�>_����c���H� �[�= �TyO�{����}m,��U��k�-�~j3X������h���|U�'T�w��� s��A�(qb��^O'lGY?��J���$����C��gT�g9��tD�4�&u��q�2 xͪ�擹��'���W.�J,�\��q%TT����۟��sF��ۦ�P�jh��t�v����_���ظ�g$G����9���A���������,�Ƅ�J���x�弰m���c��X��O<�D���p �&%�v(X����x�vT�B�X��{��`����L6zqp_e��� ��Q��z�-�`�D� /(�o>�6"�e65X�6�L���jg�'�V��*�<��\=?�h����Sj������u&����^�s�wl�l=�T���f�C����MkJ2^��J����K����̿�ȅ �B����bw�����(cg��?�h�5�*��P�\x46(��{3o�b�?�.��s�.�Ί��Ϥ_��iX"Y}#��Pe�wdfs��&���u>h4��Q�����GtC��'��yT{���|��-���s�h����^�@���_ʟ�H��i��V!bflj��cdX��+�j�O8_�����,�q���&*%���@�`��#�ᦏN�=0��I��{C_4�W���m4,�G�[���C'� +�<X�P*A�+���/�Ht(�#~��~=��l��̤���9��n���6��L�4v�4Y��R�mH�.�6�~�0Am����z|R1�R(R�7!�����(X�<��S�ȓ��zvFo�R&DJ {]���C�R��7H��1W)�VK�$˭�z $=��g^ �"@ PQ�Z����뤖v���j,�ٸ�$�2�$���P㌝P*� @��ϹRպ8��E�{�[��Q,I�=���L�M��1���^9"j|��A~�}/�~�t��=�<��l�H|�)��M(\��%��®���Ž�� ����E>�]��"�|@k����J8ڃ_�cΡ�r;�_����qx��.�tJ�d�d)\�0���yސ�ӯ�1Y��X���dEO�N��\*@����Y� �x����S�d�����$dg�����'Ʋ�L��6�y���D"������Lu:��I���I���B:�#�;�q����s���虶�hN�t��#��u���$tK_��?��?a�f�:���r?����$��#��s�,j��h~�7��^�Uߧ�/1O�V�غ,�/�� )��C<��lC\v[<�b���A�j�p0�Y6� ���!�m4��yv~!F+ {�.����O��1���lԞhb�,�[��c_����q 3��lP|G碇u9�V@�j;�^axr3b]Q���g�{�h�N���ey>�pG'�Mz�c����#� �W�4Аj����t�y�\V�Ib?~����4)6�'x�N�,f��B�+����Ҭ����8���:�K��+���t<�7S��pN|�)������`������-ju �,=��SC}eٲ�C&lO`J�8m�˫3���3�C�-�<!�3��$8quʫ��Z���?wa9�&.��D������/uu�����9^!�ҙ�[��7c�Ų�6��|`�����YJ-MU�%JZ$F�9A�s���C |I,�T���$d����e<1����E�r�Ԍ���n�Iw���n��w2�o�g�/GQ�5����Cd�,�@w��4T2C"�^y]K�[����8��ˍ���e�����Ǖ�!�|��j0�_-�Dŧ���nZ�4�a�s���B��җuOϟ������bo�y��}�������D�v1�R_W�i͍ˡ�p�j��d��'|n(��y9�� @��}6�#���4����9���x��wRM��W��*\�F��E^�-_�&�b9��w��@׀��@eZ3"�6uN7��j�L��C�A��p��<{Rm����\YG�Hp_��(S�QQ��da�E��@ ���j��'�$q�T�?|����\�98��3d��`�wg��9�C�v�0�'t�ӹ��We'��i7,jW��;Ï�$��U��FB���ۣ%P���@D�&~XE srӆg�����o��yV��*&?�o�~H;��X[-�h�s�D�KZP A=}k��P���s��f�Ig���_sB�2��1�*�|�)���2�#��9+ ����h ,�o�ؘ�eA�$h6���2�=mH~%��s�&����y��/QV�����821�����U�W���B��&���}Kp�'5~T�7�ݑQDF�t�(EXO�,��)��( �C�ԏ!�� ꦂ��?�rX���`��ʁW�&^ �e>r/�M�y3R��U5-�sP�Z��IU��[��6Wm=旈�F��d*��z���)�n�$r -���i��m뮲�n�� 4��]�����y�j�GTt[���HF�W������N'X��Io?�6DQ0I�F��I�<�A j��]�vgy�A�#ӿ������n��_��Sr��t~v�b�i+:��1��S�p�uCg���ZW��e������*˘�E v���%�|Ѣv�\D��$�^$ˡt���j�kQqB���6B"�1�~��~绞6���c`Y��������7�d��Z7D\*ȸI�p�@2�)Y�8��+�p�������F5� �-�%*O/�/0��߶dF��0�XU��}_c�a���" La�>x����ʭ5����E^G2hO@`�g2�,�h]�^��R]nP��y��CB��w��h���ȗ�w�S�_��HV1��a>B�͘yC��x�� � �\��A�i�:��L����$ 2�:�l�8L���җ�&-�/=���he�ܳo`T'�Q�5��f o8ҕ���}/�X���a������F#g��f6���D�Md�*J�|*�z0~w�çVrsq2�br�;�M�L�/�0����� �� ]d��hYki�(jEy'��Dɇ}t3�#ٙk ؊13�tߛ"r�2�#pb� ����:(y'��s�x@�t�r0�?,�M��z�Ȇ��ҷ���R3�*��f݇`�0 �
Behavioral task
behavioral1
Sample
df0c586da04e2b3b9a87229f1ca0927a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
df0c586da04e2b3b9a87229f1ca0927a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df0c586da04e2b3b9a87229f1ca0927a_JaffaCakes118
-
Size
134KB
-
MD5
df0c586da04e2b3b9a87229f1ca0927a
-
SHA1
9aa493f951b3d2aa1104ed708a24aa32d6174ba7
-
SHA256
5baa1b13e8b1a902ec2607fedca4827374caa6485cd06d71b6ff88fe60578355
-
SHA512
6d736c97d10619dbbc0678cfc1d22702913a292bd0c4002d73a2357fc81ec347b616204961f122d7a3051ae0ab1cd9a6f105a0e6705024abe4578ad26fc759e8
-
SSDEEP
3072:N7bE0cde0ztTpCBpSyqYr/59uyvw8EuNnsXCUF2I:lj2fVCBUyqK5rY8FNnn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df0c586da04e2b3b9a87229f1ca0927a_JaffaCakes118
Files
-
df0c586da04e2b3b9a87229f1ca0927a_JaffaCakes118.exe windows:4 windows x86 arch:x86
7fdb7688dc680d191f453834698975c4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
wsprintfA
MessageBoxA
comdlg32
GetFileTitleA
advapi32
StartServiceA
mfc42
ord815
msvcrt
strchr
urlmon
URLDownloadToFileA
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ