uv�c+�`�<S�B篳˰��*j������b���g��CSsXe��f�LkW#�s7���9��"'��0&fҢ���lI��E���X��3���]}���t���P�yd�>�%C��5�2��[����u�F1>���m����Q�˹�t<�1D�X��iZ$����6��D���G�?�1r�<����҆�Sr8@�b.&j'�T��1<��<'�Sp��Rx�|Fv���i��3� ��e>��O7�V 2d��cW�7��>�f�����c�P4�$/��+��_�?��3xW�hzPps��D�Յ�����_j�,QB2<�}�K�d� ���y����#�Ð+X~�m1�������uݠ���WćG�o`n�G�\9<K��r��AU�w��0��'M�_B#�y�H��S>=�}��W_��.�����6n���*jo��[�k)d�+���alB2�kK��75s^?���~?Gf�������#��~1r�g��b�4��z��P������/�Ϟ����Dx�YP�����6�[P �dErF�*���@�� �J���p��"�F��X|��^:�AZ@H{V���d�R~��t�u��g�4>��`��;V����?N�<'��i�K��8.s확�L�l>A���a�W2�Sz�␦v�����7�W���� ~�D���U�Aq����7Ҥ� �,��K�<p���(*�`M<��^"�N fI�F�=H���2�v����S�����\<|��x����{C��A6�2��I�=�^x���~?��cuc����w��!ľT��D��"�羝&{����� ͌^���I�ғ�5�S����%Al$p|qL~���`UE��� �@�(x�B�A�4x�:`SVҶ�n��!&a$�r��w�GR��D��u�9�N��ZA�NoO�74!U� IN�ֲO�� ���G�]�<����A�<5�^^�4^�8�2*]Z08�����$�)2){G����d���{�õS��$�� �[lQ#��X.�;��6�`~,�dȄ�5����a>��*�8kh�P��2^�+ VZ��ee7�R��!���FwI�f�8!*�5�Ł_y$4�������c�� gj�Eɼ>�)��u�8���<��ZpWM:iLS�ғ�Igf|��S{d4P\���c2R��ު�dq,#������2�@*2K����'@]!@�l�Ia%2V<�*�4��Ǟ�Wo�;�D*�-�@nQ[Pu��Y_�����v�xy�V1_e�%�G6|�b�l� ";�c?<&��n��1�L��������> 验gI1n�}(��f���-����DV�&.N3�'�`��P���5+�5����_��x�G缨; ���,XN�k���rFôz��Ç.����Ph�v�A���zz�����*���6B(���Ժ�L����o|�IK���O�!�J�v*r�kr��0��@�q�����}�%�+��D�3����tx�A��&Ǚ�]���G��m-7�jśOP̹`�:�t�7É��D)��:�$���kVA�q�:f�F�����a6�Sg��}E��,Z*�!�u����\肙��'�U�Z�)ΦBK�E���!��ļsK�������{�h+b)�N_���jMk��"^_ݪPM��*8��$z�:,����%I�z��D��JA���%Z�F�lW���e��Ԉbs#�˹�'��iy��笀1<����fy��XM�NDz�>���%̥'�ߞ�Q*�F$�ym���'5*mv�x�0��1ͪ�}�q���:�).�|��S�T���=��>wM�R �b���q2����]%F�L$���+��n�:2�;3M)A�|*�P�W�\���h�V�I��l���. �����aGzh�����d-a�P�i�<jU�6�_�T�S�J�0B�C2K�F��+��1���,a���?���H|����g5��ms0����T<�� ���#}�} ^�;�˨����]��������m^��' r�,��X̡�)��B2G��wP�UlUE�F�c����� 1�"ۭ^���n�3�H�j{�c��:]Ń��������gDjo!�m^��`dj�jO���CmW�� p�L��q%�I&x�����w�R����7��ѣ_������;���R���+m��/G���r��ևIh�V�w������d��I� � H�� Ğn�d\~6����ܻ���T�o���D&�>nzD��φ�;v�*s2Z�m��Zo��XeO��E���f3��wt3�'�/c�����m�j}^3�� l&H�����y�3=�l�Y((��RO�[t/cU�E�~��Ժ��q����U��@��7m��L)Q��ۗ�˥NF��\��g~��'t;�p_�C�^�A�H����87_�x|h�6�C~P��вpw�BP���g�F��ki��fq�����)�l�I�!��_z � ���\�=�Jy�A]���ځd��s�����I5���Q�gA�UM�_�EJ��2����������C�{;N%��&ۓ�+����$���+����&�FiЖD+)A{g�/�f�B�4�K�ͨ}p�C�-9R<+� ���T�5#ӓSw��t/�ʺ�q���m���ǪO���Ns��Ʌ�6t� ] @�_2�{l�+5zKSL��O��egu]��cÐ>F�Q\�U$�M�o��w���E��@=�������ai��R���M�#Z�������x.[��� &0�SV>���qKix��l��]ߦ#[�W���{6�\���XY��'Ȭ���4˫�n�\��v{$�L� [�Q*���� ��h&&�O���9��r)cpV�����{,<��%�z3}���ٛ��B}>PY��1��J��qi��kM0�n���.�ֱ��_m������^�E���j#��ހ�_����÷i��\�=��\'u�GR�(]��Q;�J*j�\υ�� ��hgicFuL����"�� �[���dF���c�<� }�r%W�����1��r?Tȋ����H��!ѦY2r;H��֏��rW
Behavioral task
behavioral1
Sample
eb5984799cc6a75f29c0b135bd5b63ab_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eb5984799cc6a75f29c0b135bd5b63ab_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eb5984799cc6a75f29c0b135bd5b63ab_JaffaCakes118
-
Size
5.3MB
-
MD5
eb5984799cc6a75f29c0b135bd5b63ab
-
SHA1
6ae1259c9ce80c06e5a0c4f21d1f17824e009595
-
SHA256
aef8ec4ffebe168a8832ab9d8398b3aa1e7629f242c5ca33ed7490b52ab671f5
-
SHA512
a4d3ab3bd0a1d3f03ae696b4f5d74b5296ba25e7c19bc13a3c0e152972b3667fe8a55f57364d6db216ba62970bf9116e3395b00a4435bf3523954156eb4a8c40
-
SSDEEP
98304:nkvSoDSm59ufuWe+XiEa8YmKIrlEJGb/74SyCP6VBw2ATh5xBNR:kkmyfyx+ZEJsyO6T+BNR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb5984799cc6a75f29c0b135bd5b63ab_JaffaCakes118
Files
-
eb5984799cc6a75f29c0b135bd5b63ab_JaffaCakes118.exe windows:6 windows x64 arch:x64
c112de5a5206ba8cb39b7bf009c179f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTitleA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoUninitialize
oleaut32
SysFreeString
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
wininet
InternetReadFile
urlmon
URLDownloadToFileW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ