����~ˇ�"t/��鞾�H^?j�h»%�zA���3VnLh?�R=��a��ص�8b7��F*���,�Š�>� ���z�����B���Bd�����p���j����ٙ��XO�����tu,��{�W����fZ�#�RD�o�|[�GU Z�H5��BS���XхX��*��6� �hw&�n`[` ��n�:D���%�:W���uhZ�sz��)q-T��va݄��~� ��Ԋr�V�z����^�N���d �A��J.�\'E��>G�F��y?��|�_�\�iBp�������s� v�����8̐I��j�8Ѓh7*O��lB@�ڧI�g���X ����7�U����p��h-C_G��{�%JrQ����wTz%�O.Α�r���ݺ^���:�G5�/��h�I��Kd��wq�O��q��������m�SV���6����Nw�� FΘ���H{���6����/v�pW6�Ȝ�/��s��"�% �jB�7jk!��4��ίs$&K�*ִ�hoW-�!��(� C�d�k4$5�ZIE+\��ډ�HhNR>w�����(�;�Dz�,�m/H�T�хțB\F�}D*��Yč?����i~��eQ@3q.�Ǵ��*:Ջ|�K[;x�Mb�#&�[��2=� Ds���Tv�8�YrC��f(��au�_L(N���n�����m0\)p1���wH�U���ѓ�_���߫�0��ԙF �Q�|����/hYQm��*q�x�P�Q{$�H=����$=�����҄p���ɰ*M�^�=�G!o���-�$�����N��=c���.���/�ѫ�.D���2�r�0���إ"�]�c?־fЩ��/E�4���>J��|��?��3�w5�+�j6%�b��ű}�;�nwl}���mǕ�J����9���*� �eCLi@�C��;������qC�w��Y��7�+��»N.FZI��y���-�����1�$j����ܤ��I��$�o�J�52�{��c)�6�6Ѝ%��pG��Þn��t:n�^1�gW�� �����B��_������@ 1 7�?�����8a�KRƷM�<Y$�V��dG�ங{�EK3�zBS��ed;^a�A�1����q�k<�5�¤�9�����JGl�'� ��QNx�6X���p���̲k���tZ!x4��?OZ`�����~��gK���BG���xwg�f���U;�V��J�9�%?c��ѽqeլ|�BP4�F#{�3�`X0�v�� �&�*�>��TH�p}.^��B�D'u���@]��c�_2���7m��vo�U�,��2���r"��>J����?�� M��>o��&�F�)��&��Slj��<�k$����^^ H���R�<�TU[�Ny��F���,�YM�>���̦�!�v�(���Mм�5cp�ܫ��!������/�c���\���vΛ��h��/E�>"������������Y�[l��^����T[����Jf��dԬ_ݠ�D���,�� e�L?x�x�f%Z{����$Q"i}���B����[`oP��uh�!��x&��#=���G�wn��Ŵ�9,���L�!SJO#�P<�Ρ ^���f�=2`��7����� R�c5�'{O&.���%�c���|r/�IS��o��%^���]�)D��z�9��vKg�&��T�T��Vl�s�[��k2V�~a���Y�M��� 2�~������������� �e���@k����|��1����R��.9b{,El��1l�bB ��5�����Fږc��:)�$H��%�-O�BP�ͩhI߬�Pl�32l�g����W����\v�>SGV���Z�fg=yt�������˸�.��9T%�U��=1D=�g+}����P����gwJ� �cTj��Bp�R� �f����G�%��"%�9G��@:�����}� ��NJ��@��W�������rY�Y�H�At�(ox��\%r��*@[�1����ֹYA��� v��dphRaZ�e�q9�ᶛM��El!n�(���!8����]*y�(Y�p� &�[�l�+v�����:��@鍢��zy֖WT�2.9��Yf0���}v!.���s�yy�Ţ�R^d��B����tL��n1��� �U��'�d�x����| (d�n�Jk4<lK���x컚ˀ����_Zz��(P(o&������_����#F.�00嗯�}����8^��J�=*�B}�T������aeX���4����`��2�?t�n\ wXrL|{�co�-ҙl���פvs����@M@��v�R"�Q�����(.s���N˼-��z�����{0�����tΊD[,�U�kE�3���#V��0�+N��ʺ(�sq����T`�"����E"{;��.�.��f��c�G;�Oh'��Ef��ᾷ�n����x�x��Y@p��d�>^�~:�s?�Zrtދ�P��pd�{u�$Uoj�D�gN�0���լp����~��:0]0���ʴ��B���R�ge�o����a0����9�f����!�K�b%�3ۏ����0�2�<�P�#�N*q3g/��0��}�lJ�5pDO�����?��¸xjߤD�eA�p� �u�x'�%�e���MLTa0���"�)�Wz]9�&�l��9�T��������)���X�Ǭ,^щ��6����S>�� �A��8��r�U�$�!�~xUt�0É��@�%���~��o���o��J����7��0��͌�c��7^W���*���_$��$+����mVJ`a���8 th�ˌ F,�,���v�_���L��YT�N�T��.b(ܴ�X.�7���hu�V�3t��#ߨڳ��Q ��!��<�#;�z������- Z���e��1�h�샘���!�֗����G�IÜ�͋���u���F�6��;A勶���٤NP��h�Z4��9�� ��Z�_t�n����2X"w���Z��&U����k?���̤�l��v�ny5�D|�ΈL_�������r�m���}[�+���
Behavioral task
behavioral1
Sample
da679c268f8054061f4fb22397f11a68_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
da679c268f8054061f4fb22397f11a68_JaffaCakes118
-
Size
972KB
-
MD5
da679c268f8054061f4fb22397f11a68
-
SHA1
92ce5addb997cc5f5ebb08c35e3e61e79bcd7b25
-
SHA256
d84163190d1f41c3f4342c3d46efd7984e327680e375633c34fe3aa6da0a1711
-
SHA512
f1c5d528da98b4e90022ca04dee6b9718d28fa5b8dea1839d104d3e2672c29a0fbf10a13103f2777e8f0f2d910cda25de1b16e867055ffc37785e319c7134907
-
SSDEEP
24576:bYjd/L3HK9ztye+LJTOyGl/19geEcEdo9HDIh2w:Ep3HGztwZZ+JyYHD
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da679c268f8054061f4fb22397f11a68_JaffaCakes118
Files
-
da679c268f8054061f4fb22397f11a68_JaffaCakes118.exe windows:5 windows x86 arch:x86
fc564d4834100a17d7f5d63570eb92b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowRect
MessageBoxA
advapi32
CryptGetHashParam
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 908KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 952KB - Virtual size: 952KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE