-?W$��Vz�P�w��+��[���C�������=��=x���9�X.���9"�r�7�_��E�Q�X����:#���î`&k� �DΥd�������s��h�4�T!��ԻH�{%Ōp�;����ʠ����5�m��1������K@y�����P�r����I*7���!'���DA����[u%lB�6���T405�;��t4�2�q~��y��S7�@ �P5sHRw��=�E���C���tD��?�rÇ�٣���`�s���❯+EAQ�U2�E���\�]Z��̅e���,(g@�.#$`+S$�wEҵ.ޖ'�Ns(Y��O��I��ɜ��k���8���0 %.��?G][��$U/�'�w�� 1���rt�ק3��E�o�6կ�aKԐ_KN}��sI��Mn��- ��xv߱{�H'�O��~���2B��8�����މ?bX,��R����(��e�`<��c"ę*���:y쑯���|�w%�����K�a'�|K���Ia.P������Ν���a�S���k��V� ��/z>;zQ��o%h*�OƆ7�طZN&��8l駤5�ܐ�J�vT�*?�m0K�`���3�{���BS���к����f��C��p(�8u�g1O>Ό�:CT�\Η� 6�i�+(�b�÷�PU%��I�z���'L��&ZI�2��e b�qj���VGo( )��50[�@j���f�yr��%'Ć��M?�ak}E�i�N�6��=㟫����8q�p$8,{���甼 WH B-il��ɩ�m�;��"=%�z/����Y=���}�=9��C��{i���/���i��Ie��#/��`��zƂ2��`B�s5�������Md��sl�6lKa�qq��E�P���B~@ �i{w��w�@{����3�Ƿ�$S �J�J�����.Q|���j�����"_��+��!���2pG�;���H���Pt��M�S}����K*�B�I�6��t����[�E�,�hI�FA��:g��7K:�G��CF�Ag_P�y�S7g��Qߊ�$MM���k�#��Y��Y�O��;�>�\�N�(%�'�h,�\2P�D>�P ����~j����F���R0V�*|�~�X�ù�nS���?��5W�(���m�S2o̒Q)���9����$J�@u��&��mn���y�����r} �(�S#�?Qd�����[J��J��8�_���h��S��O)a��[ka ��E�_v��D����� ��w�y�E!;��X&n���4�*���ꄸ���6n\Kq��cS@����?�4����Ww ���9��a0�g�F,{�K,*N�땎1�h4!Y��uJu8�i��Az�9 �˚��q�����_g������(���(2m�EhN�h��Q��zq7;1������_B�{�ģ9c����v�uD��&�|�N�����& �F���4)>�,vq0"����F�M���q��ԫ�z`���i7[�H*B8�h�8��� �ak��>�m{�� ����r�����/q���*ʺ��|I2��9������"&� o*��_���R�MI���E��`�Ө�Ջ[�p��Z�y$���$���U����B�\�����AP�ς�-��W"��h���e�|MDu��B1䄵w��0,,d��tı�6�.���} �zA���Vx�N'(�!p��c7н%�4�T�|u�RR��>͚�,�vI�y��bئA=�n~�g+]{�z�f���Hw�`Պ��T�H��N���`���� "�>�V�X��K�4G�С����e�{��$�����e+]�_m$ ;_�����א}����Q<s���?~˙N|g���Fȗ���3f\rf��3�(�7��ʲS��������#�R��m�A0W�|�4�ʼ����,WB�mL�E 7�}r(�q�8�Uo�|����B������-�x�����1�w bn��k��vy�9&��6���bc������!af�Xj>֣��^x�&��q��^�(��n��e���]`��\�%5��xZsZX�vUh䣹������ hoʠ#�(�iE,M��*N����M��)�ߞE�>�;��Gi���\��S���K�Y��o�!�����3�̓�5�=F�����G+�麋v��e����w����<Cym���w���h{��7se��E�Y��0X�ޘ��g5���l.&� j���<];rĆ h����L#LaH����)b� Ə��T�.v<��&4��"�8�b/έ��-0��ai���������ss�B�7��i�Xf� E�l��/�&�4v�r�O�A��RSP&�XY#�o)�ZI5���w����^j��1��@�$ѭ^��2�@1ܮ�dDM�V�}�x�G������`��Ӂ���)˹��/\ƱX�Ax�W�F�����O�Ae����� v��%kz\�[U_9^�s�Xo7~�p�c�:ǣ�F�{�E���p�چ�i8q+��e'�_��K�ZFE�����u���춉�{f8�����%�]��������'qp�{�72t���إ���}���SdP�z@*��� ��t�D.:�������^�nE��{�S7��� }�����:������8 ���?���O��{���z�b��[�s*��l`����L�GT���8X���*�q���t��xG�dSL�n��S�Y<^<������ҰWW'��B��į���� �lP�0�/l�)�d��`3�������}L�TJ������KD�:�����`]j�����#�eQ�Y]�ہ]��>5d��3:h�T3�i�5g��8�{��w�X��V̅fB��<w�?��q�����Lo�8��@���S���-J�Ҷ�����N<g;GqB��b+���$i� @�̵��@�d8���T:а��Zd�W�"��0�� ��ㄸu��p1FR�b,����}�;��5�o�LKXjI� ���Y,�仑,�{� �Z�A��J]��ۿcn?�h�n�0���I��l Vq�p B�I�DO ���Q��`�1��<��v*(S��1?pF ��>
Behavioral task
behavioral1
Sample
df513487acc1774c02a3df852127d734_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
df513487acc1774c02a3df852127d734_JaffaCakes118
-
Size
732KB
-
MD5
df513487acc1774c02a3df852127d734
-
SHA1
95ecf5c91890ad67599a7a64efc6c1dfce807267
-
SHA256
f93de9b3718166817b8f3b1feb9274525d1ebff4a74fb040a0736afc4f093c46
-
SHA512
4aa8425e630efb0a114d82786352ffde9b3f81304f6fab3f1c03a03c6adad1f40aa9fd3c7ca538e93687a044ee136d8e6a65b78a25075d563294a766523a9a15
-
SSDEEP
12288:hbWoPetf+Z0UjpDwCRJxKIr1QcgjHWQ1epqR9Blzp+QQMfae8P06CBugsSCIf:JWoPwe7pDXPoIr1Qc+UYBlMySe8P0RY/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df513487acc1774c02a3df852127d734_JaffaCakes118
Files
-
df513487acc1774c02a3df852127d734_JaffaCakes118.exe windows:5 windows x86 arch:x86
12861ade57a01cdb26a461cfbb3b4211
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateRemoteThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
advapi32
AdjustTokenPrivileges
msvcp100
?_Xlength_error@std@@YAXPBD@Z
psapi
GetModuleBaseNameA
wininet
InternetOpenA
urlmon
URLDownloadToFileA
msvcr100
??2@YAPAXI@Z
Exports
Exports
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 652KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 730KB - Virtual size: 729KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ