qm|�I���u;���0A։�K��0C�s7�衹>�P���N���q`�~A��[f>?U�9_�����z兩��;�8��u�#�Ś�����y�X0vP��B�;0U��M�L�B4 j�*T��r��ix.�l_��:3�Р}g[�r"x��N��a�f0n�dS�%�?�D�L�7 ������>3�ML��$�:��ƢnT��J>F���W�fP�����J�g�%.������sF�����(�"_Po�_��?�k����W��^�qJA����_�5E���� fq���T�H]����=ʜ�Y��5���V���p0 ˠ��ګ���x���F�Wl�cw�LI �=;4����v��9XyI�@�c��V�6Ɯ�������?�?��ŕ����)�����N��e�����ld�>��KJWg� j`����|�C/9dt�u��6lR�] �眚�����a`���o9V�9�7zG�-eu�NJ>]���!�È'Bϫ�����s���7,�-R����) DfkI��V!�g��6� 3�~ge�GᔢT�����\h5x���9���|]����?�1�9�! L r��N�w�c<Sny���^b����xn��(9NY,.�M�C0�jW_�������1g�����<IX6+x�W�3��a�c/��&���uD����gmuk�v�ت�m:��� �|�� ��� �4f/Bh���[w�,F4E|se�͖0wnG�Cf-*�������˩V�l�s�+)v��-�;��|��[ eT=�7�_]�I7�Q���꒾�4SL��!���Z;{�&7���j)��WTvK��.�l�L�\c]%��L�'��qWQ��㾿a���Y�e��c���=��3B,��}O��0�`����k��0�8y�3N�LCS�7�w���>躔���!�P��_1��&6:��ed~�ju\_h���+��t��.SՌ���$�%�[�d�]}ˠ)C��F��s|n��GHY��QX�dd�o*Z�xQ��^�\5�v<�{�j��tT�'�����z�e&�4Yi�XE}�Z�Co�v�4��^2}��(G�"n�Dk"8yiq���$���.��|Z�:��䅢4�TWu��<����g0XT�Ӿj�!���Z�!Y���s�H��o-�x�q.d777�V����4�NL�_i��`���ĵ����"%�Z���ZE����+ȍ��z�:����\<��ҭ���bky��,+o��}��Y� U��,������}S�%4�4��林��w��]�Y5\���Md�gV�F]�=�(��F�fw�lfi!�}/-D�C&8\%���aG|s<�{O��`�O�DZ�}�������n��8�\y���(I�z����Ш�wz�g���b����]���1�9���X�)�VN�z��5���j�Q��,�]�´g�ޥm� �ӯa[G���d���$��8���C�8��\+�z}rX�=�4�+�Dօ�j���?vP�{���;mp�h�V��ʓ��Δ����7�c��\��U����g��E�tf{�JV@65�Ru���[|Eb܋�QF�p���F?�Ϛ��a��nF��N�=��i�?k��� ��+i�IO�k�WFe�MU8$��9l��W�Lpy���&����9�\����Vڅӧ�6��h*/���7�Wr���d2'd!.hX/�U�[*��#�<R_Qz��>��,�(2;��r���2P��õ���u+Գn��A]e�!4�x��c`�w<gN��<�K��hy��_m�IRH3��<�e"�[WH�>��}@(�/�����ȭl[�ߘ��g�'��e�$�7$��Dn�s��){Uϯ�y�Q!���4`�<�'N0om.��������� �aq���lxJp���D�"�����x�Wvf�%嗸�u,���}�2��r1H��|��O�E�%%�>~�7ԙ�N�S�@X%v"(n%�� ���_d�x���df/5Ce�$j���nm�pE�2�,�Y`�v2qbi�=�˳��8I)9o�$F��miL�&n��:�=�u-��h���������}l1J��8�����<��Eh}/֙�+�jp �{�ޯ]�\���]�cĤ���X�˿:/��_8c��w�$��[cv>҆����9�~��|;k�����#na yL|������/1O'+|B��Y���i5ن��T\rBu*��N���{W�w�,k�&s���.b+�ݭ��N���!brn�xk��X��!� WR4�}��WE�:�V��|���t��7uJ�-�K[M�NB ���Mi9�'*�=�si����X��ňd�ޖ�O��5OD�7��@}��j�$xGO?����H��uʁe ��u�N��l��0�ؑrWG�F �7�J���IA��*�G,]k��*��S<����@Fv[UuPy'O�pn�R�A}�u��s�?h�Y|V S�3ƯK#f��j8T���e��O�W�Q��u'8d��p<�?y�z���2�e�*9h�5ফ 0g�CIC�2��ez��~�P�k��'0������a�V�?v}�%� r�DQ�e���W�v�U6US+��O$n��j�����~������n�*��0�y_[��,��%���Bdi� RY�"�`�2ř&����SU�~F^)�M`!�@�$m����5��������_ؒ�sA���4�\�Pˆ" U(��:���=AD7��\��ѱ8��x��'-W���&���;��'ϼ4��2w��$�3*#]?�*�X�ܠ�`A"��^d��������,Z��B��rd�U���~E�j?���p���ZF��$l��y~�*����e{v�l��?�'!��G؎��E��lalG��f��eaj=/��J�x,�Վ5�^p\�:�Vs�����/�B��t�c2�}>ka��5B�P҇�].*w�Ez��b$C��w1���0����$8���������m)�x��\��!椙I������QY9C��܃,�����\(ޑ�����{�s�PG���}II~'��JL��f o^��������shc�gƅ����G6�T���TW����
Behavioral task
behavioral1
Sample
dd73c2aa70f0b95df8c81e9e8c4d0f6e_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dd73c2aa70f0b95df8c81e9e8c4d0f6e_JaffaCakes118
-
Size
1.2MB
-
MD5
dd73c2aa70f0b95df8c81e9e8c4d0f6e
-
SHA1
28c2d61df9c0890c6af27959db65f29c14aa7b32
-
SHA256
96206cd468d7e6a316de5e71ba3135ff79372a060b6141dc3711d36b41665bb1
-
SHA512
6dc25fc37051deb85e1e4f54d455c56c12f3fc8bc374f91b2e457cd428ac03c48a979d2e9c937c92079a32c535c1264d4ec55870b005c904da301594337ddaad
-
SSDEEP
24576:r9GEYmCtbhbYjXHhyChtJZdKEDJVzlY9XwK2PDA22BLy+jsScPWRQzryjM:r9omIOzBz1ZdKE9I9wsH7jaPrUM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd73c2aa70f0b95df8c81e9e8c4d0f6e_JaffaCakes118
Files
-
dd73c2aa70f0b95df8c81e9e8c4d0f6e_JaffaCakes118.exe windows:4 windows x86 arch:x86
29b93bf6253c6b225e58482dc4d1dc67
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
mfc42
ord3092
msvcrt
malloc
kernel32
GetStartupInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
shell32
ShellExecuteA
ws2_32
WSACleanup
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 858KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 245KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE