcN>?���ץ}: �^��&����9�d=fIε��T,��X��0o;t�^:"gI<�w�M +��7�r�sR)y��A�M#$�a>hG\�\^�#���@�s�� �_d&�K�F�P��g����K㤟�8b�D�4#�����yK�6m5.��l��ѩ��XEU�E�А��"��PNo���nB�3���:�!#�$�Q.��������a0��S���[Xr�~b*���x5x�ǒZ���D�x�ʧ'�}p��w�AA�_�����P�����W�$1,W���' u�˛5�*��T�kFֆ�$Ґ��K����[), 8A����`���"���h�����M�Гx�PyPX��Xe S�$�:/-&����g_��OюbS������+�n#���Ć��:�05�?��|�{� �T���#�ᅢ��t[���$w�`z|@{���WG0�Z�v�h5VUZ�Tv�[��Q����8�ʇ,˒�%E�����qG������x��>t� ��4�֕y/�~�Z��W��pϟ�f�����֨�B�*J��5شD{:�@� m*侺�l9'�\�$x�~.W��?�1i��T K���*LS����w���E�1�J]�f�L�W4��ݥP?��+h�_Z�k<��T��I`rr�H���֚��ɨ�uLÂ����x|K�N��oB;TV�ݭ���nM+i<�K= ��@��i����}�� m�����3Հ-\}����j>?�eW�\�@�Қq�H}AFT��N L�J�����,L{ZYQ�c�C�e.�2� n� ~&�P���ocf���
Behavioral task
behavioral1
Sample
b5d7b82aa13381bf137892aa412a36f5_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b5d7b82aa13381bf137892aa412a36f5_JaffaCakes118
-
Size
1.8MB
-
MD5
b5d7b82aa13381bf137892aa412a36f5
-
SHA1
1c26672d5213bc07c04ceccaddb5fd9938ec1c4e
-
SHA256
dde6a6800ec0fb18ea997afde68afd345b39507e00fd10b72aec89b3e2530ce1
-
SHA512
2dd8a6c1468efea91d242ae162d4143ee898549f7b6e0c1e42931988a710a6a3ef68f6021354ff3c1265815a403c877951c08a8fe7e7af5aad2c6ad5109c9776
-
SSDEEP
49152:PVTPq+fWZxs4mU8wjjyn8VbnPJua3I7oy189xOShkozPHd78:tTPq+eHbmxwA8VbPJuOI718e41
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5d7b82aa13381bf137892aa412a36f5_JaffaCakes118
Files
-
b5d7b82aa13381bf137892aa412a36f5_JaffaCakes118.exe windows:4 windows x86 arch:x86
f5d9affcf3908e14cd29f10241acb99d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
waveOutPause
ws2_32
WSAAsyncSelect
version
VerQueryValueA
kernel32
SetFileAttributesA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowsHookExA
MessageBoxA
gdi32
SaveDC
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
VariantCopyInd
comctl32
_TrackMouseEvent
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 835KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE