Ԩ�(�$���"��ܶ9����@72��W�AF�+b ���! څcz3���!R>����B�l��@T�ΈZ���J�IBJ��t��8�g��!*S����*��<���}J���4��{W�ob�=�����<�t��1�Uü"���D�����)MqέU3L�-���ŷ��DU�4ǜ.8��a/��K�jvDڹ��q��$$S2�����N�Nr��������_��?�~)�L������#��(��[]����M��+��Àk��U*���F��Oy1���̳+s�n����_D����ب��+�!`B�+�necMC�Gá��.����vvZ���T��kG1g���{#��c4�H����%��������II:[EZz�U���Q�N��۵e3{^\eUuZ���&��)�>�m��wy\�S���i�o9BGZ��T"�������#[�ў��v�sa�°���et� ��Z�����^�e�*{�1��o%'�ܷP jQ-'Q7�����Ъ^��l�)��Ϟ��MO�b��X�-�Y���zAE?r{�e��38ĂíVULs3f�Hvs6Oީ�5Ž���<���F� �C�����U���c��z�O ˬ�ڲ崪LrU�z�u�h&H}����t�cB|8`�A���$�w&�x�_GRb_F�g������$� �G�T�EB��s�2xB[���=0z��fk����e���J��U���f� ����Q����8p{aRЮ�=[K����0��O��~��_I:^,�1b ~���8��vFQ�_�¥�I��ISpݻok1�˯��L��m�R����7�I ��'Sy��N3+��&4T�ېҒܣ��9����+���T��}[R��u�ϒg��#���v�䉠/��mD]���џ�k�����ǫ�~�#��hw� ~< ��&� �H6�r���!)�� BиiQ�<N*�(=��T�2U�=q������SZ��G"�A���,�!����i������o�>7g���6���qi�Br]�-Bn(��p��B~����f�|x6t��T������˦�Ϻ�����`�����9h���S����=��E3dg��<RQR�ly�;��%n�:wy�Ha��xwݚ����~�.�w9�4����0���.��uc z�K�?����99=�&.�^.�����7z[��Ƴl��C�4��z}/t�0^٧82 ������b ^���"G;:yC��xpH.R�o$�yB7�PQ�X%�}Zt��I\���Vu����@P��\������ֳ�E�g��B��1�х�.�yY�3~��P���rˁH:�^����B��r��\����ݿ�^J�,Sm.��Ҥ)�%�o఼����hSv�z,jE�q5�ٶ���߯{��U��'_� �p�ꂗd�j���W��3d�C��_<�4��{�N�'Ϣ5�����p�uI`���cǟT�<!��=.}T^1��Sy.��{°�D֗B}�{�qȖs�A�/6u���I�A��8W>D+es���[7"F�Ů�L���'i���6�?�n���~<wM���}ka^Z� ��]lk��7��@/GT ���к�2� ��W;%�z[���R��P6HlL�!̫S��-�% Vɔ"�S���� 덮��I�,�0'la��7�t/�$X�W�G�v��<D�����z�F����7|�5E��a|!!�=����D����\��?ST^�X�2.������@��t����֢�3pt\�W4Y�s�.~3����� ���/�T�9,_L���wx����Y� �P�>|��a����s���c(ԩ ;��ZG(#8�/\CE¤ec��/��{�%2դZ6�|�a,� 4��L���qّ#⽐v���Ef[�����UK.��-�1��9z5�^ɣQ�Bt3]R!SGU߉,�?~E,��0��{s�����7x�P�7�y a�ĉ�C@J��I,��O��gF�����ҖQ��݊���ݣt�x~>�_4*c�W*�>- ̗����%����:i����U��z#py�5wn�2�+��j/Y�� 6�S���sa&�3�� �֣*QӬ��Ԅ^�C�:\��@�+0��*��g�$e��8�/���Qܤ#���iW�ද�|Q���z�������e$��k�_ 4l���M���#�h��>0:̚ -7�7�akk�sRLe}#v�����Ml8DrDI���&u�T��cIm�?C�l`l'cƁ��duS�$wf��$����7�d��& ��R5Dcc?B�%ŎYL�v�d}a* C�s,�.o���ǻ��>0`�v�BlCrJ9���A��2�a��)������p����צ�BJ���b�v��=��{9�V��/��L��?'������B!�p4��s���2���8��B�g�q*�o�P�~�,o3����Z��n1��R�ڎ�q,��n-;��y�͔���pNL��� dIͨ��� 7ѓ���ޓlZ��[O;B�r�u���e�&.q�5c�$��+��VH� 6:so$�� �<,-�`��8���/3�rz����F�hX���ScM�x1ly;=}ݣ�ݬ�X:��~Pe�ﯭ��{�9�ޜ��{{���ޜ��;�m�yRO�W����nPh�E��tM��˭)���Յ��c������ �ʕ3��!PF�xG?B�m��� ڭ�[eP���n?��h��4b0O�^��s-2u�-����.��Lm���������K�SL;�H2~��+)���Wrd}^E�<*��<�������w�l�]�q��� lh�(���ok����F���'^�;e��>}3h�_�YAi��B,x�~� D��i��-a%�y�� �!\nV��cK�|9qz���;G�7ǫ�b�Y�ɯ֯و{��@�:*R�٢��2v�c���xÀĵ���UՐ�<WĤ�y�� ��o�8~�[��������P)�����Fk��YuxVU�r3{�����e]����M(ߺܕ�v:q��
Behavioral task
behavioral1
Sample
efcd190ad5d30f1be5dca2d0b63dec62_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
efcd190ad5d30f1be5dca2d0b63dec62_JaffaCakes118
-
Size
368KB
-
MD5
efcd190ad5d30f1be5dca2d0b63dec62
-
SHA1
a4a147a6ae4f6233c867555326bbe9792a68ce30
-
SHA256
1bed2c32f69122d77b40a9b54f02f74e38837920faceb5aea7238adbceb8dabb
-
SHA512
d0c4f27364b9d8afaae2a70e4b26e41af1b9f83cf244ac871b72db58293c2461a5c77e332408d26992160068b7a5a3c1e83d8b5354cb0b652803621d483d100a
-
SSDEEP
6144:kcinoWEb5fcv3LxBepFEMkCVO0/D9433+an/my85yzuND0atSdJYonM:1CE1fc1UpFbkCd/en+dgeBOM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efcd190ad5d30f1be5dca2d0b63dec62_JaffaCakes118
Files
-
efcd190ad5d30f1be5dca2d0b63dec62_JaffaCakes118.exe windows:4 windows x86 arch:x86
fc6666f18c2288ae46012f43f03c35e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCPInfo
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowThreadProcessId
advapi32
RegSetValueExA
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 360KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE