+o�ŃO���� ��p�uo���ݎd6�&%$4�Q"����Z�]��9������B}��?�aA������ /�hE?�ۚF6�:�֦*�lAe�,R������&Ftb��r�ƽ�}�䁺����ٰ��4%���(#p�53ټ�|?H%�uz���)��ͪ��t�j��'OV�s�ݨ�bm���]*|?������F���,�ňW�γl����2'y6lQ�`6� �y����Dar��V���d��2q�я��\7*��U�w�4W���P��[��S�(��5WhȨ��^���|Q�W�%����-r���Cw!�h%{ϖݠ֕?D%���oP���^2���mu|5�h���t�P��ϫI�'�/�ҟT7G�\Rw����Q�+ޕ����d�Z9��sr$z�~�6 _�yq��Գ>�?|9 ;�Tdd�����\"T-�ݞT��%/K��Ť���B��[��M9��-��H(H�����a���۟B���u<b4��S_w����1���Y��]g���0�����xUiv����-�D0 3W��"�T�ٕ����Wܽ�T3')��;i�����E�Z��.vj���Y4T��9� �e�b`b��@�sv��lIi�ev�t�8�"��8��P�'��yi%ɮ����rZ���$T�� >O�*���6��F�O�f:�h�]�1�|�Q"��&$���F�%a�"�-5������m��f&Y���ϛ_9��x��H奀x���'wJ�aφ*���)ܖ2 ���aط'3� Ѐ�+j��P���b����v�L�_��m?�{���� A�[N��B(E���'�N죩2��ں�{��fymة�?���N��^q�s8ɖ_�A�F�s��D��a��Ks�QTIno��|w6L�fK�7�K�t�/��4842��F�R��I`�H�Z���`/����.^��4����PxQ�{ԋi����_2��03�����f��v��L�g����\�m4�xws����}PL���D�J�,��z�U����"�8*ə����VG��)��8P����� zq$����/�:�q���R=!j �;4��4��7�>�Tߥ�� �y�-���LU�DY^��ym�Z�uX\Kz�g�so'�8Y�Vz\��z��,�)�nE�U�.��v��X����*� L闦-��Sa_��S� ��jXX��L�]9ň�Jz/K�[¤��!�i����%��@��)�Ѐ5 d�^b����i�cϿ�Q)�g����\5�&�n�u��Xw��M�����#�I����6�g�o4��usA,�xd�����Z<A`>=G��M�Ē�T�|�!U��<���C�y�5�_���Aq-�CO���������9��l����ć� ���Q�"�.���0�ʯ���a��WdRLr^����c�3fF�E7�����q1J��g4��Q�~C�wT����4"�O�<���y�!^U7���*Tyl�����ʹ�ܛN�mM�^��W}���� 2�0�߅V�Ђ1M�<uڝ��%�lO���>�س[�D��:[���k (2u��5,�&��\����̓�M)���y�Y��e���MQ'�'V?2*�Z�7@^FVz����oւb2}dNᥝ�B,��x��%<[ '#O�J��]-o ��l-���t'�+2��d�<�}oSҿ��(��D>M�{'d�F�D�� �B9����k����5B�8ޗ��C� "� �o@���\��+�LeK���}�}*%��'Ǣ����2܄ ����@̤����\*-ӣ�?3����}��k���B��K��e��-r�C|�k�7����J�rPэ��8s�(�m��]��%��?�HD/��gZ�7ʲ���$���֭e�����c-2kU� 4i�I~cqm��Z;=K����HAK�|����K̰�}�ґ���mA���R��h$����R���yJ���埈n�^�U�� �*z��e���`��qk�R�;�?�,����'Ka+��q:�o��@C�^.m����̈Ja��X���W���S_�T���1r���; |7q &����;��>�4�o�%w+�8CL�<��z-�Ɛ�$�����BrJ���TbΗ�$�)��U�|=6��k��9�/Y�}�a5TW˿؝z ����B�(D��'Tw��Y�>ݽY���g-i���v|��k>�_�?�]����W�;ƞ��")�����ȫ�f�� r���O��s� @���^p�;�V�Z�]m�&9��'��k�6x����� K?�Ԕ��@�$>��� BJi}��syzP ��>Q74 S��up�^���z��~L�"���[q��?��;ծ#21�W�DR�6���J4@�!c�9�j�!�����1�gI���ڸ��A[��$�M+!�0R(A�7�8тԦI�A�#�v|]�����Y A�;h��Av���P�w8��rZ�0{�����8@���p�ȡ�R�)Q}�~?&����r.hX���4�0��Y���M"@x����ց���4��s1\�9�j���S<��]�j�Չ�a��C$x:&����a�\��x%/qQM���[��}� ��l��.]�)����VdI�1������PrR1���F�d� 9��a�z��l��р�}'��?�|i��3d�"3��͆����[Q��NF��u�wP���ޢ��OX��=<=D�UG&�H-�~�zJY��е�=������cɼ�{.��h&�.�G�� m�C���IX'b���2��M&�X����e4��9���F�8ivC\�é%�8U.��&Fڱ���#8��#����U�;\O��������L]����� 9����{8 )�Y��7��8�]�u���V�,���#譢�o�wFzG��4t��ѭ�d���:�8�F��.&V:lr�P�3k��Xx�q�(N�&Da��-���r�y����E�����S�|6'���(�g��LY�]L�[�H˽�~�s8/��V2|��Ъ`|�M���&�����\�ߒ=�"���q��u�j�١
Behavioral task
behavioral1
Sample
bf8ab5e818312cd89a421f190169cf2a_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
bf8ab5e818312cd89a421f190169cf2a_JaffaCakes118
-
Size
776KB
-
MD5
bf8ab5e818312cd89a421f190169cf2a
-
SHA1
9e2cfdf07108f92d2fb85cfef841f6cfa0d75e56
-
SHA256
97f1a9fea5ff033382665caa83687b187d83e2b5c29c8335e19b6c05757d5ffe
-
SHA512
dcd6cac9119eaf4c2951639db980f344311a4bd54f96674d6869f3a46b06286171b347b0325ce528c5187d7f65e3761ee14a8730b2dc61a4dbc105391dae21f0
-
SSDEEP
12288:KZ9oRPe9G+DV/qQ33a8FImREM8gHWcLj1smyUQzTLCRnpHozk3/D1nEB1dGrNpgL:KZ9YPSZLVFEMtvLTtQzCzIa/y2rkL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf8ab5e818312cd89a421f190169cf2a_JaffaCakes118
Files
-
bf8ab5e818312cd89a421f190169cf2a_JaffaCakes118.exe windows:4 windows x86 arch:x86
bc9c2c40e20a000a7a3492d91875dc28
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
waveOutPause
ws2_32
WSAAsyncSelect
kernel32
ReleaseSemaphore
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetScrollPos
gdi32
CreatePalette
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
VariantChangeType
comctl32
_TrackMouseEvent
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 735KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 311KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 720KB - Virtual size: 717KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ