w-�(��{؆�he)�R� �!_������U8?T���@�.=I��Ӂ�tl�[����%��w9�nL��+��H�>A��� =[��?E��y N��|��s�&�w�_i���|Ñ�i?����_B����s�/;�M��}�-|}ֱ��$`�A�]-O,тt���Ȧ �;��:~( �T�����K�Q(���7�|��u�5L}u �Nڥ3PZ?�%@�&�<��`��Wֆ�X]V�B��`~��0x��������U��ժ|E6k��AY�Y;X[���mPC���<&���Z��>�%y`k?�(��8���� *F6\h �����=d&��Rz+��o����ePW��f���ak��G�N����L�;M��K���|x�}H鹈elҟ�Q9 ��+��ѵ�mg|����$�j$���HJ��`^���N?)������1��k�K�,��m練��>܃�ø���hz�+��<0oz���z���P�(�G��Gl��^��D� ���vZ��i�r��E��_�#������Kt��3"%����C�ǑԌU���������Xƣ��;�?)<���@�[z�V0RY�(r�##vVDE�18jP�`<�&.��z���1��;QԲ�9�E8"�5aa\���^�H����{o8�3e���)���:����l��#��U��y��ތ��.uP��&���;,�e��l���\�lZ[�o!��N���j�f�_�篥1�Zʉ����,���sw��ϗ"n�c��oq��e����O𐡕�ݼ���3��4J�/��@��VL6��_ �,3���t6������T���^�%y� 1����=�C�z �k������N2�j��"~��.�q���"s%�R�%G�nW��[@��i 5�]Q��p50*�@Tb��3K�w4hDbh� �)�12�C3��_}2�X�����Y�~WSg*����D�7!Y�c܈6�?��8���y+��m!�X�����ØS�G�vʭ��`ь�M���I�fO�p�漤<�[j��Wd���C��Gm�עH֩]��n��Z B�IJ<�d��eL��~ �E:�n���Nj'��z}�H�BȈ�YH���@�.ktf�Q��Q�l�(�ՓҚT��Yi������m���7Ìx[��/�k���V��#BpF���җ���/%�+GY?l<�|w1�u{7e����ڱ���W��ह��Fad0�$@�ķ96�Qpdq�^����S*z'���=�������hC6���} ��.9����^���Nn����2�-=����Ey�r��b6��3 ������[,+\��U�Y����-{�C�ZL���|]f�YƦ�A�0�N�M��&�['�r.�A�>>���J�.�=�\�T~rD��/�� j#��1��fc����!:�ݬqP��c<���.0@�ˁ����w�͜G1y����H�>�c����O��ee��@w�Gu]�^MUk2�m���рz^R����ٖ��/4]��ŝ��/�������y8���gm��B�¨,{���eW�t��٠S�.%v�{a�#f���20:M�e�ܐ���g����}{UVZd�k�ԗ�L��ml�p.��� ��bEH�o/n�l(�ȭO�1�`�;\��n�����;����ˎն[n+?�הg���/V�q� �?�UJ,����Y��-<��3`�#�����8�]$C�l:V��K���(j����4���[���댻Hv����N��nUǙ����+��>�GF�ٜ��Qm���A&ÁN)�k� >͎Z?�1 ��g��v/�P疘z�A�S���a%��B� N������iG<��Į�9�/�7��M�9����f���9�q��e��!��n �IL�ͽ����s�ej�=quQ[b�8��0xR���ţ4���W���Ò,*�y#gTtt ~���?�~ �Zk���P��� rF9�c�Z}�L�}s�!\xG���,� �]����������U'q�z�Ƈ��tے�����̤ʓ7�G�͠4�Y�#��O�Zn���'��Ȗ"l����� �n���i�����)�Z�u]�xңFc_QƆ�{��zů(�+u���y�Rdbu;_;v�P�Ѥy<���x汌!������O��?������O�矹a�VS%��eʫ�(�)O��LK����HU����� ���2<+��X��h��W'* �MJhv���G�����:��;����ōY: ;|�9j?j;�����<��⸅e&<'�+��'g��G���̭me��}"�j���E�R��cG�GS�]�ю�[ۢ����IqJVu�DP�c�c|S]4w�\��ԕ�� W�,7��)�"�#����Š��v�?w2Ħ3��p����&1� #�C�2*���������SsK��j=ez:�3Oi�B����C�@<גUj����}�k�J:틆딫"��+U�i?Fΐ��3��q�X�����K2�#�����EE1bkdt���X�E ]*Ab��`�&��f��\y7��a�Mس�= ��V�u�^َ�:T�DFxNw�Y�|�^+tݢ�L�hWk;I'�M�S��{�m�Įϲ3B��@p�Xe�{�(q 5��;�s��A7����&Q䟲\��*'�Ţ�$���� �ir6PϬ�g���U�!f������ �R�\U��b� � ��c����'ㅾ�)[L�'��@�{�9�!��$����^ T�����2c�Ͱim֝�cSm/�\~�-U��V�Rׁ�@� �\r&�������m�Z��#a��_��;�L��� ���֊xZ�;��ݷ�A���^�uqXO���2�s��;�m=; ��r�>Y���oV�1Xb��+�[��'cS����\]歠u�;�D��&�<1�t��<����*v��6�0�L�bK��c�M�N~��me���N�`�����y�J~k��d��z(�Յ��&�Π��K)�O��a��� Mu�c��2�����Y��b�����.y%�ͳC�#ةE�a�K� z�`h�˔���wמ����W
Behavioral task
behavioral1
Sample
f00d8ad9996b0e18f5c000d21dd4f45f_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
f00d8ad9996b0e18f5c000d21dd4f45f_JaffaCakes118
-
Size
136KB
-
MD5
f00d8ad9996b0e18f5c000d21dd4f45f
-
SHA1
153a3d8520df0a0a2eaa6dbc628571b69a9d81b1
-
SHA256
5eba13d5c6a0d4f2af32ca21f62549ebf0b8b0a3d7b5424f801619fa8e0796cb
-
SHA512
61a52c3840ffe47e8807aaeccfddda8ee94c65b5423f0b441efa1faf8baf0065e008dbfb87d8726ff181f960557e032000a6fea278ca9a0594ac864b67815b9e
-
SSDEEP
1536:qmGKhzjEciUE0cJn+Dk7B0PtCOq+FZYxKhZZa/7qQzmTTdwIg2NOr/7cIpGR9p8X:qmhJrFQ+A7B012UZE6razqdxNg2ahWA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f00d8ad9996b0e18f5c000d21dd4f45f_JaffaCakes118
Files
-
f00d8ad9996b0e18f5c000d21dd4f45f_JaffaCakes118.exe windows:4 windows x86 arch:x86
cc2ce27f781b3772d57a542d8ed3d7fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
comdlg32
GetFileTitleA
advapi32
StartServiceCtrlDispatcherA
mfc42
ord815
msvcrt
atoi
urlmon
URLDownloadToFileA
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ