u�:��c�8����1�|���@L�wؖ^�kql�o9G� ��֮��h]��Z)p5��8Qkh�����x������A!�`I���E�E6|��x����縷ܺ����g�%�_'�5ޝm`9��������+cPPhcN�1~%yL�Y�խБ�əγ�����kf�hW������5���0ωj>s����)��� hw�i)I��a~o���*��Y�Q��� �G��K|5�Hц�P�TH�c����w��N����v���#P���h�a�� �C���\*�E��������Pc`�9|�%�6���z6��n�7�"�����QPX4ik�d]��E�7��ڜY��0�r�G���+�������� 4�%����n�x���Io�V�?��c�^���Μ�w�I�>�-�$��vZ�Sig����DEV~_=�����1���`��I����R�b�3�$�i�^I�����%��7�B�B�O~��76��&",�tFt�(����[�RUV�7�ʏ��]�r�(�K�`�<�ʴr��:��1��!�ҷ�S��m�X���筫?��j�R��4��gW�b��)y��1IA3����_�����\0>e�:� �Ӭ*sm�O�^˟;�Ċ�>f3�DTNԭ��K=���U���~t&ۈR��7M�lk�j�����<+�]��� �}L����:c�� �Ȑ(P^[�}��i�K̕�5L5����R�)9��ld�������~��c��}g��L�>VYA�¬��ZΰH ��EE�C�F,cߋe�0��m�Jك�0���3c�^���,���1�Ky�5�st��ݚ[V<s�";�m_�и��F�FZ�b��t/��n�y������M���b��X�Ǟ~;���\��X{Js�˙y��:���iY�)�Aq�%��6�����������T1~�1�gtĻH�j6��_<S�f#q�៉ߚ)ppP?,�31�Ԗ�"�# )�J�{�'�V�l"��Q)�H���P��/�n���P��Ո�� �"����5kjg��+�,K>r�6��������dZ�Ø���Tf9 ���tJ4��g C�/�{Aa�Q�^�����x�u�2#9�e�6�<LJc���:m�{��t�I���2R0�M�T�r.��2�����,u�F99��e��W����`=Sh)��:)*�(\ʋ:�]�&��,g��'��2'�^R����VMjUh�8m�l��P��U��ɚ��w�7].�9����v��s(��� ؔ��N�V��3��j���T��Bʗ���g�BC�,0�G�\Yy+�.�~���*=,�g�x��?��G�������dK�-[��0�]L�_�mJ�]+��|����eAu� ����'XX�v�ǥ�c{��̍U[�cͧp�·�̛lX'`����5!hc[O)/E<��Z���9SJn[��̬O���]H��@Q�"[]1�=�e��#�-b�1���Q5��#2��w��ri3���J}�����3gc�F�U}R͐��9��iYէS+aw>��a�Nz���u`��ӞF$�������P/O��R�c~v��������d4������i#М��)�a�g�?睢�h�*�ә2�4;<����9�R���.�w�S����u/�m���2����j�R\���:R#~DP2�����%j;���2���E9UP������P�4&Yd4���{�iA��U�Ar�_�N��c&~6'�������^��+q<�%E��P����g��V� �l�@s���q�R(Wi�!�,�By[@�w��k���X��<HQ�J��j��"��� � ߳An��Z�Y�'�!]3��W}��C��b�8��tv��� �qX�BfkP���+Q$D ��%L�)��I͙�$ߵ��B� �G�Z����+ a +"��)��ʓ98�%`d|�w���bel�t�P�k��������6+P�lz :itz�SC0/��h��j`$�,狷K�� ��B&з�E�M���J��X���� e"z�Pc����=�zf�$�/��̲~���R�Z��)���qU��?�}�����_�/A��v�C�"Z_���9Ӵ�'<��� u]^��P���l?�<�J�.gS?\VQ���ߙ(PD�����Zq��b��BhXW�J�����Q ���6_� �/��ӏ�U��H(-ϤQMr1��_K��Y'4 ��wg.9�(�|z�0b�:�,���y�^���[Z��N���V�|/疜��3�6[N9_�T��)�#��M�y��X�)���������& ��Ҕ_�x��M���H���fG Q���h`� ����uUp���:�G+����x���w��HɹP��|��5�CC�v$r:�<'����.����r��U+��媷���ۚ�&��8��̒�E%�>^g�4;M@���܋���,/�=t������~͢��A��^d�Y7��sF *D:>��5�]�P���p|6ua���+��}�<�ZSEj���Qf��a�K��MqU6YG�d�P��)q�^�cyI;����x�������O"Cْ \�[�Osu���� �`�U�6ɘ�|x�vD��<ںG�v8?�<xR�@�bn N�j?nj�~J&7�4��k�sK86K=�4�^\;P�^�{XLd�Hz]�NyAVx�h�g�� !t��X���k��W�]$��ϱ?��:��&1qJ�����r���\�b[����(HJ'��[6y��-Q����t�������l:�:L<-z�]#X� \A������A��ԹC_� ¢�۾K6*�H��gi��B�����_������r��̔�_n_pD����X��|_���e�'��㒝Z���c�4V)� u�Z��*���p�2^���e��.�r���T�����%�U[JTZ�"a���<O5|���sHhipBpD�Y{��Q�������DnZx����߷�Ap��<��֠X{�ŋ�mF��v7)�A3N$�OP;�P��A��1E�����DsJ����B���Y����$'�IV�A{VG� �bȬ��p_�/�gqM��
Behavioral task
behavioral1
Sample
d2fa6d51c546e5f19d143d0e20924304_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d2fa6d51c546e5f19d143d0e20924304_JaffaCakes118
-
Size
132KB
-
MD5
d2fa6d51c546e5f19d143d0e20924304
-
SHA1
20881ae33489d5408e6bd418dd88f49ad45f2379
-
SHA256
c91e41d260f8327ad18eff0e41b3e865969d99670f55cd2332b023b4dea1f363
-
SHA512
b39fd76f26d6fb0f75a80aa70e9caf57885e2613a99370259aecaf0d50c559cb21c54b5c351b912a23f5a7ee152869929e7d50340b23457783a126f8d52da472
-
SSDEEP
3072:xqahGwHspff8wHg6gZo8zNkj6NXPGLLe:x/qVL/Rj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2fa6d51c546e5f19d143d0e20924304_JaffaCakes118
Files
-
d2fa6d51c546e5f19d143d0e20924304_JaffaCakes118.exe windows:4 windows x86 arch:x86
d24669cc89e054bf8e58f33ab2990870
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
__getmainargs
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ