�Q�+�?���ڴzѽה�@I%8+�*=�D��٢�h}��u�<��M�9fXgJp\�*�t���V1�b#]\� t�<�?��~�����lD�%��o����;�U�(?�T+'2OR>F��yD�'8|�&S�a\�p�����E��~��\?����\�N�m�`px��2� ����K�b�>9��ǑƁWL�o3�4 "��b��z��bjNo��qV�6&�;��A��_���f�o�<��e�G��}|#1l��&|�&| ��|�ƻ�*U�\�H�q^��(k�5V"��QԂ��t)8�-���Y��Q�����Jnj��P�=i}M��]���k�S"��j�z�*��� ��9��;u*&dX_�����#��Β�h?z�a��l�� ���Z (������(=��j��,���L�Wx���^�Q@u��G�9�{�������U��Þ�zB����1�_��S��7��~K�ʸ<�y��������X��ƺ��z6���4�-�4��v�9��=���)y����/Z���1�m��OAf8��ɿ�@�0��Oiq| ����q�}r& �3��� `y��5�4LS�$� �d�*�T�n�"�����h�l���5&uC��8n~j���Ț��g���&�6ֵH�l���eb�K�b���i���:v�tm{���u3tZ���h���h���܇ u��LS��J#�@23 2c i Ox�="F��/�n�P]���n��K�us5 �i�I�O�9�� ��bs3�l0�'�]�L��Y/(5�Z �ǰ��KϚ����9o�%oZ-�39��o�b���>8��Gk�ET��#l�^�"��=�а��,�Oa5������i$���Ⱥ ���B�2�`��Ծ���������^��B�d�G�g'�D�im��IH�a$�3�����U�WE��u����I�Ӱ����b\�b���4`�Z�����5�Dq����� ՙ6�́���_/*Mɩ*� }� ����ut�?{����H���*($Gr�n����Q�����?|\'@"ۓ�T#CAj�Z��o�a�Ǒ��'�/+6������nϬW�绳�Irw=6M�NG#����a�3�ݝ'e���HO�_n�$]p������^�S�Vu9��\yTe�##�~�R�AxT�k�Xq\{�\E�۞e�^x�x��F^1o,E+$�*a�ĉ[�jk���5�V]e�N����8�7�Ɔi��c>�#ma����H�����]ĭ�~�eQj�p3o���`<�9E�Ic�b��j�.F�g6,,�������_�p�ԗb��<���z]V�`<V�bamJ���~D����ƪd#�-R%I��"��=�������v��a���[�����X)��t�U뚁��q�ԙ���(�Z���//��z�|u>&J����̢�1.hv��f����n�����IP��W�A@�ԠJ� ���T�7X-��7���܈�Z��q<�+�m�PK�h���1u x������C���Zi[Z ?Ld_;A��s.� \��K�+ t�T?�'�S���,sS8ܷ���༟x6��%(��ʼn�.���PmiA��Q0�k){D�ya�Ԋ2�R�����Y�CE>t6�E���=Z.̐�.��N�\�bjF����P� K,�m�[��=�L��������o��n&`V�à��-˼�g��`\- ��!�������x>��;g�$�����y���� �)�;��Q�b�^�s��h�ԧ~��or�3�������l����.�W�ҵ�,jh�.���U�֩�0��-k��Z;B��&�q����V⸡�v̌�>�s��^I��B�:r]nL&z�� vZ(��ښom��9�;�DՔ�L���2'#��5E�1�V�%q������(<�O��,#��`���S����Ñ�-e�ɪ��FP��#�W,����B��3x�ѵ��L+h�Ӥ�9����������2�!P1�f:��xU� �x�9��4t7V�}�) ͮ���=O���|}�[]� n"���ޚ\��.J�'���C�"�g�NT��ro�:$�3%�3/�����gQ��:@�?R2����s�s�e�G+Z9(�N��3�YJ��KC����gt�����wXf��F�'�9w��jkf�F�P���5��=)�&�4�݃���xB�lܱ���c5�;��A��pX�E���xAu�{��'�';6�J���� �k;����mb{��[+B4]i�5�F�_u���a����ljϺ]`��M5GE;'j�,��S�pc��8xF�B�7�sX��]���npM�^�[@���ΰ�u�DN���b�k�-K�²���ft/�gW����CTF+k�{����r�<B�(�kO��wXh�JM1ۋs����ɫ��?��HB+�F�|�p]�uJ�~�%�x�dbGF� ��/����0�W]�1S����=���7c,�~����ٻ����>r�p���!��Z��^.�%�_���xy���*��z�wV���yj��3� ���'[��Z�F�=���~���9 0����k���H�_'~�J��V�8�����9�.���i�(GNB^�xE�wH�{��X̻R̕�דBٍ<&P���'�I%��&Ȯ�v �e�I,��k�3|=`�"���Pw�1���cq��L7b�A^(�����#}�r��(�08( 7����*'��}0�)��W���Ag �t�+Er�b��(��Fᆍ�wŭ���6�L��ń��"�l.M{�?Gv��!�E=���+K-_2�y�}LQ�����?�n'��H��;����� N��ю��`�p����Q^�G���"JSCV�F��a�����M��ב����rݳ�^�� 0��F�n8&!���8���|���9���|M8�Pj�BP� 8JSMVuR4"=5L7#�z�|���d��)�������C��[���.ǩ/>�k��`�LC��<�A�P��x��[D�M�W�/�+�W�0���J�?���jL�Ι��'峋c�{���8�B!~,�,���������6���sb�r���&���
Behavioral task
behavioral1
Sample
fce70293accf990c4785bea0b1fee59d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fce70293accf990c4785bea0b1fee59d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fce70293accf990c4785bea0b1fee59d_JaffaCakes118
-
Size
4.8MB
-
MD5
fce70293accf990c4785bea0b1fee59d
-
SHA1
9e30622904a027a6dcf26d9e90f0b6a05afb56de
-
SHA256
307e922aeb5ea55829c3595993a13d37905cfc1420e09725eea984ff9368bf21
-
SHA512
8f5e2c523a23e9a182bb0ca60564fe1e0d19356be97c91e38192f75d4a7610cf4a16559a642e876b9e7a0d6070e3ff5e31c609ede083f0969ce4aa92b3256706
-
SSDEEP
98304:SyV2g6myT1gQ/uBpwqcSrox2iUU/LJtvnoC8OzQUR02k6hx+p5eWPTRdI:h2rx2iUE1CqexOk+20
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fce70293accf990c4785bea0b1fee59d_JaffaCakes118
Files
-
fce70293accf990c4785bea0b1fee59d_JaffaCakes118.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
.text Size: - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ