&�_�G=�~�S��(�a��M(�7oip�U��i�D)Qc���Ng����iMr.P)nM�9H�{,��)Կ���w�(���12��uAxJ�x��٧-7��&�89�J1Q������;�,���ı���˾��M�m�51�'�����k���ї��$� y���uV�NiEA���P�n,�'�0u\�0m3����b�<Z��)#lOu�v���,����� yJ���G�Ļ��"|�`�n��wؚ]��u�\�S�ӧ�sMڭA:�w{� -Y���M`���`��QH4��϶��Z�̓=d�م�D$`$�8��s�e�^����>D1'Xb��Z�]/�@�������ѹBQ�<�Z��Ȅ-�@ݍ�j���?�SJJ��IML�1��?�Q�8a�U�y������_��m����GBRc���Pڛy�~��˴����lG�NO\�W�<�cF�n��j�� �8n��4>��m��pz���4Q�Ұp(ͧ�)O�>���j����������G $� ��V��yfڲ��2> E�Q4;%gL��XYĐ8�S�a�+�|�?{g���u��ѣmP������v[��nU*�q��ڧ�[c�q)�+k;��,z��N�ڥ�pX�d?�Aû4K�A��^�?m�f���L��>���Pw����ǒ���/�/8�g��XY@P��1�Nu1Y�՞6M-����'�H�6�� ��i�`���Y�a��o�e�aN�T=u��4tͧK�� H7fѤ�־��+�RG�T���C`��qE��˗�9�i�/���ԃ�V>�Zo��9+�8�Ӓ����ئE\\��%UQ����.?����^������o��b�l�C�k��)���������,g�>�#ț&Ir~�y� ��Z������F�h�Us7�җ��0�#�':6��7l�/��2����y�JU� W0��1�.I��n�њ�Y����Cm��ç,d�%MFzd��-��gtD'� r-�s$���k��.�"�R���m��f(2j���Aln[�C�w�ŋ �1��.5�ˬ<.��% YX-� �m�tzcԧ�˻aǡn��odݡLl���#�Pt?��5$EBh���DN$3���l#��Rz��/Eh܇A�I�����vy������CNk¨�^V��El��\#�,*�aA���0c[��Si���M\ee-9ett�o/���O���1��ӑ9�I������!�$B1�� ���d�C?�l"7�������I��}�7j�Y���x����\��`�3�p dl�t��s����).�3C���,G���IV�ՇJ�gKst�5d�4�����<�� �d3� �P O��a� ����Q�9�#����@�M�t�k�|���/�S$��@����}�l��)e%킡���S뗓��qi��-zDj�l�����3hH�0�D��;N`�+l�-��j�x���?�-��� y����I���@����G掠�2F��z�x�>%$MU"{�'x�J�g5�苍������}M~ǽ#�5cED[.|ɩ�n��#m�f��y���~[&� ��]g�4(36�f)�3%\�K3����hI~QD���w?�a�y4���46[��R ��OIsEN�:�R�^����>������D�|b�� ��u��:^�P#t��BZ�D����0_`)G<�RN<��/�}�H]u]�.�����B������Z6��sT�<����G'���w|�AG��YR �X�E~PA}�Zؓ��n�E�b���IY衁G ��g:4�i�0�E9�����R�|�}E-�7���a��i��R��PO����4����E�A�n1�!O�%�糶�������M���QB�x�����Ϧᤕ�Vy8)�o �8s�e��X���N�T��nX8\�?<&wr��Ȩ{�} �����5,��gn:�7Bi�����h�N��Ϫ�쑉�w�T��;˩��~Y>ë#YOA|2P��6�����?pN1���.��+����w��8��og�/B���?�~Ρ3g����춦4^��ZX���ȴ@=|:m����\�gy��S�QLt>��C�\C����ظ%�"�e(�z��,�B7��)�Wk"�7b־��Hj8��*�)�����)�k0~��aڗu�)$a�r�f��ǹ��䐜(C�BMBJ��rz����?0��Ĺ��v���i{x#�5�[+���@ N#�V}�|��$;�=��Et���sæNA�yE��f�����v����_ŏIm Z����^��!��ӕ��%�Ќ �p�)��^�8�����wAV}^d��cߤ"��gSY�J�1.�h6CE�D<��=kO��8ꜽ��b�bR/�C�[%s���0�/��������o닶3��|�{g�XN�+,���qu.�� 1r{�g���T�����|%a��wS�������r�@� �����cL��_��ۂ�3�����%*���؊��ޕq��}�t�ſ�̔tiٮ6�d�J\7M������r,Y�M�o������I�a�XP9����s՚�1͛��j ���$���h��Q��)1�9]y�����E "�u�T��2"w&��M�Ldr�A~��:t�����4h��;FE%�����MF)E��;�GQ骋x�ѵ�)X/���s�@�����]C� ��y��@>|��T�0J�~ �&H����B9����!Ж1����|�7eSC���C��^�������Dy��v�>ڇҷL����վ�A&�r��N�'��dm%��0�*�`�&��=aI��9�Tp&eǼ�_��Ð*d^��T�~�)懛1$��T�ܟ6\`��SM�W��s2�(����S��"��Kn�rh�hU,"�O�*�5}�<�`���;}@���1[�3aC x�qu��(m�� �DʳE�@��e���qJ�d��Nk&MLu��?wLi�����Ci�d}k>N��oc_}��&�����s����]��E�F�&`r�7�p�I���']�OGԘ��+��D�@=v�a|�B��?��j�� ��w�S?��@��~-��L����kT��K�:����
Behavioral task
behavioral1
Sample
f9c6dbf5eb8ad72412950e35788286a5_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
f9c6dbf5eb8ad72412950e35788286a5_JaffaCakes118
-
Size
4.8MB
-
MD5
f9c6dbf5eb8ad72412950e35788286a5
-
SHA1
12cbd8f3b8829c7caa0c94404200a1dc160fca6e
-
SHA256
a4b88b277789831a68efc18433b07dedeccd5f68ecac96e9edda1213ec28e1e3
-
SHA512
8bcf63e834f2b8e92391a79a2759f290bbfca3d70ca6ecf6e8896f249d94c74de367edce184d567450cba59fa865b2fa2854c70e78d0c9ddf40abde74696cd68
-
SSDEEP
98304:Twh+nXOv8aqMx4GbTJHAKb1uM38MoQYjG76VSiSyeEZTf:TX+n7x4+xbvONG7VsZ7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9c6dbf5eb8ad72412950e35788286a5_JaffaCakes118
Files
-
f9c6dbf5eb8ad72412950e35788286a5_JaffaCakes118.exe windows:6 windows x86 arch:x86
781b159dac7b11fb4ffa711ada2af881
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
kernel32
LocalFree
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathA
msvcp140
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
urlmon
URLDownloadToFileA
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ