� ��r�Az�D��A���=]X}ۉB�1M�M��� ��H7�c�`N� ��N�{=A�yD숇G?��; ��b��o��v�t�ϣ4-�s!�Թl��u��"��^�j�`ze�׀���e�j%�6�[3�m#���-���el�N6��~����Ћ)3���?��5��|S�u��a�T��H�O/w��p�)�Q��@l%��8������{�H[�u����r�H��X�k�M��Z�9pSH��m��X>�,�p���C����R�����3���RsT��k*��49եi�܊ӽ������`t�g���H��w�|��p;�Hd��ё�{E6U��- C�����i���D��O����$:����l�Ӗ��.�5�e�x�v3˅v��huX�^���������x��o<�Z�]l�wlی=U��I��O릢��:$>f�GNG6�xr�������ϭ �*���m����r��]�4��zX���>�#�Cj�����>���'�9��|D��,gó<���DcY����q�ݯ�-���&�jHW��ˬ �6��Ϣ��hj�oDcDZK�r���Ҡ�d�-y��O7!��%��O�=���Jp��|��3���/5ej��S��2��y�L��d��#���L�|2�j� Ƌ_^Ȏ�6U��4 E{��B�V�@�!>磯'������帴�!����}uE�B����Wg�ňS�i� �o:���$f{g���䑊�h�F�)B���3m*��t������8l7&[Y'�cN��o��}�#�������Ak�fA1nc�v���8�o�˯˽x4�/��>�h(`4����,C�+h�Ŗq�)�_��AP��Ax�d���m���ߡ�& 's~�o�Lljc&��s�a�����AB�&:.#w��clH~�P1�� d��9[�1�%X��E^Q���K��[ݼ�F�:"���v�K� R�����`�C�����B��l��������l���&����#�穸"\c���u��af�F�m�����Ws��{I#I7��r�� �W��aGd�cF���bA�F8ICAF������IX�_�D9�J�Ij��]2;\�&�Sf�K�g��uM���wU��K���?� 6^+�F�@x[��'��끋z�;���95 ��N��{a�b1o�M`�$]~ �wn�����.3j>R�Emk���n��� b�-����+((�?ɜE ��G�#�4O�)L̼>�@����(�,�VcRyU��|�m�� �I~�;�����7|�nΥ*掂�[��".I ��1��9Yh���7o0ԌY��>�8�v����;�"�N>@xd�o-v�y��x��o{�-eB���_6�`� i�`����<�xi��H�~���t>�T������B��A�:}��[h�o�U� �$vhi'�Ex�|���O��ݜ�*��ľs�����m��ˍ��s�9$�|]���?c�jR��ɿ%���d�d��ӿ�Ig�[�O����hyRx ��o�ۊ�y�V���V����2��V�V"<�`%�pB��ڱ�Z���2Nu�)U��_n������;WA����=�ub�0���l�If�ۨ�=�Y����Khu�@狃���"��C�6+���\|&.��@����0?S,���C���ϏPtNV�U��7����,�@+�(#$u| `�h(�6cQ��b��9>�E���$�qL������~膙�ե���CqN��s#/�#n��.����@�[UC=�B����R:V�)�MD�@�+$��M|�W�w�%6ƅ�!��g�9PVl�����IPN���p�;���r<� ؎e�<����d��r&��u��ܡ����s"O|EX�m����*:�dQ����^pB��a�w��5�Z##;c�cZ�71�.b��י����������h-�s����z����O��^�� #O]uRA0L���i�[,d�����2l�#T�ĵ �y@�莋:^)���o�~��ks�K!'5Zm&S������ݞ-o��[��q�� V�!���m��g�)��Y<�9�PB6q�*^��m;&�:R7��#�����m9�ܗ&l,���͞g�ƣ%U�쀷��c�P������Qrz�hx9v�|7w���(���C�ν�u;*��ubu1��E�I��zϰU��1�Z鎌*}��}��ś0rHRɴl�)U.�(��&d5�H\@�uy�I��*p#�V)Ά�~�D�q,oW�]���d!���o8������.�̏�]K��Y���i4���5p��;mҩ�S���)��d�5�v��,��P�UO�q!E�˷���،��"��&+��L1�/�����dq$H�Z�� �9�Sٜ��dG���s���B�(�GrWk��/?��H���D�~���$�f���'�r�uJ#��Ҹ�Y/ٚpU0����{ל� u��y���շ��f=�$~j��� 6������Ԝ̸O�wU߆R�Xͧ\���Z�����?�ע��ч�̷��-����W��V�D�ƛ�L��j9�N�Y���l�[�7: �0l�Q�fcá�7�oK���t�E:xi�3�#Gv+5 �1=1N����~f<�������R|��3�������DT������K\�)*؉cHX�A� &n��a�X9 �3 ���_1W >�n���^�S�����0�b�����!���a��7��W��$?�[>u�����թB����^Cg����k�ܛOp�I�I��� �Q�`��E_ �m��̄8������~S`j��X�f=:rAY?p>sN� K�+:$v@�֛�t��D���q���`rv����l��ʛ�Mw�(���$�?���l�,�����2�=��f����z�8�S�����Gs1�̯�Ľg�����Y���5�qe�����~����˗�"߆:W�&�5@���֤�� �1�x�h���m�Y��#{�7�<��"�52$�- X�k|&���Z�]��BBN�#�|;.���i>-x�qC�xA����������|RUF�O����dnj%��Fs ǧ���g����q��
Behavioral task
behavioral1
Sample
dbca30d5479d78f4f35cda79f35347ae_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
dbca30d5479d78f4f35cda79f35347ae_JaffaCakes118
-
Size
582KB
-
MD5
dbca30d5479d78f4f35cda79f35347ae
-
SHA1
ec2a305a121d3b6085a6ef2883f8101c3599bc11
-
SHA256
9176ef2070c96001be1394ade2591c90243f4d32fe89a6a740230cc67c62de6a
-
SHA512
c6719d5f6dabfe16ae24cf9148eb5e78821c4c9c1ff24f1a7db0b0e479219079d80a2a49d355d07a415cfc68da5dc0e6bba190521d143113f0b5a4bb96ec9a90
-
SSDEEP
12288:w0ZTe4q9i/9DRLHzEkL+03VmgN2s3XykXJreHmP5rEccvIZRYDd8FPKpbi:VTeW/9DRLHzFblmzs3Z9eHirAli
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dbca30d5479d78f4f35cda79f35347ae_JaffaCakes118
Files
-
dbca30d5479d78f4f35cda79f35347ae_JaffaCakes118.exe windows:5 windows x86 arch:x86
f6854ce19ec3b8025b7568b1b22039bf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
lstrcpynA
GetProcAddress
GetModuleHandleA
GetLastError
SetLastError
lstrlenA
FreeLibrary
LoadLibraryA
GetWindowsDirectoryA
WriteFile
GetFileSize
MultiByteToWideChar
Sleep
TerminateThread
DeleteFileA
SetFilePointer
FindClose
FindFirstFileA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
ResetEvent
ReadFile
CreateFileA
GetModuleFileNameA
InterlockedExchange
CloseHandle
LeaveCriticalSection
EnterCriticalSection
ExitProcess
GetTickCount
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetDriveTypeA
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetHandleCount
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetStdHandle
VirtualFree
HeapCreate
GetTimeZoneInformation
IsValidCodePage
GetACP
GetFileType
SetStdHandle
HeapSize
CreateThread
ExitThread
RaiseException
RtlUnwind
MulDiv
LocalFree
FormatMessageA
FreeResource
GetVersionExA
lstrcmpW
CompareStringA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
FileTimeToSystemTime
SetThreadPriority
ResumeThread
WaitForSingleObject
SetEvent
SuspendThread
CreateEventA
GetThreadLocale
InterlockedIncrement
lstrcmpA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
WritePrivateProfileStringA
GetCurrentProcessId
GetModuleFileNameW
InterlockedDecrement
FindNextFileA
FileTimeToLocalFileTime
InitializeCriticalSection
DeleteCriticalSection
LocalAlloc
GetModuleHandleW
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
GetFileAttributesA
GetFileSizeEx
GetFileTime
SetErrorMode
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapAlloc
HeapReAlloc
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenu
CallWindowProcA
DefWindowProcA
GetDlgCtrlID
CopyRect
EqualRect
AdjustWindowRectEx
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
MessageBoxA
IsWindowVisible
SetMenu
TrackPopupMenu
MapWindowPoints
PeekMessageA
GetMessageTime
UnhookWindowsHookEx
GetTopWindow
GetLastActivePopup
GetForegroundWindow
GetWindowTextA
GetWindowTextLengthA
SetFocus
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
GetCapture
IsChild
WinHelpA
SendDlgItemMessageA
RegisterWindowMessageA
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
CheckMenuItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetMessageA
SetWindowPos
CreateDialogIndirectParamA
PostQuitMessage
MapDialogRect
SetWindowContextHelpId
GetWindowThreadProcessId
DestroyMenu
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
WindowFromPoint
GetSysColorBrush
CopyAcceleratorTableA
IsRectEmpty
SetRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
CharUpperA
UnregisterClassA
RegisterClipboardFormatA
GetMenuState
PostThreadMessageA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
EnableWindow
SendMessageA
LockWindowUpdate
LoadIconA
GetSystemMenu
AppendMenuA
LoadMenuA
GetDC
SetTimer
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
GetWindowRect
KillTimer
PostMessageA
GetSubMenu
GetCursorPos
InvalidateRect
PtInRect
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetDesktopWindow
CharNextA
GetActiveWindow
GetMenuItemID
GetMenuItemCount
ReleaseCapture
RedrawWindow
SetCapture
SetCursor
GetNextDlgTabItem
EndDialog
SetForegroundWindow
SetActiveWindow
ExitWindowsEx
ClientToScreen
GetMessagePos
ScreenToClient
UpdateWindow
UnionRect
DrawEdge
DrawFrameControl
DrawFocusRect
GetFocus
GetKeyState
DispatchMessageA
TranslateMessage
CopyIcon
LoadCursorA
InflateRect
ReleaseDC
GetParent
GetSysColor
IsWindow
SetWindowLongA
gdi32
SetMapMode
ExcludeClipRect
IntersectClipRect
GetViewportExtEx
RestoreDC
SaveDC
ExtTextOutA
CreateRectRgnIndirect
GetTextColor
GetBkColor
CreateBitmap
SetBkMode
SetBkColor
GetRgnBox
GetMapMode
ExtSelectClipRgn
GetDeviceCaps
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutA
DeleteObject
GetObjectA
DeleteDC
CreateCompatibleDC
CreateDIBSection
StretchBlt
GetDIBColorTable
SelectObject
SetDIBColorTable
GetTextExtentPoint32A
GetStockObject
CreateFontIndirectA
GetCurrentObject
SetTextColor
GetClipBox
RectVisible
PtVisible
GetWindowExtEx
advapi32
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegQueryValueA
RegOpenKeyExA
AdjustTokenPrivileges
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
shell32
ShellExecuteA
Shell_NotifyIconA
ole32
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree
StgOpenStorageOnILockBytes
CreateStreamOnHGlobal
oleaut32
OleCreateFontIndirect
SafeArrayDestroy
VariantCopy
SystemTimeToVariantTime
SysAllocStringLen
VariantInit
SysAllocStringByteLen
SysFreeString
SysStringLen
VariantClear
VariantChangeType
VariantTimeToSystemTime
SysAllocString
msimg32
AlphaBlend
TransparentBlt
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
oledlg
ord8
gdiplus
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipFree
GdipGetImageWidth
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdiplusShutdown
GdipBitmapUnlockBits
GdiplusStartup
wininet
HttpOpenRequestA
InternetCloseHandle
InternetReadFile
InternetQueryDataAvailable
HttpAddRequestHeadersA
HttpQueryInfoA
InternetGetLastResponseInfoA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
HttpSendRequestA
DeleteUrlCacheEntry
InternetOpenA
InternetOpenUrlA
InternetConnectA
winmm
sndPlaySoundA
oleacc
CreateStdAccessibleObject
LresultFromObject
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 483KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 565KB - Virtual size: 565KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ