��Ϸ�##��i��?M�4��&�"�33�j{5�Ϡ���&�!���B�2���2;�/��z�.�����͢��N�Ԅ�UQ8(|T�t�u��tu����3z�S�/ܛ�ܠ���Ȩ�*������3I�bW}����l���c���ZȎd/,��jn���p���KqA�t&��ׯ�s��G*dX����9��}qn��p\����(WI�47�bM������Tb$��-�M��b��'X*,�W�>p��~�C���}.-�g�?��c����̮j�V��}���{� >Đ���8�g+�`�o�7Į����>�e���G@\�<�\@_b�CmR�� �+[��)�ːޕP���/��Q3��'6.����%���(a�b�<���<8!�:��ݞ�>9�^_^�${������0s�[��jP[}ŀ�T��|v��# �5�B��Ov%Ǔ���[�"Ї?� �B|��84u4��O��B뙴���vR�3m�n��`�/��E��1��V8[���u��\��}��� +��G"��J{ ��\�s�0?�hͺ)�U��"R �&���:�q�A�����K]��Y@=b����p��Zc^\v���C����>NR��D�1H���h���!DDj�������-`�n�n7$Ԇ����M��W䈲����|"^������~J�է�/=��9ݾB2?���N�?��V1�2|(�o��$r���/��;�3T��|����1[v� *Q�5�R/�:��}�˨ɚ��g*iy@(���->7� ��I.�i$)H�^�^�-�dQJ4+��C�r����#�U�=��Z�E��7�:�''cB��vfџ����R�U� ��Y毵3��K��E�L'� ��td�Z0��+/�yz�k�����D=������N�B��z��28+d��ٚ�:����<����b�����wz�t�����o��<y5A\:r"��L%N[�?-ԍ�+\f��6�I���/���e��l�{�S�l��!���1iCւ�����d�B��~���?��!PzaPԶ�-�˷aJ����o����/���@چ6�I�PM��R�\̌!D"B�u~y~�����"��� &?ol@��z�s�=���|ce���&���I�.��{���:VV���e��ua�8� �f~�F\s���������m�y͑����=��C���G9��יD�~g��&b�����$� Tb�b����OT���7W6utl�Lm H7v�MԄ�+w�6��-+��[��9���Hfk�-Ve��Sᛀa[��+�>rk��<�2�̆���yb?��.hMOG������h���~�����R?s2�����L��&�����#<Q]lv��Q������8{��މ�l�� �}��p��)�yT�=��o�1�N��=�&O=o�Ne��od��0��/���a�{)��d��7���h���2U�g;����-�B�Ĺ�]T�k&��Ab�����a�μ����@jX�Q�������3D��ϬQ[����5�(��I��@}��̜����0s��za稞�J�Hb�?卩6�\݂~9���r��ih�;h�5�?� VM��T������,��SH�@� ���_�;����;Vd����B$t�QeҀ�v������eX�X����Q�%��i|����oo.R'Ph�W0H٬�H��"_���*0G��n�sa�,�jm A��h��9��n3�������>�h9���Ǵ{�a���F�I绝� �N�\U��;N��Ё�+��˄ �\��pBr��'�+�d�:^��[�sF~l=@�F�Ҷlu���M����f_\'�lP�����*;n�*)Ŀ��l+Ƭ�'s,j���:)?�6��_ӿcD�E�&0<����˕���R�Ҹ� �8r����ʣ���(.����{p�F���C3��츖�(`Ht3p`îYڀ����K�K��<����nh�3-t� �fs5���Pl�:�yuEV�턚Þ|�{��u���_,�~!�J��0�iO�^��?�6i��W��;�,w�.�&��Oy��T-���(��߇'����'"��ʾ�{��S�ݐ�K���cB.wuP�;��C���;��};�����:�6٫Z0�<������*�Z���=b���x�h�lt��a-��'t��w�C�Y�|sC� �:�p,�����I��)�0����2�[҅��= �Vc�q5�)�'�@�p�o����␇�'���ke9s��k��a��=_[�uС\�O�^�ٹ}w�40�<���:�%�6�����C�&� Z&� $��B���j���> W9# '���h�40����7A�Ī�I)�k'����e3B����(���\ �!c+�ș�I;K�2� �Wl�<f�-I��=�y��P��k�����EQ��A��̀�m����K��Mw�CSϪӀё0z�%۸ ލ�r��0��K^�����GEaE7M�W2�0z�6�g0�O~{��}'��Fm��'P��'fWZ5g'-�W���*0����cI]�2_ �����K���[��F{9!��(j g�L�bvl����Ϋ����L�@qq �32�y��KD �r�.��A���n�㯭��k�R�2S:r�nAt��ơ|�T�H�^��#��H����;�8̇�{��V�|�ڞ� �#}v���"^v�F�#��nL�{Yr�r��1�"��b��O@e�C)��E�X�e�AN������<�|bܥ^^zI�K �]����Jb�u�H�r����������v��f�`_��sJ�zXb���$���Ა�c�hՍ",]��HU7�WfNs|�-��]7���OH���$���G�X�c�8�R@��7i��B��-����I9��'P�������v�V d6�l�K���F~`'�n��u�a�^��� 1�d��f_W��l�:��=|��L�4�l���lX�W��E��l���V�Fà)9ۊw�W�~2IbR�V ��Ujx �\z���z:��6�g÷��-����w�B��U}��S�1
Behavioral task
behavioral1
Sample
df83664a3bc949ba4803f3c9dfb0b308_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df83664a3bc949ba4803f3c9dfb0b308_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df83664a3bc949ba4803f3c9dfb0b308_JaffaCakes118
-
Size
2.5MB
-
MD5
df83664a3bc949ba4803f3c9dfb0b308
-
SHA1
1809446705341dc57bf522cc296846fc97ecf9be
-
SHA256
3d825e5873252b7d34ff11ebf192ae8b87838a135d93ab29d7c32ffa114ed2f7
-
SHA512
5677a15995814d48b40bc98e8346ee53ee4e66f7dd237e3456b1e1a16e83ef62305b6928f6b5ab073d64d3b90c59c63e4f96cd30ea82afe2f8e389e2e959d3a6
-
SSDEEP
49152:0mog7BkTXW3Tkln2PoKbABHcr4+cJwVzsdQ/SqLjxQRs0/Kf0Xb6m9Ffx+Y:j17CTG3TKnGfABO7LKRsMNumzx1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df83664a3bc949ba4803f3c9dfb0b308_JaffaCakes118
Files
-
df83664a3bc949ba4803f3c9dfb0b308_JaffaCakes118.exe windows:5 windows x86 arch:x86
53d56d237ee126f189f380a5c67c468c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
CryptReleaseContext
shell32
ShellExecuteA
shlwapi
PathFileExistsA
dbghelp
MakeSureDirectoryPathExists
ws2_32
sendto
iphlpapi
GetIpForwardTable
wldap32
ord301
user32
GetUserObjectInformationW
crypt32
CertOpenStore
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ