��#��[z)�2� ��]z��AAQM(�/ ��z��b�/;:p%��Y����R��U�o�����l1��wx� 0�nE#�#.̱_O��� l����1�Pk9�֨���f���Sԧ_m��F:#�ؾ϶_��F�(�f ڞq*PC~FT}��y>A���hD��#���%�MV�Lb<U�MvƱ$�?/�i�����ܪ> �罈��R?3-��� a��͔�+ �T'#Aā��}R�>���͜�V,�`��]5n�� �A��{��n2����}ӕ�k{��G�4��; Qo�H3 |�{o2p�Fs�.�l?�g|{4���g^���R�H��Y�Xt �=�S�څ����g��1+��9Lâ�\sՌ���>�y=(�p�t��K���㾹�u���̤� G���=o�<�����t^jAE��iX;��-���U@�w?��Գ��,MH�c�9�η��(#���%����%1���� �9:um=�YLGl��x�m5�\��R�%&�O.���/��GDu,�w����B����5�Ӂ�]AF8f%!�l��M�ѽ�c� �F褖dP��a��)]ޖ�RCۘ�+I�.;��� I�CE];X�Qlnc$5������@���5�^�����b%�ţ�wK!�5",�ta���.4j�]�﮹� �yU+6����?ՠB�]�J�W�y�Q���FkY�~;d�L{0i���<-�6YD��e����l���/"\�w������K�d�M��u����|�c/�8������l����b��CGd�y��Kn 9d�ql� f�\�d�6s��� `r����_��<T�m����n1;��MA[;��ç���b��N�VM���=�P�+<V�꺟G��R����"$l������1"90� G���Z���p����V� Rge�^���Jg�kA�@�#���K���BX*r��B����4Ҍ���Ƃ��y���7�!]ݲ� I�"vZ�T�1tS-�I����'�g�H?y�J[˱G�R��op���tMl�(�7~�,p����h7T���O�����������������m+O0��~��s勖���g'щ�)5�Ĥk7Q\^�X�!�����U��.O���k���8iFͿ+@:N jC��Z�¥��5n����e�%qr3���FA��f�ɍb&�~�a<� ;���Uu=Ĵ����-���C<��|��n���VE�����.��/J���;�Q������|1����q:{0"t���R�4���;�;խQв�* ��-m�uW{R�Ǩ�Փs��Jޛ�P@���^����nkb~*F +L�>�Ps"l*�Q1,5�&�3��1�[I3}3�eW�kU��0i|�Ǖg ��**( ĤΉ�]� �LJ {�<�Dp�Y�!���.�$�{�ǰlT��e��|�j�b�y 切깠���uԒ\��)�3>P$#����H:��Dً��,�sO�·����Ӛ�qy���Z�,,&��3Y3'��$�Ћ5,�0��֖J�fn��$y���S������ M�>v��>���`T��,[\tN9"2F��~���yR">þ�8��]e}�b����9�M1W��: YV����8W�-l�:�t�ti0b~q�R~éT�2�f +h�@:Z����s�����qgw����F+����?�[� _g_xD��>��C��co�Vn�4}�%��1���UAٵ1�* j�f�`L��9;���w�;O���MR�~�����R/Qσ��M{�":��<�6��6�CO�����]���������PmJl'�*R8'O�:'8��TZB~7��ފ靀�1��"�f������(���/xF���3 E������oOw���C�� ��C��yp���cC�0<�LZ������Rɡ���c]Xd9&�DΑ�� �:}}P2fl��>A��F��%.�s6�6З�J<���T8���.�����ƿ�=�q��R��k�V��� �����&5\��� $��� ��%y��(�����E��%�R�8����)�$��t������莂+�}�P*a�,��GU�+�p��S����q�nCI�&�u_���L�'���(�a/��Z�a��77/s�(W�Fg~n�ZUM1,� ���lR���h"�4���$��"2�N�kD�E�|><�%���=ҟ4�Iu�-��3#WMgj����}UI�ح�\h�����Y�-�n�3D�����v9b�8A�EMFy��ʊ�AԞm�@��O�m���L��6p'E/�=k�/�e�IM�ۈYܪ�Xk�xKӷ�u%�E`��M�J`���\�M{�y�/PJ��{�Ɨ�@��k�L�� ת�G3f���>l�Ā�sF%�����v�Q�`4^�e�ĵ��<|�q;���k��I�E�UTqQ� �`�^=����p��v��;�!��Ә���VQ��"��:SKUn�����h@�m�h���j{ (��q�+��ɘ�zA���l7�����Ux �h7��J���X$����z`_�`o��w��7�߹��T0t^%W6X0C1��@ ��Ya�����ckv�7�Xͦ��w�5٧��$7$��Ћ$*2)�IV����L3�D�����"Ci�UJ�9Z)- >5���jӉl�ߺB#v<p�#��֥;��%E�o ?�N�`��<���� �)7�իk���W;2���u"��,�����I�ddu_U���������b���?�@ ��+V����7�����ML�1�,��W���OH�#���ۻ�CNҚ�/[o���C��w��x�o��d�ђT��� �����]�S����Tk��Ў��r��P=���Q�5�=�_������$u�C�"~�N����&y[(�j��9�u �}������������DLy�����s�%d}�%U�4�S�R��N�����5������X��Ө�m���/�3�0,w�5�!Z�Κ�h��߽=�f=�*Ho� ?��E�v ��9c� [؟��l��Z�>��rZz�)��m���8�nfX�8�ո�/)L�|���SNF+�'? ������lS���8 3�0��
Behavioral task
behavioral1
Sample
d16a374a699118397c81bc03ea0e7fc9_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d16a374a699118397c81bc03ea0e7fc9_JaffaCakes118
-
Size
1.7MB
-
MD5
d16a374a699118397c81bc03ea0e7fc9
-
SHA1
d9cc02f4cb86ac061a6bfc182e318537d261ed81
-
SHA256
1820df5a8fc888d03b48ce51c7db8490be189e4cf2920fee5f9728a5c9ec48bd
-
SHA512
e1afa3cc788cfa16880ed11e83e89c6b65bf50e0c79298467ece1e4fecb56007bccaac8ceca9e5388b287ea94b11f4e75a4d61f6e109f1d5fa7ccfb34ea55d8c
-
SSDEEP
49152:LZhg1kGUC5aYwhkgn0famDxnoCJigNByE:E+YwhkgqFJJ9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d16a374a699118397c81bc03ea0e7fc9_JaffaCakes118
Files
-
d16a374a699118397c81bc03ea0e7fc9_JaffaCakes118.exe windows:4 windows x86 arch:x86
3b0823b000aee6a9bd8abc0fa87dfec4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
WSACleanup
kernel32
GlobalDeleteAtom
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
TranslateMessage
MessageBoxA
gdi32
CreateRectRgnIndirect
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CoRevokeClassObject
oleaut32
SafeArrayGetElemsize
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 501KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 935KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 445KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE