��q/UT�}�qp������ߊ��O�U�������z�ƟA�2�$��jm��8��Z\�+�y^�i"7�k�����Ӥ@Y��- ]�� ݄D��h�S��̄�|�)����>�{l�V�}��g{��K�Z��̑���"�� �"�Q"���鞟A���h����3��^���kds��������f.��/�h'���Z�,�eI�.Ǎ��> P/g+�NPQf&f��H;����8hB��`*�R�H"�/b���&�ߕޅ'��l�+�P)ٶ5�^��-}��y�s�]g���z��&��j�r�����O���b�7��RY��7�h ��$�<y�$*�����X91_0�/dߨN�x}-h_.�<��f����S�5.\���Kx�m�3`qTh�Xz�%vmX������_x�g��������7�V��*;�{6o��ب�a7���Fv��a�xj���$��=��m�3����y#@k���u�#� ������gZ���q��x�KØ�E��֪ܞ/s#��6,"�?ڒsjdi�<�#W]�?�qqӏR�2uD4�6�O�q���?5b4ag��3�p� F�8�����pF/��6DPӧ��' ����.�Eh��;�|�^[iLj��q e ���2W:�n�v)�:Z�$��^�׳܊�-\���E�@�Gn�{A��6"����y�}Q( ���ÇF�r����e&l4��5bX��3�c�E�����e�]!c�g��Y����NBn�O<x�8v�Y~�^�����<��|���s�z���yǎ��]NS�[ܳƂ��jW���#�jC�N2��/Ƿ�+�Evp��MEL�4ի�,��"��I��[on�*l�!��丧F`�E:�> �(�~%L�藮ܩ�;�B�on����Չx�Wy�7��T���k�7���횷�����m �H'jz�V2 ���g����k#;�Z�u�H���DS~�ސ�W��c$��rXz��,�=]��cqS�����4�D��Ofb���0��s��7Y���>�R+��_&/��&"4��ą�3=�1��1�9=�6��˖��j����npj)C��dsVf��ƥ������)�S7r�BU���#/���h.�I^w�����sR} ҙ�� ��]}p��o���+5���;?%��y�P����� ����1mȾ0�?m�+�V=�6"�>�@ʐO�с���%�� ?�.D�,�e��<���Wd5˺1�W��ɀwKJ�l�����@�7�%�h�@B����G�2Rk���L�B�������e'�.�V��n��/���"��ۉ��f����Q�\U&��J ���D��[9����n�Srj��+���}{�̣�6r6�h�o��^LL��g�/'��m6����R�����Y� �����ڝ���S��W�@��T�0��<�2���\ ��a�>Y�%����K���y1�!�� =��sN�ؤ0/>��7��mr�Q����<�XE58_�J�o`�F-���4 @Yv�P�ɸ�t�NT[1� ���F��dՀ&�Z�EE�[�'��dMz YW����^)�Ͳ���gV�o���I�G���ថ!�B�u�NX��f��E_e[����^\Yy��G��dkNd�#F�99P �����8@�G��ϭ��X�TDyXa1�W�௨I�V%7�݄Q�[��\z5��RH:�I���fv+��<[�m�u��!����yq@�e���p��^o�bA��'&���l�b�L.���MA&�B�4��sx�g��!F5G<9^�����Z'���2�v���ekLx!�A�vX�K s�ڍ��-�)N�������ث�m�\t6����z��ccd���S%��m4�}�7�<n��u +��q�^M�W�ڴjg��=������\�9<��j'��*�����+-�����=�@K�c-Q/��5CW�1ZG���ܨ������ZP����?iq����sxP�=Y� �e ����'�^�4w�@�y.u�����@���;�V^���f�u����5�Gt/˕����)��I��N�FV]���Љ�������¢���ko��7UX ���nĞ��DfKkDbT�S7�}�2op��]EMkRb�_�TQ`�::�j��q.@�������i=)`���a����Y/D�����А�Ȗ$/�P�y_|��k�x�z��6��<D���b\7 G�bX���8�iX$.����|rj�Ww��<�y�̆�m']���9�*�v�����5OA;B��V�O"��xYC�\��X������H��5�YZ>զ�������ެ$��E�5�"_ߤ��� �A�;������|��8\2������@ �[�=�'�3��V��E�=��e��*��3 !� [s���0Ɏg�6�/��O��1Ao��1}���Vب��&E��Ni�N�?K,GH.�@+5�*��kމW8X�v:VF�:�r]� �M�ʾ(\]��<;ӿ)����1{?{�s;�h@�����2q�O��p)Q�>�r���b����;5?4��<.5��S���Uk �T��5V��y���Xl�N������i�,��P�k3���Π;܁'��#ȵ=C�YӔ}�E��n�� 䥒��u��Z�=�,����h���>�9����ĥS�:�����}#���R���Bz��'�s6��<AO5T@:���h�(�a�fr�� ���Zg��>�ܿ�*x���[#���k�`�B Z���H�v.!�g�z�S9偄�v�(��Yy��[yJ���z%�ϝ�t�Nsp0�V(���$�QN���Q��k@RM��]u�|�K������l��_�� PE����_1`�NI��1�T����O ��"���i��p)4}~ǭ90~a��VD�9�.��Cuh���}7�?&�9r'�痿N�y"I���S���l�%�E�n�k�\N���,]j:�Ra+z��2�9�����r��֍@���P�D�w��M�{�>�j���g�Z��D��3]]8^+��ɒ;|_��}���̵�� �t���|&���f�y�t����JК�c��
Behavioral task
behavioral1
Sample
e27732453d8903f8ec0e1cb8860c5ea0_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e27732453d8903f8ec0e1cb8860c5ea0_JaffaCakes118
-
Size
5.2MB
-
MD5
e27732453d8903f8ec0e1cb8860c5ea0
-
SHA1
564c756e2a6f4a36b4766951a943f8756354602e
-
SHA256
af228920364b21bae200e701f706fc09be06dcd0f774403b3675af0c95825fba
-
SHA512
f50a2e67d3ceab8d58e1299e65079332372d89a624d1a08664405424a4b9be82159d846fe39b9af1bf39de02fbefdb5573a1a5e1f1e5e93f0cb6aa24976113f6
-
SSDEEP
98304:u7C+NqKpC8oRyFBgwizD9oaIPRcqdOrR6OG4N2rxkXiE/V:u+o55okFBSIKItYWxk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e27732453d8903f8ec0e1cb8860c5ea0_JaffaCakes118
Files
-
e27732453d8903f8ec0e1cb8860c5ea0_JaffaCakes118.exe windows:6 windows x64 arch:x64
7cb03873b60a1f3f6f00195216dd1184
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
urlmon
URLDownloadToFileA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ