[�, '̭���l۠����FS�Y�������9�SG�O�b�g���<��qs`�Z�/n&F�T�JG<[f7l�v,�#gX��o�{êˍ� x�b�^�����|��G�3�A�N�~#\�� f������Sq�|\J��6C��0�]"�3R�`'%ΞuF3!����2��ա�<<w�\���VcA3p��� ��4��L�Xz����́V�h�g�`��*���N��!$v;��gk�/�ɑ)��zY��B^&G� �p�=���w ��E�����J���cS ����X���a抎|�ϝ��4����x[�!�<zi��j?���?����I��\�D<�G泝���5F�F^H�d�hP'�}��k�]!��D����?Y���K/��G��h�ج9~������V��LV>#+7Mu������]�j�0��Sy��5rO������d�iU�Ω2�L��5�X�@�O���+`�h��"j��yʉ끫�ʥ��5EId����FQ{V;���_B&&?��N���<e� �=�F���-]��drЩ�N�S�P^��ͫ����S��!3>���p����7Bf;��ϱf`FsS��ތR��k���x�ߚ@�6=9>Cp�%9�!"�k�%kB;S�`��H��0�L�N�֖�R��M��9;�G�'�6B�eLN�p+~��J�9����>:�i�2�kx����oҲ� �U2!~W�{¢*�J��Ɣ�-e�gz�<jl@C:��2��#��x{=˷�"d+����EnԢ?+V�R��T�6r�um'�r)�5E��?��z������WP���6]��Kԇ:�{F>1�o]�����eE��п���3];e���S����/r7!��SÊ��hݛBV��[(p�����{I�����uƽ;U Z��� �D7$���c��vu�6q8D����Ā��Ed7��W�]��"�-x�)YI��*� X�W/JM�N�mv�'��|@�/6�١��N�p�F6d<�f5�F�ƕ*Q�����Qq��G٩��J(��$j(=�'�1���&������ԃ�f���n��7Y�����j��/��I��?��ZN��_(���%�I�M�ꏸ ��R+�N��eC-Թs�jEdA�twf��;��i�G�q�� },�Ѯ��&8=��"pR�'�̉+/���Zn,���.��FZi��%��ʢ��+�Cb�4_ij�m_N�;�Uu�~���א>5�QQ�Pž��(�^a�vMT>���Þz�ѸYB��_4�u.��8uc!E�,�FP�����|,&�� ����#�E���yʂ��R��vl\W`�buf*] �3��,�<v�7��Wts�ug���^o�R~�:�Lq���<Y�1n1x�p�Ru�J[;=II�2=����晤��=;3pۂ0C�/�(u�yBZ����/r���-7F�Ɵ��ځe�H���ؽĪB��nN��U�w.d{ݦ�D����7|Δ��� i�3p��� ք\��y[2�܈�N��u>�-V�O8�f˯j����S3 ��Hl�waR�����ޒ���4�h6���mr\�j�V(�A��l���k%|ғ�5;Xq~�!�`����sV\�l����g1p�V���Q�K��5�k�#�Et�w��^�"�Gh����+���\�t���[����eI�X�>�5��qB�P�K�_"�5��t���M�{���Q���輱�>k��!�Qۗ�����3`3�tJ�~���I��`l��~]8Jo�r�¨|����,�ޅJ9^��T�ro���2�g�U�j4��Rݯ?jå1��Yir���ьQڜ?���i�*���[DΚ=�ɖ�R��Q��UYJݭ����{�?C�,��a&M�VA��C@u4u�|P ����<���p��t�o�fV~nQ�,��Bdt?8�n���+�i����)���h��g�z�Ov�ػ-d�3���������Ð�Ou�P��,�g��(�R�����6J_u�k�O�X�Ij���� �tal������n�ܰO"g���<s�r�x�� <Ƴ���u�@;��3B �&�ƄûWF#:�����`e����:���g� Җ�8b��/ʇ���1��C��ݮ���ʏ��P]j�f��(E��I��Ox(_��%�40�k��B�ZD+��=�����*�P���|��g�\]Ԧqm���pjDG:ɴT;�Y�Bݨ�mO U�*9���{3^.Ȕ�!�~�U��X�T鈻G~��(8���s��2ˠ�d^d�� ���z{Þ��?���S�&��t��M����į���N���UsR�pӘ�J� ��ORYC�:�|e��=&d�c5x�p�������_G��8e2��F]Rh����v���=eİ��ؘ�=�*T��PTvF�����ӸH���s KR<�rf�ȯ��g�tL�LH H����������o̒= 4|di�h1S�J~$sP���T�q?b+��L=�%��6�p�* ���gF�$�����wK�`Q�,����3O��hZ;G���eSv������q@:Ö*�D^�"�L+���`A���<�o�ڂ �>�I�Ĺ���,6o�v"���ؙ��c!�=�(PEF�������W����+���⦖��p�� t �E{7��K�Jb�s\���2��D�Bw�w8(����\�\x��r���%~�~v�X�������k�㙻��AF��>^�fOж���J�&�m?A%e,W��VS��Ě�а��x�p`���>ʁ�5���t���EF̔j��tA�k�4�s��A�x6C�(�}�b�K�!�v@�����|��ߡ�/Jo5�v��Hwg���Mh�����D*Gs#�(/�i/��F��4A�:��(�����At �,�a�#I�����+u��5uS|�<N�U�����ϵ��� <�⣏��vo���/��TH{���#q��f��)�]b����!t���*?#����2: H�5�h�����U�Qn�b����vg֖X��+�ҵrE�k+���6�'�E$�@ᩴH=:�TL����B����Kx�핰��a�\ &Y�w�����i�L����Yd4��D
Behavioral task
behavioral1
Sample
c07fdc2a1ec2be41ca3e716d6bb4078a_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
c07fdc2a1ec2be41ca3e716d6bb4078a_JaffaCakes118
-
Size
1.7MB
-
MD5
c07fdc2a1ec2be41ca3e716d6bb4078a
-
SHA1
b96e8844deea20997d2a655a5fb3e4d74eb361a2
-
SHA256
6958e795f538fcebbfa6932316679313288df82dae460fff9ac82bce2a944565
-
SHA512
93647e4f50a31302cdafdb69faa65e82c1b9198bc3070ef191959005b246da92e206829c86bc5976bb4470f3a0b5fb8ad221819dc0652fcce2fbc5104fef70e4
-
SSDEEP
49152:YfR+ltQmZvPR6Xpi01rtrSjX/VhkkCaDBW4N:YyhEv1prKX/Vhkkj04N
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c07fdc2a1ec2be41ca3e716d6bb4078a_JaffaCakes118
Files
-
c07fdc2a1ec2be41ca3e716d6bb4078a_JaffaCakes118.exe windows:5 windows x86 arch:x86
0850b1aa0315b2c1a7d5aa1fc7a398b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteConsoleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
advapi32
RegEnumKeyExA
ws2_32
WSAGetLastError
iphlpapi
GetAdaptersInfo
version
VerQueryValueA
Exports
Exports
Sections
.text Size: - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 850B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ