�{��u�vP��:M['5��� G��n&��u�q�ako*,�L���1���W.I������}d��S�����7��/K��kxQ�-x�yJ����u�%jF0��}�E��/2O'������b�yu�o�.\� ���5�_rg�+�,��KZZ?/������]��RN ����EVz.E��r�nB��Ae "�qm��y�b/����X�H@��� ���w�����}ɸ8K�+@B�є�*!R�Α�F�&��.!?���|أk:�/��O�VZ�a�+fOۀ�zK�������ACj�WLx�6.�������e7g�ei�I��d#�l-UA�� v]|3�'�-n=�ʕ�������7�TN;����Ŧ��E ���1l:%yW�$fqO� _@! ��zD���:�w���CviLt�n��V$hҳ�����X�՟_ήa�(�h��}�0��~U�)a�H0G2�sX���������� ��4=h���ݎfJse���>����ئ@�%6-��*ʏ+�F��S�ǀ0!T�3����&%w{ҿ �>Cԗ�C����'d�2 � ��i��Y�Ƿw?�ԍ�Bej�V�������L��L���R-�/"ݛ0K-)���3�w��Z"L*Q�E�(�������h��o�צųw�}����w!uХ�ǵ����"]B������j�p�R�&�l�qX$ؤ���;uSi����w����na���E�+��L��Zz4U���)�K�>sZ��Lj�/�.���{���ɚd�(��=ϴ/�?��*z��|0�?X�a�+�Q����2i5�g�B���[���� ��b��@�a>�1rO�hd��G�9,y�6����8�U���m?��%�x5���d�>ܶW�X���E��,��� �H?�r���cŸ��~�[I;p�^&�c�DG���ٚ���G�A��=�t�'�Xe���z��, �:q-�H��?��X�c7�S����g��#��V�)%]��j���o5O�4����҃U�� ����U����B�Pfj�<�� ��k�h���،�3���`�IA�i� ˱<7 m���<#��()p���7g���q�H��dɁ�$�#����e s�@f��Q,��y��sg��T]@O�fr�5YJ�����R�p�@Q5��O��"qȿ�p�� t.����Cٓ�E>٬{��Z���ʅy�%���YuN2%�5���A;H\>�wv�i�vP���k��!GBr����O@���r��9����Yɩ� ���A1M��M��B�'�ĘS.���2��t���Vo�\t�O�㷨��I$u9�����͊�85���x �� ��+Ϝ���U�AL�/`3=9X�1GTb#Z�Y{| &pf�"M3f/aނ�HŃ����f�f�Rr��Ш��A��&�oE0ӛv$�L�����>nh �Af-i����g䪮��-����� ����4�}3��5��-����Vx��{&�U�T�וj[��mժ����7q:[s�Ϳ�p�|c�%;Zmn:[�ћ�L��;�>��q�b�m݅ �3�՞Ɔ�U&�n�J�]��p/h�o�,�""�ZM��O�XVzu�����5m�K�S���]n���Cph��g+M+ӗkY~´��37��C�H��^�Al�������J��4wt�c� Ʈ�� qo����^��!>b]��h��3��&�j�WOM��w����gׯ�����4��֡�>?�n(1O���,���B����� ^��0��C2�r�.��ʝV��Cc��rh��+���pR��1V��9��gݱk�G��5Q)���A�z1n����z�r�T���T/�!�q�o�R�̥G��S|��̖*��`P�"&��1\�Q�3��gp���D�!��Bj`�Z/f�"��x{}��FV��B* ^�*o���Q�T���ȧ.`i��K����Z_��R��:�@տ-�e��3�T���� wk������[�d.��!������/P��T��MG��W���Q�F �dl��;Ӄ��!}l_�59�"�W���ص78�C"ʍ:q���a.8��腽!��ң\���nڑ��oi1ȪM��Z �k�~��:JO��p���E�P ��$:8�/ÔnT^��+s�Etoj���R!F��yH�%'O I������J����m��:[�Ac]�*ë��\X'5uF�_��|΅�3�Q��������Ϩ��_ʌYܐ��� �u���s�����o��߄+��R1��m��E��7/*�̸-~u0��ll��W�¯mh�Ǹ"P���` R�I5�Ӎ�~��Z'���䆘2VY�; �牎 ��,�R��t>2�7gʐ6� �� s����������Bq^qzh�O/�rׯ��lQњ��㺎���^���hs���"Vş������n\��{(���<��o[I��;_-�ޔV���*��p`M��z!aj�b��j���:�քWMнb�59��y���>y���evZ�`�DT��F�!Hp�+�1y֟Ğ��c��bڅcM���I�}�R� t�bk�!��Z��:~ES�ºV��P�N�Y��j��iŴ�tOS2@��ᕗ�4 ���HpX�r���U/��OQ5cʖOK9\��-����<tI��ݶ'<�����}�]ҝ�+���Hh� ;1M�L���5��|�N#a��#�:ƃC���A)�����^�Ϩ4R*�9�.?A��J.��_>�e{ԼW�a�����?�u�I;���>c�F�օ!�a����RO��\�ݐ�����1$�r��[���v��+�{�U��62h���r ~�r�|�k=��eޠ��v!�Qc�<�a/iXy��!`U��J�])k�T��g���5p?}$�k��X�OC�=8�7^��^rq����4�ٛ���8F���(Q��V�D���֟I%� ��5��=�(}q՟9���W�9���e��TK�8�p&o�;J��X����+L>oB9y�aډs�j[ l�*1����đ�ő��x��k���)���i�u\:N����h��j��� �0�
Behavioral task
behavioral1
Sample
d58b40d6c587aad4f296fa65a0e28a46_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d58b40d6c587aad4f296fa65a0e28a46_JaffaCakes118
-
Size
1.1MB
-
MD5
d58b40d6c587aad4f296fa65a0e28a46
-
SHA1
403d1a0226423a460834f88ab13e9b4b256213e7
-
SHA256
34701d2d0b7ed6b11318bee87f6a1751f3cd866cbc6d6d9cf8e6430eac0e0366
-
SHA512
f13ef71c75c37caea423fec1d153bc77d0a7c40ba15b3847d4b9584bedf2eeb11e4d6b17421b8750943c02644cc8b1c5be96c152db81ea799ddc618da11f4696
-
SSDEEP
24576:+fFJ78UGyziWB2c0cpqg+WeVSzyAxfhmMG/YyAiQmuDznFQK7i:+ow3kFcT+WeVSzyAx5fGqifunnFQK7i
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d58b40d6c587aad4f296fa65a0e28a46_JaffaCakes118
Files
-
d58b40d6c587aad4f296fa65a0e28a46_JaffaCakes118.exe windows:4 windows x86 arch:x86
f6eed3a3bae13a46f85c3214fe485f51
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2915
msvcrt
_acmdln
kernel32
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UnregisterHotKey
comdlg32
GetOpenFileNameA
shell32
ShellExecuteA
ole32
CoUninitialize
oleaut32
SysFreeString
msvcp60
??0_Winit@std@@QAE@XZ
chadan
SetHook
Exports
Exports
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 100KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 873KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 960KB - Virtual size: 959KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ