�QS�X�b��So<�oYmC��C��r�!L1 �Uq��g�;�����f�R�(}D��;1%2Qr�$�a�6����WeƋ�����e��� ¶�y:; ���{�G��Y� �2ߵk�1��\��P�㸢PDq�~����X��F�tcY]Vw��<3cFi�x]>�c�)}�H�D�'l�m�3�t��%�{@~J�� `���<�_�1 ��^��7��-k��ݡ^�>�h�EƨWhI��M�J�"�� :������>�UE����N��y����)�4�o�t�D�A��70��J|�k�h}������d��u�J��r�Q*D������>��At �#m�i/v�ć�;{t��T��dzh��g�̭^P�G������f�:)8R��H0��[�iD?��N@��D��p����jJU<���#��7��T��n�ck����Q$�&����B�s�j���� e������K�@�1���iшy~P&� ~C.�z�@��}mۙ8��a*��h�\�ԑ�*� :3Z��Q�4iX�����<Oz��5[����;�����vh]S�Tޠ;��D�(�s����f(-h��������s"���9j����{�ӵ<��b7ŜO�a�vjՋa-/Zݿ��s���t1*$aA�r���z���F)`�RIٴl^.;#������Ƌւ�������R �$?!�Ù�F�<S7q��A�2kG����_���hw$M�k� ,T�Z��ʐ�g���LB�$@���y��t~xo����/�)@N�V�/Z�h�ۏؠ'f��F9L�����G�8�"l����4j~�v�ˮ�='%[>}�Zvd�X�� ,!/ �|B��!�����0�6#q��:,�,���*m������"ؙ����������������ǀן���% ���։������zd�L鱀C�O�>TC�x��X9��؋�n��4b�q�b��孄������',G��m�`�k)�f�ܜ�~=s@wm�Rnm H���s���pc����X���!�ˁ`z(wz`0¾Cχu#H_���%o�Hj)�-���VmT���o������\7}Fq=�����9�%Iކ@���;gB�W�����>�+�h����W��nS-��4=J�\h ���n2U?�!�=<�Ѷ��r�x)Ii���6Ű����K�J�W��LSr� �&9*�aw_���=��'���I>T�����Q��Ϸ�)�:��1w��o��^眣{�tڼ?L��چ.�|m�?�r�N{��+� ^�@�x^�?!!]�f�q �1%~�k�Ap��E|VV����sO����b��Ei]#�qln�h�$8c������z�J��R��0��Y�.�tbU�t�c��@���e��)�#�]T5� ��]Ħx`��x+���-����xf�I�XIw>%�B������ �b����nK"��7RS��W�` W�Nf<�TTxv�{�C���n�^�o>������3~���N]@Qr`~*��(�z<�����`�u8�TnI�[r���?�s�u�C�E�p�p�@�|A*k��:D��i��%a���;u�$p#c� ~�<�Ƃ�hr N���^��H*��g���;Oq!u��':�Z�����F7�l(��I�1��ߟ-:#V��x�(���ôwQ��'�+7u�lt��~�2:���M.]�A�Q�]�?��T�νR��t�������r���k�Mu�*���5�B!��66�rk��n�-:!J�!yu��߹9����{:8�ҍg��$��d1��nZl�~D=a�P����5@�.p)R��o��X(0>���)oq/����0~� �I��8��X������8Qn�T�M ��]�mN��M_B'х����z��&K忮/1,ϕ*�R�-Nj?�=e�f�ʛ��u���o�t��3�N���u''� ?��c�w�ḯ���h�JzS^�&������AL���n����� BkA��M9��E�Y�F�vi��o�� +�B{�2(���25�J&r�����-)l�F�W;�s<F,�{r)��1pّ��Ao&O����l���X������k^�%�]��*E^qa}�� �3�K��hN@;��j�%���ޙ�а�l>[��\�}�uJ�w#�F8ų0�����Z���3�>���7�$� ��� �� �B ��q��p���DWNS`�(i�XQ���� #��o���V�>�1�NA��v������� �k6{�[*�Z��*�t9>�У��j����?��۷��K�j��X�K�|<���Qí)N���P�e�uF�r��x��>Ӹ�3v�ҞҞ�[���ɇ .E�����`�R�X�+$���A�[�{}���M��m�F�I�\�?f`1�}U���˯�k_̥4@��0f)�C�ҍ(���~�����ֻ_$���25,F��ə-0b�y|������-H"z�����a�P>��L��ꝶx�߶�f.���B�X�,2[쉌V ���/ T�i w#[F����;��4ۊ���2��K��|V���1�O��ĘGf�Hf��L�����T������l�jK������PZ�H��,��>G)5HPz�lW���v>����8�#������vK���\[��Q��0��r�iK�բ���o���.��ب O)g��Y�G����xF"c�Z�Wk��F��I�K�7���{j��DI�A�^�/�y + 4FsH۲�'���I��:)"�:7�5�El���{4_�������$�#U6`N��"�v뭵q���V^B���s���:n��O��.��A�V �ؖ��S!�e�"��֎� �{�e��%��R�Pn����]��h�L���������Z�s������-�~!����2������֏֧ԣ۷���+�آ� �B�<W���k��wF.�,���I��d1>��ϟ���4�����W ����� Q��;I�I�7��a��h���&M0(.����g�[��?����(]����㤿�cfG�qQ��L*%�!��x��i=��l��V�i!���sS�T�
Behavioral task
behavioral1
Sample
d6e54bb10e2206b65867ea9833e2252d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d6e54bb10e2206b65867ea9833e2252d_JaffaCakes118
-
Size
6.7MB
-
MD5
d6e54bb10e2206b65867ea9833e2252d
-
SHA1
07295b2039d9925e4d176fff3eb9eae07b6b14b8
-
SHA256
76bcb68f268511425c0aa1db70268b86d2900e01828859168dd93a4c4731c210
-
SHA512
df4f5dee47a7b9d1f404b4287323b7983ab79c516b6ef1f2025c224e325049dfaf2e8bcefdb3d25b70c0c6c1223628f601d75d6d169e1e3fd45e85fd9978f089
-
SSDEEP
196608:NxDF343M3ajPNiQ+x8n6nWPjLm48jgA6mRMOZ9is:TFdKrNZD60C480AcOZk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6e54bb10e2206b65867ea9833e2252d_JaffaCakes118
Files
-
d6e54bb10e2206b65867ea9833e2252d_JaffaCakes118.exe windows:6 windows x86 arch:x86
e01fe5f15a049699601b0148a4c425cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
wininet
InternetReadFile
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ