�Z>��A�p`��fەy w��W}p��g�R`��7�DҰě2H�?���t����H��^�O+���ߙ{�>?h�N�P�_�B�p �P�j�N~~�hf�\���'�X����a��J�t��A�w�[�����A���ܫXxS�p�����g���̅rO�fw��,V"���'̾.z�o�V"6����B��%�oh�ʬ�LEZ�2w�Dz1�S������� ���!��E��u��@�&x�m��O�'�����Z��#�u���(�l��]�$�U�ܣ#<������p�����ҩya�h�?1SI0��!��p^Z�/� �;ߖ��f�BS>@شu48d oM`��.,�E��BlVZ���o����mm����:U��ZXo��\���OHs���>�����TZ4 ����`?���0?oRn4�֞�8�Oj���SdV����_�_%���&�U���E�*xPQ�-����6q�� �gl_��m*4!zv��m� �1u�;M�Ϲr���bR&�nRo���y�:���Π���K�����D�K�ǂ����7~6��3����\-u#����\�3�x�6t�`��x٫T6%r_\�P�(<��m�����{LdL/�ٵ����c�5�h��e1���P�x^���H��%��k��D�D�՞~�8F��:�B�쬥���j��d��a� �FQ�O��)wi��!�R^���A��h��Vg�}�U�gÄ��z1UM������e�P��̤�J͐\�f�>1��K��6��Ö���5*�;6�>��J��(����8�j��3�������wv*���3fZ(>�5��%�:I�r�^�.�&:��Í�ڹ�J�(�T 2^)B7�60�� ����9/*�A�#�d�~��y�'����V� ��2�o��4u<xB���#e�Q��)d[Ytjλ�?�(^�O�ím˭�|�:6�9;����F��Y��u��b�R���D�U< N��B�AqN�:�vޫ-�6;[WS����ᇏ�S(���-w�n�t����H�D����4�[-��t�J��x;�}q,�bW�c����Q� �'?��B��H9�|���K�y���{1���o�#����R��8=L&�m�B=�h2�L���P�Y�{)���.���e �.�5Ws�Za~a y��y�HUO�����/�?4�4$�n] �&�B�o8��َʙ��y8Ō��P���]#���E��s˨�w��'�,7�U���*S�Y�:T� �r,�[��9�&�K��L��M`������xS���[���TQ��V��"!���9Y7�y6��T�w�0?S#��[�gM���)��,���>��e?C�S��b�(BN^��%��i���zJZd����YܜE���{�:K��Pk��F�[Zr���[��Ҩa�����= �R������w"�p{653"Rs,�f!�"�_j���Z�g7C6�nQ%���Qn%����\���r��tu@�r걹>����s��Σ�S&�����c��#5�Ja��$?_LZN��P�m۫8�I�W��k4�ep�6�˱�xɉ5��z`�����s'�ʷg[����tj�U��R�q�D��y�L���OzNb�"�b����3A�w���Ŷ�n'�ɝ��l��1���!t%TF�s����[/o7�Fe��7YHD�=�ZEݠ!3�By7��4�.ch8��S^��]���rA���#�΅�$WC!��j�p���7�<�.�f��vY�n�r~Ƴ��ZG����P> ��D:���0�5���V�#�SR���V"��;/i��<.Y����ո,,��7�ڼV��mʉy��+��-_����-�ҝFxX��,u�R��β:�9-u�(�ۏ�'�OoY�*0+4}:��Jh�H����uR5���K�I`�>4�R��1�\�n���ɁC�}��=~�)�0?6�r*�Ȉ˿�¥��� 2Nc=���p�5�+��]֤����7�K·T���(����6˞�3Nn�f�-L��.���e8� /%� j(��p��^6e�fS�4�/'<<����@0�v���.�����t���t6��mO?� ]k�/T! ���� h���O~|��ˑ�� �0�2���`Zs0GF�/�����&S��B-�\��&�_�9�X*IqdY�³�� %�A�ܥ�m4�'�) ���e�Q�l�� �ۓo���_K���eY�#�p��sEL ��� ����"�XIJO_� �J�\���6�!zq�B����^Զ�^��\����p�X?�[������WF��GxKc�p�}�#���~��E7��=���S1�!O�����o���Tɹ�"��ߢ���B�"�cB��U�!�/���{�ė:��h�h��am� �}�n\�L���<�ljGC�-���e�Vo��]�h�A:W3t��`��}.��eM0�|�BO+!-n���[��.V��wF���K5����b{~t�.��$��պ|]�9�ʋ�[�S�ˑ��Ji:�\ v�����d���` d���t���7��=%� ��&������g!Xz����eݛ��-q�@9o�$�|,p��X�N�Q���-��U�0"�n:R�y�R�� �ڼk�$�EM?�C�Ǭ^���>�������W�z���o�B>�d�u�A�j�I�ӡ� w� �$� V�C`���Z�Cl�NK�d�>tÔ�N���sN[���b:s(�D�Q�Kbp�̕hpZ�?���J������x�T�m���+Vٻ����ETevLo����RUE'�K��-��m���ۭ6�������K���i=x�ѡ4B$��?�@e�X{gFM�%�*C�Tۑ�#$ ����%.x���]5Ƚu���D���n4���=;�a���{�,7�U�.$U�-1;,�e��*"����-�'V�|���L�lkՄz\X���X';+Q�Q���nQ@�f/�o!]�8�.�.��fLɹ�N�05����4����#�ﭜq��L��;ۣ)R��?��5�#��"y�B�i��$j���-Y���`��
Behavioral task
behavioral1
Sample
fdd97da6274789296a03ab4a731e0117_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fdd97da6274789296a03ab4a731e0117_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fdd97da6274789296a03ab4a731e0117_JaffaCakes118
-
Size
5.2MB
-
MD5
fdd97da6274789296a03ab4a731e0117
-
SHA1
681034293d91b01b9652a0a45f4848e804df5d1a
-
SHA256
75a610c3d99a4d99762dc184e813e50dd90c77eaed4a744604a9dcdb53f254c1
-
SHA512
9c6ce56dddcfa16fae78cb4de4ec756a8d229f9a16d073ff0b18e07ed57174bdf3eddf4365015f37fbc41627a82c3ac61d1d830ce3334ae90b9634e0f8a72b21
-
SSDEEP
98304:pRfVG+TABpCKFvTzKkUBj+zDtgYNW5bjIqN+MwMyQQmG8yj6eB6e:pFTTA/F/qBj+z5i5n+UyQnG8y
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fdd97da6274789296a03ab4a731e0117_JaffaCakes118
Files
-
fdd97da6274789296a03ab4a731e0117_JaffaCakes118.exe windows:6 windows x64 arch:x64
18095c5f2a0b7d094cf30a575adde443
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcess
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteExA
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
winhttp
WinHttpQueryHeaders
ntdll
NtRaiseHardError
urlmon
URLDownloadToFileA
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-conio-l1-1-0
_getch
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 245KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 272KB - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ