��]�b�㛮z��*u0�����6��}6�f��<�N������:3�"�s��oV����7\u��������ZOk. .�4Mx����n��%j�ּw$<�rdW_0�4���T��M��:�Z�9_�o;ZqkH�т/{q�#�� �B8V�^B0����x�����3p۷/B�R�����[<9��(di�6h�&p1Ĝ�ff"��?�/]��+GP�;�]VB+a�ºߤ����RC%_.��;�:�5M���Я�"�����eL�"�6u�[�����ȻH����i�@��=���]Q|�i��@Ѡ��G�}�DZw��w?� �zM�4���<,���{&l��A©/����]l0U�۸��`���zǻ�0Uv.�mk���J�j���,�b��Ql(z�'ݔk�샟�.fh��%�~j���f0�E�g(]�����Y �ޛ؆��l'Z�I�Ϥ;a�S:��bZA��jhv�(���'�)���E|<���A����-��l]�����q#�Y��v?��O$�K9���p�J��U r$��p�%4��c����pr�9X�)��ǯ˖1b\bK��ظV�/���e 9��@ƚEV��l�Q���Ϊ���Y�~%ҚQs���/�5��|��'^܅oĔ��=��=�����8 ����ȉ�$��dC)#�����Oj^�r���E��䏙�m���|�Cy)�b4��n���lT�VZ���G\�D�}1�G������oa,�L:�|�&&�@�R�q'�X��?� ��Ů�ަ�������8'~@�2��?N�K��(��7��iqL��o��y�x�S?��Q��V��ɀ~,�������>�Z��«2��3r|%664<�� ��˃@p� �v�g�D䔄g����6��|��bs�����[ڿW��2$"�\�g��@Z���N?�.�P��8�u Զlu�ѱI�<0Մ M=���4���0{�L�@�V\����.H~8[�|/�P#Yw2�x��&�!���c6l�̲Һ�Nt2l ���ڌ7�h�R�` ~څC:(��iv��h�o�ƭ�OT旰C����� �ɚ���U_pQ�T��D>���RE�x�&B� �� �Q��6����&���b+��� 1�ȖZ�TO��%S���1[�epy7���e�b9p�9�12A�K9��v�Eg�$/�����V%c�c�`�'.Wd[����t�ϔ_v�l���ک��G�V'GT_�� ��JB8E��]���;]�2�V �;�X��װe��G�0��b?T�z��������J��*�u�;ci�u��%W�$�����⬎K�m�:��os;2$�;j5<��+�J�<�; ˖ճ���c�l��h����Ua��'��@Ҽv܆VJ����#�Nn2�Q��vÂa�H�� [i�Z�WT������W�+�L?�N�ћ+v���iu�������י�w (�z0-�<<v?�T�u���^�Zr7+:���l�KF�r!{-��&�衊���Wi\�"?Z0��kዜ5��V=v����%r�Y8>��c7�!0�}�rMn�{m�jIwH8�;x�u4Yv��⟋ܓ_��^��A���v��_���ig͉B�ۡ��݇ǟ���^d�H�+�{c��M,;'?Ȭ�]�yv�4hs�l�:[�#���T�]�N�8�aL�����[V�.$�Ȟv<�V��{m��Ȱ[�qYH�Pا�'i�Q_�Z4�9r&� l���o{-]a>�_:(�Ա��U���IX��m��"]���Lٗ�9э�q���2=-�(��Su�Y��$����/��S1���V$�T"��B�]�����K���ӘdC0'�+m���]f}_��]4�.?;��E�#P�`�p�� n����Ǵ�v�p��q����\��'���q����� {e��� L���T�� ���W]� 3����xN�)*[���������Gv.�bx���tn�!z��;��W|���kO�wnfLD�k~�L!�H��S�I;��M�CvnōZ�8�*L�<N���DL�BM>��[S���DD�#�5��e���vW��/F��G������!>1�> :Z��K *�'� ^v�MR�@*��/�%���ǒ�늬�euDᐤ��/����Ve�>���Tn�b�)GHY��~�Ub�������+O�c��U~ =��6�[?�GF�p�W��=��9�fS7�Y������٨)Q�@����gH�τJ�ᢕ�H@��H�J��=摘T�>$1tbW�^�ZZ�'y����c�e1Q��*����lW�ы=�q���g�K�=�E��m�ė���P�2��'�vg��8�ן$_��+�_���8H�Q����r��4@�`��# $cI�������ŗ�mU��˜��(D�t\ڸ���j3�(����" K��䭋؆���QY@DF-/r8�R^�!��{�l�7H�+���ߜ:˱o�={6S��p���?� �q���/<d�9�+��8����rꣶ�O��y�#��3�~�[e8���W9��)����%��9�L�U��q\�rJ�G��.�dv����U3�9z>m<�~U�6�a�1���VD&��\�1K(��u��,��lJf�?7�6�jĊ�D�c_s�䝎6+7��,W��� "�k�U�����m�2 �,�0�`nG���E[�v��C����1~�֡?�:ޏ(汨�5U96���H�;� 9�1�5��R��bӣ���1}��n������YhX���ռ�,K�iFU% ���`�SB�$Io�mDX��i�pX����"�,�KN�`l��}���h c�� �A�Z��x)�4����T[�I]���y�4�ڦB�d�%��Xu,)@?37�*A�����?�7�̟e]��.�Kn�U7����8S���.�Da��-�ȠC���Q����C5�~���S-W/@-@�)�ѷ+�g�J��v$?�͜�W�� kg��c����>�i�P�al��Y{>�s��E��q����P�~��Fs3���ֲ��~è��4*�3@Al�{����y��?h.��A,��+d��s'D7Gf
Behavioral task
behavioral1
Sample
b90cb44b7b429cee0d0d5d2682c26a0c_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
b90cb44b7b429cee0d0d5d2682c26a0c_JaffaCakes118
-
Size
528KB
-
MD5
b90cb44b7b429cee0d0d5d2682c26a0c
-
SHA1
9df177d4ae630b2fce20fe25bb3646620ceddd57
-
SHA256
0e54b7e74deed097228488a28ecb4c9530dd3aae71188c1433e6483d5851f554
-
SHA512
c6e26311f09bbdca34afb7dd20739ede30004ebb81254443b16e7005275ca798d029a92cdc3d4a4508c1c91a94e79827751773ba7be7966a04c6e4bfe821d57b
-
SSDEEP
12288:1Bi4zOtIrFPwAcSS+i7jTTtr9FJx+Zi5BoXukCHcrk1E:TqqZi7HfCiEXu1Ikq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b90cb44b7b429cee0d0d5d2682c26a0c_JaffaCakes118
Files
-
b90cb44b7b429cee0d0d5d2682c26a0c_JaffaCakes118.exe windows:4 windows x86 arch:x86
7cb0b18ad0591c8a9b6b0a6992b3bc83
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
Sleep
GetTickCount
TerminateProcess
CopyFileA
GetCommandLineA
lstrlenA
lstrcpyA
InitializeCriticalSection
TerminateThread
CreateThread
DeleteFileA
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
WaitForMultipleObjects
ExitThread
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
ResumeThread
CreateProcessA
WaitForSingleObject
GetModuleHandleA
FindResourceA
LoadResource
LockResource
SizeofResource
GetWindowsDirectoryA
CreateToolhelp32Snapshot
GetLastError
Process32First
OpenProcess
GetProcAddress
LoadLibraryA
CloseHandle
Process32Next
lstrcatA
GetPrivateProfileSectionA
GetPrivateProfileStringA
GetSystemDirectoryA
GetFileAttributesA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
comdlg32
GetFileTitleA
advapi32
StartServiceCtrlDispatcherA
OpenSCManagerA
OpenServiceA
StartServiceA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
RegOpenKeyA
CreateServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
CreateProcessAsUserA
CloseServiceHandle
mfc42
ord815
ord1575
ord561
ord2818
ord540
ord825
ord800
ord858
ord535
ord860
ord537
ord6143
ord4277
ord6883
ord4129
ord2763
ord801
ord541
ord665
ord6385
ord1979
ord823
ord5186
ord354
ord2915
ord939
ord5856
ord6648
ord2764
msvcrt
atoi
sprintf
rand
srand
time
exit
strstr
__dllonexit
strchr
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strncat
_except_handler3
_strcmpi
_strnicmp
_onexit
urlmon
URLDownloadToFileA
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??1Init@ios_base@std@@QAE@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0_Winit@std@@QAE@XZ
ws2_32
closesocket
WSACleanup
setsockopt
WSASocketA
send
sendto
socket
WSAStartup
gethostname
gethostbyname
htons
inet_addr
connect
wininet
InternetOpenA
InternetCloseHandle
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindCloseUrlCache
InternetOpenUrlA
InternetReadFile
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 80KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ