~�N��E��<�U<�r)����S��3�V�*�f����"V'/- �������( ���F¬���j�s@��D���WטP���1�y.+viq�A�He#/��$ܛy> ~��%$a X�?g���"Y�g��Y,́p�3�p�����#~A��:�}t����*o>�߾��Aᡐ���Q$02�]�u3�Xݘ�w�X<���h��3פ��غY�p�`�wN6������8� �>\h��������)�6r3ڗSĒU.S�: ����`C�:;W4�1C��1�+�D.hk�H�(��c�ԌTZ"�Ѽ������'�C"��a�b:¾|d 8�!�����,�b_Ʈ�v�ݗ��ft�Q� ��9(�e[� �A��˦��O������ڄjk�O�!\�Jm�0�:ƫ��ˇؙ�]�����������v1\O��nN��/���<S���j+R� ��G�Z��3/��m|��77'���:�:SGǞ�S9]��U�[Ǒ�17UKy e�<��h������*8���Ď���9���d��{Pa��UdU��c�b~k>Ξ�"�^��DT������Vf�k;� ްN2<�6�DDn�P�e���Fp]�lӽ��_b����}Av�ϖ+�Z�֮G����b��|r�3��>�{U�W� �żp�K�]>�o�����`��hDVB��ɀ�F��T�1y����Kk��T>dX6�f�?+ZL>�_���X6.���a��#�cow3���1�FZ�� �Q�/��k=��0���i���9���]���q�o�����J�^��ɑ�K*�Fg�i���(��������^o�w�v:��=��p]N���K$�u��et?���,��L�!x"�&�7�0����r-����|�Z[iȚd�؎E>���!���U��ݙI"����#�~�&z�ػ\����^R#�ڷl�����o��b����Ot�\.�#nۮǸ�`�p��3[���$��|Nv���$��̭����,�G#�7�x��� ���Zo���PQ0� n�y���2�K����}2�h�9gTUq���@/'/���rP�O�����(&;�*�f}#�<$�R��5Z%i�{�%־���t���M���Y� �|��� ��ߔ|���Z#����|Kzq�(�P��j#x7PYU��SZ�(�CMU5QT�qF>Yg�����^�" ���Y�Y�ޗ���8�NQ��@/v�/���jӛ{`��PM����9�_�j �����vu�6B[�u�2M�����g�h�uV4l���m��?��܉U�dָ��8��?�)*��K���#R���O�-2d���k?=��LZ��5���z ��ex9��h���'$�iϓ_$������������}Fp&���D���W>-n�����@�2<�h���Ulz�ս,�F�R�Rt�$_X1W�����ec�}�܇��3�J�@�յ;������� ��.,�Z�9����ş���- ����79��Ψ4�'|pud>�٫Q���,+���YIפޮʔ�d����^fl�f#Ɂ]�Ј@K�(=�^ �u٫E�s )�6��k�8�k���?�]��<�����VK�Ki�]�Z�i ���4��,j2�.P����Z����d����K�N[�"�� ����|Ȏu�j��!�� $b��ѵ�G�����y��o��!��%C�S�o��Q��:W��H忐�q7�j���T�E����&*M�`�i�����tje�+ԏsm���a�1�j�B�.Q�8�J��o��|$�i�M�л�(�Q�n�ن3�_zÝA1;:�� ���v�&��_�o� �n]6�_������Ν_����,ȓ�ۭZ/f+������'��ׁ~�̨c�.8�����.,�_�_�e�.#!u����|�:>h�ƛ$�}������M���U˳eË\�ʡ\0�K��Ц�������#_E�R^2�ˁ�<L��L��"� �)u����-8?���틄K ���"�����[M���� G����&�I-����v ��@����6+���g�9�Vِ3jX(������ �����Y���jw�"�L��&�A%,k� x9~�,g��s]�����k� RX'݄b����Ԏ9�搄���p�!��SYۻ�ӽ��_�3��K�I(94��md���ͺ�32'[cDZY���[\�|H��O��܂5#����=����)|6���3�T*9�U���ͰN��L��6��$���~̍� ��/�3q�y;����<wJ�@ �i�^q_�q!���68��J&�'�v�2H�m�@+;�J��C�&�>e��/)@� �'ᾒДАVrb�� �z�k�{��6,�q��5�*nB�j���v/��2��[E��!�*h���&ic��iL5b���:�ﱩ�O��Μ�jn]�n��:w�Q.��T�~+����tjSVL��sQ�E�I��i��v��7^�'*����ɔ�Du�����t���{ٺ����A���\��0�X��R��}S:��!��°w�1�(�h� ������.ǀС�K��^Kf�Q@�U�G���/۸_@?�$�]�1��`=��I ɞ�|���l�%���'��f��s�� ʺq�>��| ��jC�I����:�k�b�鳁��8~����a(���~�#q�U��&� 8��1�4���Nm${g1�7M�^/�x�$�%�{�!��|�q8��6�G�)�`���];Ċ��|8ݛ^�ǔED=�����>�d-\b!ްH�H�r��}��R���迮W�=qSi33�,yR�؇VuSUH���mb��W숛0��1JH��f6 zm�B�I���-|��oX��j�l��@�GIXPf����ҽ�@25� -�`3��_,6Y,�ޜ�IlA����yB����)~P��B�}�VHW�&�j"����-!�-��Ju���I���t�؞�q�<J�2��U��K:�� �����Z��� �ۋMI!R�$����1�� ��"7�0;[n�5���:d�_��P?�f��
Behavioral task
behavioral1
Sample
da66a5b8008a6c6720475151632fca94_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
da66a5b8008a6c6720475151632fca94_JaffaCakes118
-
Size
264KB
-
MD5
da66a5b8008a6c6720475151632fca94
-
SHA1
ef36ed64b819c69996e7110bb362d163ebaf0290
-
SHA256
75cbbe2712ff0e6123fc349cc51a0a6f47881cc99a52ed8d0f78eafd101254c1
-
SHA512
5c3cc0b2c69a83938c9f886d689694a3baea6652b7c1b0148280e06896f8b6a4d5d68102ff8eaedacffcf78fe979db55764991ed6f3cd824e86d3e1c3b1b6c18
-
SSDEEP
3072:4drVTZYQ5zsA3fmeRpoVfQhgtYk96NZwOtSJcYqOgCe/eXhkO178BE:cRDuG2t7WE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da66a5b8008a6c6720475151632fca94_JaffaCakes118
Files
-
da66a5b8008a6c6720475151632fca94_JaffaCakes118.exe windows:4 windows x86 arch:x86
3d5137537cc6cc3d88d73ac03889a375
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
wsprintfA
MessageBoxA
advapi32
RegCreateKeyExA
shell32
SHGetPathFromIDListA
ole32
CoCreateInstance
mfc42
ord1575
msvcrt
_initterm
urlmon
URLDownloadToFileA
msvcp60
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ