��Y��B��\�Ań���V�'&ᘷ|@qKz��yD��`4�e�)�=���F�a�%5y� ��VL��8��{�:)�r�.fk�N�$�j`��0��˗��'E��I\�y�S�����H�����z�mf-���٤��,�Ȫ�� u�Ld�#?7!%w2U�g�'�5g(3t��Aڧ�{��~�7p��I�N?��0�@|57����p�L� =v:�XU�?�!�1��o��ͻ~в��Ɏ����r��|�Y�<��Νn3�q�����7nI��Z;��6<���)�۲Z�c6����S��n楩�n�+�60���U�iI_�K*�5���rZV���C����6��A��(�3H�H:���8kzӓe�<���\����h�/��������r?�e\E8%�ݖM'�.��Z,�P'�G�0�3�KX{i����4��\�#u����w�x$�-����,x�M����:p]��A�y_��{��b�¯�(��i�䞱 �kڙ�l q[Q�Ë�� � F`����@�Z�i%[�� QCY�㈭�Z��!��y�ܗ� �q�^�R��"b��ψ��g���p5�C/���!ojۻ,��}O���8o��0*�r�S�=�G�� f�H� i����X�'�S6Uk�&/�����c]p ˖/h5��������rn�g���G�� �����=�X���Q�cS�Ю��ծ�ȳs"ӟ�����R �>$j�(�&1��=��'j~�0�_��Q��r@=��Z_<�J뼃0H{���t �}¿@�A6���K1�K��9{���,Z�T �1�������c�<�Q;uU��)���y�kꅃ��U�%�m���S���:�� �4/��8�3�FR��]�-HC�%#�cm�������"��|����\� p�B��T�$%�OX��/�Hz�#x0�^��r����[�TW ��Q8��1���L�����ud�E� �]��ĩ8�����W�ނ���.&�� v��M����"-�dnk?+el]�}I�k��S~~������Ay��/:��� G�l�N$�e�����D�ke�y� �F�#�:��P$Q��� ~����� |ל��s�D�|�ɔ��قpp˄��� �L�~MPD���ȇA�5�B o��mF?˂ym�u��[�8�k�_�Y��S��a�����U�%��r�l�(�D�l�����/����,���w� k$����Ҏ|W�F�BH��#>��)E�e˘��v����k���g���Wҥ�HܶZ�¼ �+��pL߯D|��:��5�B���ZFK�4KZ ����?(�����1� ƅ�D���V�ٽ_k̛�-2���ǛII�r�g�㡕��Ń�>�C�Sq+s��Fz�/5FۓW��pHH�wW":��a�4��r�/������\i�|ً3����u/V�*:ln`$� �w!Y���O����� ��z�uFv��S�ނ4n,R~�^na\7��~�@vPz�j9�nvy��� B�\F����b'P��\O_������8�]e�e$�l�q��`�f� �4�9��3��&���l�$_�%���t;b�mӰ(2�������赶����eB��8��k����~"����kE:��yq��xs�d��UI�����y��$a6�dh-�Q�u� &ǿM$t�/2i���Xi�ON�6����g����h�T˘c�`�W_����G�9Yg�HD�C�� ���Hp���8��ɸH��oPƠ�?9���&�b�+���#������������+�N�#�S�-� � �A�# �;�SY��_���4`p�1�1���̓P+��T�1��ү��Z�R��E���y�k�����L/ӒZ11w�Zl���ӛBV��(������+9��z���@�c]�� ��=���" 8������Ȱ��i�����B������x�w���<���Xɤo�5`̛s������۪`�b��x��{�n߂k2���������']�1a���"R/T�R�7��G���O��^d(d�QM���X����S�M���.W�doT^����lQ*]���g��[�y���R��k���(���CU ��K��f��4�x���>�:ٲi�i�T�:�|�~�+��`f�����~�"��W��i��fy����!�~��ROdQU�]���,��(e.x/�S�W����Eo+�����%�A�Nj�x���\@�׆O&�3�~�~-��4��ê�AN�Ȁ�XJ@�[8��'-����1X��CXB��Bw�Upƀ +��}%|��X}��z����wO�0��������ܦR��ʡIl��Ѻ���v�v�CD2D��.T�gq�����YJg=�v���8�0��O=�����p�����$P�L ����nA��P{�2�]���x����>`�@=�V�]�cj����R��d[Ԯ�������H �����l:��Z��~@Tj���N�T.и��hWY��P�n�_��P7O���5"8��')� $ �:����_�n�<�79�V�?0�7F���`��_e����)/����o����=�QF��1�k�m�7��|I��P�;�wWk(,�7��؆�y!��S�;!�rB|)ؖ���"���8{k���+�v�Mq �����U�j�6ӡW�.�E��0�=/6��pT�β pLo�O��B"�U���>Nt!!P[ %,��#@��8�/Mm0L������7^5!�=�h�,�|����X���+�m~�V��eʮ��t{��F^o��A:)bm�� 4|�!r�|�踔 �qO@�bik��p:Q �{��9@��UZ������u�&���~�8�����p�>A�Ij���&���!�^�79���v���W7X���5jޯH@!��N�� P��4tz��� �^������]k&ơ���Ԑ�s�v.o�����W�q�=��d�-���Ϛ��O@<�c9?���=�Gvǻ ��M)��k����|F�3�'|�Z�s��|�J���)L��n��NT��H�4��[�И٬`6 ��y�0#�{ܿ�4��>3^�|���d��L��ň)�����}��]
Behavioral task
behavioral1
Sample
eaadea7fd5b1de48f0c250f0f551d9f7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
eaadea7fd5b1de48f0c250f0f551d9f7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eaadea7fd5b1de48f0c250f0f551d9f7_JaffaCakes118
-
Size
418KB
-
MD5
eaadea7fd5b1de48f0c250f0f551d9f7
-
SHA1
e92a7ccb76ef2019954e41185a1c904e2aea25e3
-
SHA256
e5ffec7953bdc23f60b999c0d61551c2e0745e824e36a00c6f6fc5dfd4240b6f
-
SHA512
0f19d6ab9ed77e97a3e4c3fcd3acafd782a686cc9d5f55711627db1e12bdb9904ca2c5fdd38dcc218c68f78449d828ee41620545af31e2b4856ded5a52499dbe
-
SSDEEP
6144:tVSdQal6RjoZorLnMyATTgxKiNaq7D4d2w6Tl66uH99QJ6q/Yhoro9E/lWG:tVA6io+TcKwaGU9eLisoSYhuo9rG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eaadea7fd5b1de48f0c250f0f551d9f7_JaffaCakes118
Files
-
eaadea7fd5b1de48f0c250f0f551d9f7_JaffaCakes118.exe windows:4 windows x86 arch:x86
d4bc4aae6e6c08e110710422ec3974a7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
TlsSetValue
lstrcpyA
Sleep
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
CreateWindowExA
MessageBoxA
advapi32
RegQueryValueExA
ReportEventA
StartServiceA
QueryServiceConfig2A
oleaut32
SysFreeString
SafeArrayPtrOfIndex
version
VerQueryValueA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
SHGetSpecialFolderLocation
wininet
InternetReadFile
ws2_32
gethostname
winmm
waveInUnprepareHeader
netapi32
Netbios
wsock32
WSACleanup
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibDraw
Exports
Exports
Sections
Size: - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 352KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ