k���F�OC��ߟ�0,� ﻎ8�G�����Zh�F��f�]g\Ҡ�-X�_����}�2��9���u����r�ҩ/�u��� -3�`�ɩp�үmV�N�~CI1#��o3��X*������Y���W7��FlFH�d��[9��~��j́�*|3J{��7��ަ0'M�����p"l�[V!�+H�f �U���%>��<5y�xa�h<0��� �4��)kX,ԅ�/XQ3��\����(��0uF�@��Zn�����c�ZK�S��!8dė;`��]��n�ote&�ˏ&������Z�(�Os)��_��*qb�� -�k�G���տ��j)P+ |7��TnXD��v=;��1�G挩ɨLd��X���>'��1���� c��ح:�EG�' ��` �1�Q�" ��u5ԫ�W��ԙ�����@��>t�yXn5�\�Q�d��t~�痾L"��9�cK�1��y��0Sj&�٘��0�� ���x��C����p?d�����G@��_�!�wR˘� ��{��L����^C�K����#��!�|ji�N�"D�z�&�/�G���.T��x�&�Y��OV����>=��X�y}����A�ڻ{��nG��h�b_� D���t�����E���Kq�w�]�=�,��e N��Kݞ~��vɖC1/jk��dΐk=ck8�����!] Я ���fP ^��"��ɖ�꣑�[3iZ2u]�$��� ��s�}b����J����'���K1��K8���}�?�Q'���8�c�n������h(3w���)�i�����x�;�E�i�6��Q4 �qU�R�N�f�(KdS��a�}��FD���W.�ٍ�p�v����r�����}�^���_φ�jC���ܧr(�Xlw�gg�����h7��>p��<F4UMڷ�&�p�c�u/����v����]Kz��Y�ͱ�^�z(.� �����}J�{����{]F/M��%v0:y�wt�` ()�L��S�G&2��'Q��z1h�O�ܙS���a���8��NV{��r ��`*�Nv`vZ�3���l�)��2~b+`��}G0����pj�́˰�}߉���~��x�J $ui��A�J�%�5���+��kێBcJ�1�:T���[�� ����O��.���֬�֦$2R�l1ʎ���2��@����A�����wFj������M��c�;=5��{ŵYo���.�e]�V�φ�m�Az���� {y�O�m�� �u4H����-�n������x��(.�)�kK��T��ܕ�mG�a4��sZ x�y,27K����m1��`����0����]2^�Wx��^썞@�Mګ ���1�C�؍c^'+� �o�>v0��9��%wC}u�CbM*�gSkym���@��Xs/�p4E����\���s�d%0� S���Ύ��8��N�0�0hѿ{˝�9�f^ɋ�� ���4$;r���=8�4k�;��ٮ��F��4��wf���� ���y"7Qy-�O��wfzv�ɛ4[�EE����NL�oE�/I����I�^��� 1�M|��ޣ�ZT�v� P���MF�q�|�'DCı�MT?0 �%Žb�;6��\���0��i�q^������6���DX0wn��fw�C�עP$�J��$�����֎�Vk[��?GH䠡RnR"|;���H�lg��s��M���D$��AjS�(�<��0��l��W��} �X���o!����#�#?����J�{%�R�w����I�r��Fj��#��Z���씅>��a�')��N22�0(�#×,D�F�\��Tf�TqN��k�Sa{�Z���YI�`�ˆ��!�Opɂ�+oL�fn�E )�[Ax*�j����N�n�e1���QR[Y��Ͷ:�nsA�Ǝ�O�F�Ԁ�Nv�ԝ��Hb�t�ޅ�6S^���*�2k'}���w$4I����n4�*ւ'�ٍ��y]�aME9c��)�b�����x%&����O�#�3|!��WC�CSΦ�A|�u�Q��y�.�yZN�0$��k{�J����n��#J�1 Hh+ :NP��Qrǜ�qŭ�~�_EݏAE�ơ�H��������;�S��F�ru��������:7�R��9��o�^���3�P�������,�Rx�$W%�Qt��tț�-p��A=�����J���Xv�*}��k_L"��Tn�S;(�i�'o��iiO-���(4�a��#�\��Q��!}d�N(ʣ�cr�K���UJM��Q��]=�H��-����e������I�b������у<J��6���Znb��ѿ��-�Ff3��K 3��t�Myd��z��L����1w�wJS0�"��5g A�NA��@!���d�B� ]v�N&�c:L�� ��tlM�W!_�~f�5~d���B_����\��f�`1�V�E�p@��[6h�lG��A饸��3Q�>��Xϛ�~�O�t��� ��B'��+*��l����Zח{-5�& [�N��!�� �o*}�E�*�*�4_G�͗�F�R���ѕ;�8��� �;;Y.ʩZ>� p[#`Nm�d}o��Q�+�(��z�3ڃ�X������a�q�\��� ^�� Q�Ő'���E���cd�]���^��5G�&��J�. ��AF$�X/�&���}I�z������E�y`_��[�\��ٸ�:T�BfDŽ��� п1�,��Z�6g�S���p?AF�%K,<�槿 `)�YZ��٠6�h˒�,crc,��<3������!E�A�jG� vD��W���� Uٹ��0�i��v��h����EW�g�Rv{\�wX�*�!�8�'�W�ø�O�d3�����{�9ZK�����*����bl?X+ZR(��]�"���GVA���˚LC-���S�S���d��$1Ůkķ�f璩J?���Ѽ���v���UG v��&�?�-�W��C��l��85�0���E�˦ł�����`��{ �t��T���� �%W/(i3l��CC��=��{�(en�����T�"/Yi��Q��
Behavioral task
behavioral1
Sample
da0e0cf3ad89d07fbf4a44c2b6a06af1_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
da0e0cf3ad89d07fbf4a44c2b6a06af1_JaffaCakes118
-
Size
520KB
-
MD5
da0e0cf3ad89d07fbf4a44c2b6a06af1
-
SHA1
ed7a1351d75d306af646facda5a3276a2c0621a1
-
SHA256
d09e740957bd10d1f0cb5cf104777ebe706bac431978d42de4fd7b1f3e72997f
-
SHA512
403e65dc9b19719866abf117cb76abc2a9a6d2cef5fa78592da4bafb8b8a646b3a4e925e935bcebbc4f8b09ca0449eb961ddd4389d2a5dd9e2c0ae82c9dcea59
-
SSDEEP
12288:tie/unz/fO35SLusWm4Orp6XDkBLF+fZGe:txM23wLVt4Orpigpe
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da0e0cf3ad89d07fbf4a44c2b6a06af1_JaffaCakes118
Files
-
da0e0cf3ad89d07fbf4a44c2b6a06af1_JaffaCakes118.exe windows:4 windows x86 arch:x86
dcc65e0d6a75b787a5bf4c1b411a578c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemTimeAsFileTime
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterClassExW
MessageBoxA
advapi32
RegEnumKeyExW
shell32
SHGetPathFromIDListW
ole32
CoCreateGuid
htmlayout
ValueInit
iphlpapi
GetAdaptersInfo
wininet
InternetReadFile
comctl32
ImageList_GetIconSize
Exports
Exports
Sections
.text Size: 180KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE