��������ml\ ��� �l��:G�o�<����ڨ���w/�t|�M��E�nڭ]��R�����<6�]��.qq���r�g L�O1U�~��#���p�=�#+���|/�}Vޫ�m�����9Ue�M���D~2�"��/ŵ���r����S6K0$�Un�*M/�M����,ŷc��w���c�R^��3�<�@W��ښ�,����uy����?�\q��Zy��H�����o�b���_��ɡ�m���]5_t_y�k�w*� u��g�� �Y���p�שq���?�lv� �5���]>N��h9�D���ȂX���ƨ�T=��M��${C�c��p�@_�M��+��70qC�P"w�5.�� ����o���7���e�g����v!Ґ� ��d����B)��j�p�v�����-ҤO�G|�`���F�x�a�.L1���"�Y��B��*��kJ�����X�*����a��ڡÞ�,��x�8�%�����/Pt��2�� Br~��ޓ��Bj_U��6rv�'-�o�j�O$��E�DD�%kv�Xt0qO�<��<9�HJ�!�\M�mǂ�ͩ���W=�m�F/�f7y��'�� -�K��G +7�GC���W8n��}����w*���� �ۈ��4�5Pzؠo�uc�9�V���V� �z.W���AN��|�M��z?��%vd����F���o�/ �+�|�[J5۱���[��t�C���*��!g .���B�s�+ �"m�!�����u��I���P�6���.�ߓ4#�N� ���?��/�%a`L�Z�<|��u�+Vm��n�uZ��B>I�X�{BtY]a���Ҽm��� ��I�MQ�v�y\c��|�����y�_�4v��0��"[h�0�o� P�4fJ���w#�O���$2�zr�s�-�f�>o@�W�p�Uҳ��so��x W�;h��a17Ё}2`�qh�0����7h�Jy5�>�O�w�08�}��:���x�yܱ��Y� M/ZbE ?�a�r��H��ѻ*Ny�w:����4G$F��9�#��r ��/@�^2D`��cص������V&�[((Q�n�l'���g��A�f/��� :A̍dICsw���[9��J!\���P��2E���Ye^��A�B�F����U�%�I87c��$��ލ��6��n�s�!��YP��瘨B�1���:9t��� ��ђ�����07叮��D i�E�&X�1�xt����A�ʰ�L�P�-t�j�wi�y7~��k�\�VYK"����놲���D��`�A#aTq�܆1]j��r��b�G�����4KZ˂w����G �[}��e�E"*`�1�M��k���Eȣ��Hdt��"&1���I������M�)dX2|wT"���%��6�A��N��(�/���>�t��=oɇq�y��Z�R�AsM�&"��"�JܑYt^� T���z�[:��*v�=Eh�3 �L\�B]�N�(!��.�m���U٥�4 ��#)`��}���-���Ț�g\��MG?æ[yqgZ�<��+&�t�~���Z);�V��5"tG�:ȧ wݑ������m�=I� 8 ���Ϗ�1͜-.�����#�pw���47�1�)�}�Sx7m�8 p�gͪ]c�V�VݫEy��:��;D��L2|�qZ毮r�,Y}�?�� ݞW����_-�;��@Q0q��\���\7�Ub��@1XPh��l�06�o#���t��7��P�C�Xo'W,:�Ȭ `F恁j`���NĽ�X�� O�:�2�.g��t������b�Fޢ��B�|>F!����#�����Q�M"��Uv)�_gnGB�m�⣕VC#�oð �����0�b����x�A�5���۳��+i�3���I��d ��?��,aRe��X{+0uﶆ�qnGy����,��}�`֚*E)�^�P��5۷%#<I�ey�����au�*���e��j� 7� C7��b�u�w���'���4 �D�� ��X�A��{ӑ!�������B�(pR������R��HO�N�j�vo�LxƪՑ����-o� T^�7�T����DZC4�e��6tM�W}y>�a�J@�����Ť:6k�aie������s��R�o�k2�m�# �2��iA;O�i�@ʻCYs�X��-ٌ��N��u�m K�A�w�1ҹ{w��?��[�KĮ�H�DW���a����ZMS�Z�����$�A̎�#���}x�B�'�����w��vX\��$�ؑ�|-Q��ڶ����ƽ=!橊�٪�;�;�o�%T����@��C{O�Z�R�qr�x���i��D�/���(�l�Y����t��C8�7I��_F�� �}h��[(shKܭv�e�F��v��[����A�V�bi:4l��PԆ�#��D�ޤ?0�}�����P���h'B��o�.��9��u��O���Yb�\-�{��u�w�����(���Ԏ�Z�C��r��N1�a�f&>������R���1�/�O�����>І��_����B�ta2�t�i��m�+��=�qhB}�kl�?��=�0᭰��d.3'�P�X��E8�k�c�r�Vp��5�b�"��s�H3u��7v�_�%�f��-#��im���ng��R�,�.j�J�o�^낔��B>�S��� ����5_��I���C��� mE%�B�4�'�C��3��F�5���ǂpi���%a,}����-U?9�Ĝ��2�hM�����|�CU��l���&W�_&�=��Bj���(�W���^sC^�Y����2\b�ɸt�rrP�l������ޢ���C�^�@�����ȩ�W(Y=�c:�y�z|��R.3�˕$l�N��4�,�;�W� \.�iZ�w�#�^�m�:�ַC��3έS:�&�� �+� �!�Y#C�{9e��=���&�2���Wzq����(rZ�*�:�މ.�qXxp��+��� ��+Z�)w�c�[v��B�9��Jz���l��hcl�n�����?de�m��k�djzWH�
Behavioral task
behavioral1
Sample
efdc7e6f74e35fedf3302f3b73613051_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
efdc7e6f74e35fedf3302f3b73613051_JaffaCakes118
-
Size
757KB
-
MD5
efdc7e6f74e35fedf3302f3b73613051
-
SHA1
6f521cff6e68e65402a08aa13161e5c7a0ed49ca
-
SHA256
f99fceb476d77332f17c23ee7153cc057cd508773015a884d0ad83b0b35ea0e3
-
SHA512
24c9677aa3bd60d105b0151938d1c7346d155388953893dd1b5d1175aedc396f8fb70a5a7b09a99933d8cabfcc9eaab3b22ee02c823551457a58f81864d2a750
-
SSDEEP
12288:LWI2tUey1wQJbbCOwvUfI51Q1xk6L+Fggp1lMVYn3J83WBwBaOt:Lkoz5Bf41Qo++CU6F38LO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efdc7e6f74e35fedf3302f3b73613051_JaffaCakes118
Files
-
efdc7e6f74e35fedf3302f3b73613051_JaffaCakes118.exe windows:5 windows x86 arch:x86
74b0c0de5f6a9a0c05a1d6ab4693cf70
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
advapi32
LookupPrivilegeValueA
msvcp100
?_Xlength_error@std@@YAXPBD@Z
psapi
GetModuleBaseNameA
wininet
HttpSendRequestA
urlmon
URLDownloadToFileA
msvcr100
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 674KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 754KB - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ