�/ |��ۻ�Y������&��M�]�0t1Y��`�Ť���L�����Q��b�X�KX�ZqO�eT�R� X�$��T`C�F���1Dg�����I|θ �^e�MhCכ2^��F�E|� �n�t�F���c�YA4��Ϧg�^���H�L�:�0��?��b����S�@I'c��b����0�th�K�����)��I�M?�J�l"!��A����-نt���w��3��ԩKJ�}x���뎖�P��;�sf?�b+��xji?YZpv3���W?�\�V���YZ�S��)�ݺ�Рy�(t��f7K�[��{�S�eRc����Yd��M��rѻq'f��_����� _ϖ�Ip0��M>���M#����\d��o��QvB'H��D�Ԑ��y��T��L���W����:o��Zu_'"w3�_����נ�>i�#JA��0X���4=��V����:[,�GϢw˓@�x ʒU9�)�9�p���"H,d��K����G�7��@�z��J���.�/O���!ks8<�j����X[�?�"(��hc�KsBxOje�I�z�� ������gRT�rBx��u�����'�!�Y:�4>����TY�Ѽ}g�C�]Ә�)�ǭ���en�04��-1����O�:��X3\YI�|�����˘�.g�o��%�D2Є�p�D����;��W���vD,=Yza���l��ǩ��2�%}r�:�5���LW����*���>(9��D��E�5��,oO��?��B#X��)������ڌ?��x��`��0�½��b�c�6�L�kn�na�w6[uTMHC� ��ѐ�<�,��\s`S��=�����v��9�%�Q�Y�O(�>,@R��{�Å.�K�!7�sY�kka��&������"�a�/������GN��9�3��F5JL>�wbg�H(}����J�J�r�ݢ�S@°�*�o�[Lt� �>-[4�!����dz$O�7�/B�>��o�L5m=����ߤX7���>�@��� ��*>���PAG`v�Y��[��搆\��i U�kU#�9�FД��q����.���<���*�_��* �֊i{6R;tEm9Fh�y� =��Z��O{i�"��S��bVD��fq��-w�T�?(+��b�d蔣m�/IY�2���/·���逞���j_�;M��p�k���cd=N=�����'�o8�ֳL�sx�[���?|�Eג�/��o�P��e(ӛY-}$�Ĕ�'��I۩��r,�eȖ� �4��!�ğ#X83L@��n���M�����+^�*d�]��lA�-$��E�E]�І,m��������|2Me � #��U͵��� Aa�Q�E�g������g���E��F̑�L�T���>��4 �*keH9N�}�=��8-�"m?�w�x�nF8=u��4X�$���W;�4xJ\ǔ���V�x�2p<N����{X�t�4�H�O��^�n N��-W>��]=3��E��W�t�G���&�q�� ���=���1+�?pY������h@��?�#��������[��yY~�ٓ�7-� ��P��M?0A4$�����Gق�4�:<�F�3k���!�LEm,D��q/��z��K@�-z�0�'��M~B���dHD'�;�Fn�<�k������M�y���5]�A�y��������o�^�6O�w�f����A��z�-�Ow��!p�����O�wzE��(�f�l�=Π��E�hq9��X���Ja�Xf�F`��;���5�D&���d[�Z{i���z�i����<o���N_�CW���y@��2���f�C�C�tH��Pvw�`_��ؒ��*���]��m��U�}�������G�\�-��D#���,��r�]eB�!�F��\^���rW�V.�:��l���~���9��u�LN��l��"z���c�>����ʧ}w�`B���XƏS����u���nZ�u����������f�m��0}�.E;��w$��(D/U�F��7����GZ�7����ݿ�s�!�����'�((B�>�^�^�F{`Yz]�>��]e���0�ʦ|�F�j�����i>dF��v0&)&��_�Xm����Y�1^=v�jB���S|��(��Roא��fI(9?���]�E4���2ȅ�/'�[ԺS���Ğqb�r�P:[z>�\�*��uU�� ~$p��������� ��"{���:G�D�wU���Tr{�X�之�%�T�p��ՠj�e���aL���L8�th��%�ސ��ڧ�����s���5����(t ��7zC~�G�5L�x��IRY�M#a\S��z�'eūl���͜�|r� O�H���>}�Ψ�R�p;&��:��ߴ�3,x�;�K\=T���td"3��/�^��� F�}���hl�`Bb�B���E�mW<\��v��̦&��?8�v��-J������q�X܃W�?��+l�}�y��N2�3�:Gpĸ0j��v/���q̀�1>���σ���q�����j��Ε��QJ��X4a`��NC����ה��k9���0\;�����M�0����"Y�qh�M��T]�8�_�%��!(���N���80&z�w��By}��DF�Q=\��:.�'B��x�� �#|Rw�<������OE/v?�����:IG���S�9���;��=@/�����|<�[m�d��Ip�ASꝂ���9�3.ȹ,�byh�0UD�_7T�~o��3������i���d���G�L�t�$v�F-9p��6�߷������ی��貕T���Y�t�ْ�&t��$4=1|�M�nB��baa�#s���渙���m�� ���!Q���`������G�fBI��c��"vN� X�o��R?��C"�|�`�텘�@ox�����q|Q�� ʼn!hmt� Zzi��ї�t���S�Q~o�.���D��3�.)�7���3m�M����3b�E�S� �����)��[���qZV �Ͽ�B|�n��`�0E兞��$S���ja #Zm�=�Ⱦ��1ڟ`-�h� ��;(��t�6�ŗ��,8v����~]��i�85{��]\h�1 *��
Behavioral task
behavioral1
Sample
dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118
-
Size
651KB
-
MD5
dd29311c0eec6f861161f45e7961e2d3
-
SHA1
041cadb471e96e910731e949b453ceaf7e6d7631
-
SHA256
1bf4aa43bc33b2143a43f9b6deb738359367a1297767d496f605be7e8c2f1f98
-
SHA512
8de3497c70babf5d2cc4345197d36ce14ab96590297fac5d6b419ca2f5f15478ec5a39c2182be8cfb208b12590cbb845f2b9c0ac9f0bd98238295e1ce5fdccf1
-
SSDEEP
12288:K7I/asQMNK2de9oiLcsmcQ6RIlReHfLquc+2E59T42IVqe6:K7IZz0oiTmcQ9Ruc+pE2IVqd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118
Files
-
dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe windows:5 windows x86 arch:x86
4f978bf96911ff1b5ff04b8d0badcc25
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsValidCodePage
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsDialogMessageW
gdi32
SetWindowExtEx
comdlg32
GetFileTitleW
winspool.drv
DocumentPropertiesW
advapi32
OpenProcessToken
shell32
SHBrowseForFolderW
comctl32
InitCommonControlsEx
shlwapi
PathIsUNCW
oledlg
OleUIBusyW
ole32
OleUninitialize
oleaut32
SystemTimeToVariantTime
ws2_32
WSAStartup
Exports
Exports
Sections
.text Size: - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 367KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 636KB - Virtual size: 636KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ