��" I��^x�pbVB�R�;���5v���"����f�D3�����U(��!MM4 ��"�e�|��C�b�����m5f�����"C�s�ơXGHXY<ȵˮ-+��^8�����7���n_L�h���-M����p��a|� �Y<7����X�B���� �l��Z�c��_y7g����9�!�%�R1�+�$ae �џ���3���S��`r�aaݶ�.��T���\7��ݸ"=m�5����W�������Ʒ�à�N�f�={���-�ͩ<��ߠiCYp�]J�t�Ó��F���hI"w��XT�%@Kv7���Es���7hQ�ړZ����M@ ;��]]�n�vD1^�&�����o�bcs�)�,~4>�۷�Ŏ� ~��9��e8j����&�^�S�טּ�^�c}� `�\:^#B'x������ <�X�운��G8�֣��<�o�rR����3��N���F���@�/��xs����l��L���?�K����4��&�IkY�_Q�ى�[�xz�f5�y����z�]�K���i?b]�Y ���t�v�T��@IFx+c\ ui����c�a<��!�cCf�zrS�*CR)�&���߽9�ީ�ȩ�Qz�F��a�@�Z��=�v��B��1 �\0^]i=����(8B*���k���Ǥ�����-��n�α���=�:O���� ����ډx)�fry5S��]�*4X�]�[S3ml�A?�D�uJx|�`�wK�M3���+<���P\�B��2�ƌ�K.��p��p<I���!^u]�{�0��7�9(SΝ0g%@N��>�{��5��X:V{�,��˶�azC�`�MK����Rx��<9��p�k=�Nw��c��H3�L9t�� hހ�c�L��s�N���W@#���Z�!v�;!����i�ֹ�dK�b��r�soY��m�f�����`�M��˚��@lr)j0�j3�W�A��m%�a������˝�_�p��"^�f��_�gf���ć������>�N �34Rd����]b{iۧ4h���#�͠��O��*wL/��A���|��t��!p΅͛�k\�.�2d�̙p��I������p�����d)"�K|�<^��"���&���� �0b?����.G7���ݜ �2��:u�1�����F�Zh"��nF���σOTc/������&>~��]3�6z1.�XV),7�W�:���l�|X���ܳ�q��csyгяEko9�c���E��(?%�h6�i�����vԌ)��A8������A��lñ�謲ui�b��o����(2������+S�A}��#?��v���KF8),��s8��7�8�� ���X��"g)(� �SL�E� ½��F�����fih_�Gޝ0�oy�fsY}l_��x(�qC����ĸt#f�������D:쾌�眷{XX�����=��Ep�aF�.�F:c82�*`6��+�Ja����0i+2�T��ͿD�Lst����,3�v�/ϷzTvM�G�rq���1�(��+�m��m,�&B����55��� P��kuV�Zk���FR�E��%8�[$[]�͠�24[ ڊ,*�KP����`K0�)���1��@���x��$Uk��һ��I���9Q_C"H�R����tl�,Ѫ�?-�8��s@�� ]N�v�����_O��g��y��������}���j3�t?�Π�vO�y?�Aj�n�|�F��SZ[�keC�V�8�}��V���u" ����d���v�!K�/4K�^~�W���J;��TȧΪ+�b��2��o�̄��$H��>�p���|Q5D���cY�z���q�WT�qxP��Y�XQ��1ž�Ų�3?;\1��G�����`��!�#�o�V��ɋ�����l��D�Ml���$N4� G�KOQJG��/�!`��!���> ^��dOo�������%�������^� ���?Me: ꟵM[���{'����J��������]��w�q���3� @+�����L:`zM�m�j2�-�_L�W�����reVk��:�B�M��"y �c�V�GF�X��q����<$`U�������x���T3:-�ӢH0��$��X����1*��+��.�xd�D���_*/^��O�&���K�0`+�bH~�o5�ɭ���M�" �8�j�nF� $un��j�=�n3� !I���(z�pxv��v�&ek~��⏚��$��c�Z�$BJpu��o�KOv�1�_:�e �ϸy�<u�K,6�uo��(B�N�����5��W��Lw���*ʎ��@����F������*Kx��ҕ�4�@�CT@��X��N���c�B�Aϑ�b��p���������I�U,y>g��9�Aw�t����k������T�) �fu�ƹ}J���^��'��G�a2�'��D���u�҆>Ob��Bi�������@�\8J|�q�W�ou����4���>n*!c�ކ��84����_m�k8�XiMU���ys�Ui��e�9ˠT:`d������I���v���O:�^f�n��7�'0cI�Jۏ ��=���uX�sW�x�����l�vZeW�P&���y��OD�^t�`��1$ D!��~��?�O�_��.���o)��9����r��2f �X�0=��9��^7J ��T�]X/P ?��}�kh'���u��mzE}%@����0=$�G[�2���)�f���Z�i��Pu�H�O�ބq$���� ����u��L�o����Oߩ��$6λ�~��l��_�ҹЖ������t�twj=cI�AnƐ��N�Ӂ�Y��.��t�I��z0�3�������)��T�@��N���1����̀n��8h�pGR3suB!)�R"�fx�0l�گ����ɋ �&'� &�;�/�C��{R)��T�5������Z��-Q�R�������rdqGK���Z�및c�M*�3�t���J3<�5��D�P؋�\gh"~=�+JM�<&|���U�=�o�g2����.�ވ,ծ�*������ȬЃ�j����-bA
Behavioral task
behavioral1
Sample
df944e4e1f4db9a4bf705511b782f6ff_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
df944e4e1f4db9a4bf705511b782f6ff_JaffaCakes118
-
Size
824KB
-
MD5
df944e4e1f4db9a4bf705511b782f6ff
-
SHA1
b83c10958f2925a1a460dee8b2ff6df2d278bec7
-
SHA256
6c1fd9e5d713b4ec9265317e512145914280abbde4ddb464f93371c95e5347eb
-
SHA512
895bdb79ac713df419c071d0113c3cc9c34d161d73bba1392ab73261b54e067681d6a3243ceb371e2a0cf26cff800dda972a5a287b5e740c6e216d7a4d1fd5de
-
SSDEEP
24576:IRhGXEiUEzrhy5OASpKOLHhy23OO65fJ+5Iw:fwArCOL/OZE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df944e4e1f4db9a4bf705511b782f6ff_JaffaCakes118
Files
-
df944e4e1f4db9a4bf705511b782f6ff_JaffaCakes118.exe windows:4 windows x86 arch:x86
1ce52526b58e63244862864d44b37532
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
TlsSetValue
WriteProcessMemory
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
Exports
Exports
Sections
.nsp0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 3KB - Virtual size: 664KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 819KB - Virtual size: 818KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ