cւ1˄�#"����J ���'��#>r���y*VHp��x0VOL1|-G��1jO��O�iiħp�������a-�t�O,CK�X�������3���������E�i�Q� ���ǻ�m��0��{[f�������@�t_Fph�6fS�b�)�b�_��=%#ta�6��!5�i�R�T ��#6��/)�]��4���otl�í`���w���g���hc���<+���I�]�˵8��yu����Z�Z�˾��v爨|;,��Aյ i���=�g�� C���_������mD5�S�-3���}ΞE�0����^P( ���l�+Z�D-�#V9���@3J�buU!�s��E `�=�Q����#�"��I0����3���_�/j\̜���(Y-|x@(��M� �8� 45�%N ���ZѰ?�[��dKZ9����|)��~�h��2�|gўNx��E��a����_��K�%� ��6����NP��Q�C{n��cgƶ������d�A���s&���>�Y'�V-�r� �����i 6|J,Di���OVs��=fѩ�D��ٶ;��$�A�U�y��7��.��u�w�W�t����������˓2H�Рs36�����<}x��q"Ģv���?B��������QT�l�P?�(>����#���w�#�W2}2��Vx�Qߣ ����d�$�5љY�V?�� ��^ �t�����V��b9[����{O�G�+�������l�q�?���FП�$z�&m�?v�d�GӼ�=��Y�;��:��=��_ѣ��I����T�C6 i�(Hv�����>-�U�ڲc^�.�e;!2h'䮶����������,��ڂ�$6j���%��[���r0+���<5Ϗ�'hB:U����l�4�o�f�]�J-��X3�;e��Œ�m�������^P'��X��a���&��?C��%{4�s����OO��]z+�S�U������X��QI3<������*���O�f_��ſd�*{�_Ye��Gw�mS��ϯj~*�S������2o����]���K�M�<��Au��E_!�����M���/x }<��rs�Y�1�=�s�2 y�yͯ��p���۷���P�e\��r`�-zk&L%��]R�8���|�����a�e�[����^����z�͏���DO���L���_Va�7��� �h��������� J��U{�/[&Pk�S�냈l��P~��8q���R�����ͥ,�s�����'_�ՐU~��b/�K��`����Ij��f��n�1�_5����A}�L�ta{ ���D6�;��p3s`{b9[�L�Qq����:�u�Mh��nۛ�8�����G3��n�m4[�v �3����)Д�:@����i�t�ټ�JhD����5 k! ��险��;S�%/L@2C�g��K�Pn�~#���.�U+rgO�A�<M_8���{q�D��bs�U�xa�HWը�=~��@[�IlOll�EV��e��o�7�t��*("!�Y��F�%�4J�[=�a� ���N�f��>ua9%p�K ,�m��0F��78!�՝bR��N�����J^�b�,�FK����/7���_w:����4�r�4I��Qe`�"�#`�q�>��Euu��gg�J��*�㛸�e������:Y%�7�%��o�{�\��� $�"�le$���h�(@ܺ)�D&����VF�sy��i�Rę�L�V؊�gV�L��5�i.�e�s�e��w�g� �H���1����jy�^�/�&�v���g�9/,5���qh��<R��:3O��嫄������ܝ���{8�E �@������t�|���-^��`x�h��dZ'��So�)&Go���w��s�x��k��V�"Ɠ�R�V[!��2>�%3~�I�>��j惼���!f}���Z��N�V}"d@�R����d �+Aasj�"-�!ڎ���ϳ�J^��!�b&Q*�KV��0��M@kY�M��Z�/�1��Օ��H���M���n�Vm���߉�P�T�gA�g�"1b�$�3+���s�=ڰ�'sqq,��Y �f`a7$.Y�Z�5̈́(��{4�=(#|���jmC���vO9��a,XǞ��[6�I���Qj�c|Ug}�&>v-9~�������O�TSٽ�a,�\�rh�{i�Ӓ$J�����fϗA��:@�f)�� ̦���5=��j����i��xM�X5^��y��i���(W�JXóї��ǦGn�̪ ��R��2�J�Iզ:�J>�\�8���� ��oo���7Ӎer��D�~�4>��$�a�)+n�ak�b_�E�t�����iCh��T��̊YDf�%䥊�6O�zo��V(^����-b �M�����bː�H�#<b����T�d�����C�F��q�Y��*��I|p�������yWK����7V�:Q�8Nj[q��T��k�~���3%||�E�����$<�t��f�~�w�7WJѩ����������1����~σ~��g|<�RG�������#Ӄ����B��ߕ=�����\:ze��O�n߮��� (�����>,A4��s��5�x�I��,��KU,���E��o@?����B��kTe�1kB��9��ē��P*U��� %m�y���S'?��f��5D��geN���u�4;\g_��g}:�@r�?�P L -�K��X���E�'5[9�P!���n}@�℻L����l�J�����}ֱ8��<�����Rj�����XvrA��MI���=��\X�^\���È�7�\�ow���dn��s��:�q�[3��7d�ͩ�� T$�$u�]����� �J��w��G�q�z�s}���Q�iq�����0t^m9ap�[tk[�7�Yp�ɮ�����l?<Fq��]:dj?���·�68�����]^����`TtJ9��k�=τ������l�כ�CT$���0�غȢA��s- �-�ֺ��X������ wb ��kj��$�.@��� ��M-{��:��Hå����˄��_�%�6Cl�W�
Behavioral task
behavioral1
Sample
dca47f293a3bc9a5c03327de99f67363_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dca47f293a3bc9a5c03327de99f67363_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dca47f293a3bc9a5c03327de99f67363_JaffaCakes118
-
Size
561KB
-
MD5
dca47f293a3bc9a5c03327de99f67363
-
SHA1
e27bd9c0c7fb84fff352f0b3d28ab53e12eef799
-
SHA256
78d172ebc5d763acc7a033d697b704dfafa7f3355391652541efffc9597e987b
-
SHA512
b42453854301b55591df1fb39c52cb826ae8cf355721206306d4a6568f8a06c8723b39c29f4772745663a83c1ab4f2a29f0afe8bed937ea76380c969f7e7005d
-
SSDEEP
12288:jpXTRQxjT/rZKcGApHz3e7qlcDii/4TNWMedID72GE20M:jpjRMTNK6pLbi4TaIKM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dca47f293a3bc9a5c03327de99f67363_JaffaCakes118
Files
-
dca47f293a3bc9a5c03327de99f67363_JaffaCakes118.exe windows:6 windows x86 arch:x86
261270514f8cabc20825cba5d4b976c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
AdjustTokenPrivileges
user32
wsprintfW
Exports
Exports
Sections
.text Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 504KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 559KB - Virtual size: 559KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ