Lπ(|��J������u��bz��&�쑋0��U�3�)��n]�A�1@�� Ui� ���Rd(���ʾ`���k��Y}oy<���"DS<�;�2�64v%�K��8���tɄ�{A ��N��y�s5T��[F�?B�Q}.^י*��T���=�ˊ�3��Y��&�l���s4�1���^�&�@!O8?�X�ؔ��F{[/2m}^��Ɣ�{gk�)7?��\��+2>6Ib���^��Z4e6m��c�h�"z�B��mF�<�1�;\('k������7�����Q�j)�]�lυ }e�|�����ә�������' 1���)� ����*�э�h�W8�I��&J8?�U�mA�z-d�|1�@{��CJW|E��Z�����qܠ�~��P�MF��>��`�1Ÿg�B=�]���1%��ip\��(П�8@!7q�`��`�s�7���I��ĠC�+����z1��7Q����� {���v�*��R�V���8�h� 2XA�$xC��]�� Ӛ���1���^�aNe� ��/�����$�bM<��ü��d1%' ��B�ݗ��5oh{:�������_�"N������|(#n��E0�sB�z>�d5����p¿�Hpѓ�xS�X�%d�U#�c=ז�)U��O�mo��n\�8�6<�E�Q�&0#�Y��n���5�a0�p�w8;4I�eY.�+�-N�8���\��\ڣ)4S�t>y�9�C���T!���Eޮ������//��r�����Ӣy��Ə��J�Eu ��V�a�Pһ }�]�L��49��K�;�Ɗ�� 0X�-`X6�2��4�ҷg���F�c�c���6��x� ���<{StȬ���)�tY!#�>��-�9!z��k՚�D�T�*���:�j-����Ѿ�z�(���\�}���.��3�~iX�sۛ1n �9j�]P�}D�ዺo�s�39wn���� �!��c�ܖ^��9ZP�(�9�C��i�V�#F�Q�1���=�<w�U�s��*�;w��q=������s��拏�y� ����֎�@��iOWą�=��6���F�����%v7��N�`R+�,��'w�N!P#U����(��ҡ�z���]���`�����N�siM����<�K�FE�C� ��!a������p`_v�1���1�q�����yb��d:~`�+U"~�RF����8W���P��$�e^}a����*���D�<�w��T,���DǣԲ���h�l��RB}���k���G�on��L9X�[P!tvS����Z�@���k��}~�v��5�i/xu>��K���c��-���F����f� aGݮdϦgo���n5�A240���#Ѽ������zB�`��K1ޕ�s��������0O F�8�Na*~�g�d�����}(H���@�P+-����;�a��C�e�B(�����Ox�l�[��g�frtߧ�����^����o0R������� U�rKR�>wQe����p��9�ׯ����(��HIlb`F�\O��W���S��q�{�z����5e���ɏ���� /����o{k:/�xe"(���jά�������ז/�U�(3�*s�O���MH���o��k�����Q&:�b=�N%�qx�ħ/�ņ!�tʋ�9�S���ezh!���1���\QR�#����M�RXL|��l�ԥ����:����v"A ���2{�����E��J�h������?�Ud��K�T9l�?δ�Wy��jE�5]��3���Ը�\NE�y����v}C1�"��G� /ojw�!`�5�6[8����v��?P�.L8ض�d��U�z[�p)�1�-�0ߣ!���,EX��x�ɖ �H�A��T0g�b��u ��~�3�$����Є��.��f�tf(`��ٻ*}Yo���!E�N����Ď�S(��+���}��VGL��|�M2�vP���(�/�ׇ�JRMb 3 ����т�����V�oɷ�8��V�5l����zE[B�KW���08X&h@��@����-��̞k:���oIc�����5��>i0p�NV�6�G{�@A7�G���r�mlM�'�A�(#����6�bJljɓ �1���<� \l 9�³|�UJ�ﴎ����w�4w}���� �%b����B&��3f�a:�X����{���aE��.yjU������]��lC����:-��Ѫ�(���$P�yғy_?�,�! B.<�5[��e^������.h� ����t��gee�du��w�o��>G]��?��k��"Zމ.0tǼ���EO�7�ć��1F'�*��D5졮�ºi#�I�K�û��m�����'$�VYD��tm�=�! g�u���� D�1�m�}��v�WWk�l��XN�u{Y��/�RBRb)��������0?c>w�%U�>�R�6��Ո�Fu|�W��h�� Y��z����.��ZM!o����8䭠wҍat�hӓ�1�j�)C���RP2m ����>�����Rk��������%��gV��[|d2�\WI55F��ʎ;��o˂���� ���ʀu��,�<���Y�𰷌˕,2������G�w��Z<]H�d�5���h����/Iz��a.�*�&�$�`UY. ��!uT�;�q�*��(n��ZhxİdaX�toh`����sf���v�� ϫn#�y��Ͽܱw�'�P��p�څ��&���_�KT�cm�tCD3.Gk�9곪���n�����ܴ f�<5�}Ps����<�oF�k�N�$OpQ�,s���7��ZTA�h؇�ͭ����I��X;��v�rx9�.� ������ Wy����g&q�2)��[��*nPd�XVa��4�l�~�Q���B�L�m�_���:P��4�s��P�~ſ2o� �:��}#�)����Z���,� � �.�Jۘ�şֲ�"��bd��}"�m!$�آ�,:��)s�u�4���.��-�z�!`���|�����H�[�U�scr;����2,ߺ�S{Ie�A�(�� ���\3��?���7%?m�
Behavioral task
behavioral1
Sample
c2a12735b1c5c7d8e2486916695b73a1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c2a12735b1c5c7d8e2486916695b73a1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c2a12735b1c5c7d8e2486916695b73a1_JaffaCakes118
-
Size
4.8MB
-
MD5
c2a12735b1c5c7d8e2486916695b73a1
-
SHA1
81bee73a64e6196c52784f5399cd44340a6f787a
-
SHA256
dd3d68b42c8156bd77c50cb9e0a0788bfaf54d3be4182b2bde54815893d04eed
-
SHA512
40705005fafbf61a9d7714b69bb0212a069f92cb1f55005ca873c5fa6f8a7c08162bfb908f1b6be6de34211c9a69d9fd0b210d2d2e68d59d3474a4317c03758d
-
SSDEEP
98304:b14+wQ0/m+Au5Oi1njZXA0xpwPJurcL3K1/J9KFjxR/sWTcT5l06:BhkXAYbjZXRpwP+cLa5JOjfUl0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c2a12735b1c5c7d8e2486916695b73a1_JaffaCakes118
Files
-
c2a12735b1c5c7d8e2486916695b73a1_JaffaCakes118.exe windows:6 windows x64 arch:x64
b66056f1c9538a4466f54a7364bd79a8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeleteCriticalSection
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
EnumServicesStatusA
shell32
ord680
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
ws2_32
socket
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ