�[b��a ��*Y];B:ߕ(���n���� (\s�>Ƭ~)J�y�ֈ����S��k{��,�ի�-Wj����'1F�8DXNC!MC�l.V�a�S��LK���b֝�m �yw��)�������3����j�g��b�O�oE��i�����Q��Ɗʗ�jn5r�ƍ ���c2S��m���U�G H2��w,^"-B��l/rE/^�"Tw3�?��*V����a��LH/���#�+$�a���cp�{�Fʮ F8����o�E�.�D��ӋeӐ!��k� �8e�ƥ����N�2W�@&�q8���{�iIRdi�@�k�(y��H��F��=vg+����đ�]�d�e���ZaΝ�����?���W��� V@�(��t<-p���2�H�j~�N��`�ʋ!�&C���8���a{���Nu#�ʓq�|q$��0X"�w=���Ϭ������(/��k;�.qQ�L�j� }�(����;�{�y�I���(��z�!uJt6���Y#���o���u�erNC /����w�����G<.;@��wM�Ԍ���['C�t N�ކ�_a�ڣ"=� S(�\@0��ym`�"bi�,�Y�E�׳�G�)�%�2_���ɻ�V��X}��6��*� +�aGu,��n2N#���(�m�ܔ�C��m+�O���C��C�Dt�=Lඊ�Ia���|L�q QaI��]� �����Z����j�yV��]t� ��|��O��b`���4%@��9����ǣ�CZe���0i�^YD�O#��7����Ӛ�R�c���9]��r��2R=����>IRض^��;X���#���*5��<�@�oo�fR��ym���*H����kś�������.�P���]٨�v���h�����xrʈdz��$o�,�M��D%w�.b��|�"�䆌H�2�x"���*��Tr�J#v�����ڰ2�'��} kN�����>��g�5=&�h��֙��6����s���n���Do\�D���?�g��"ˠqr$o[��k �zJIMyU�?�n#s�ۗ�y���_�"_�y�������7���3'� �\������%�e��1q䅲��� ���D�@�l�Sxx�⌐���׃6 Sk�2fI�U X㱴��I�IIu�c��fo� J��8�W�hv��o�+Lk°�nS�lѥ���à r� }zʦ���/��b�}�zN������ΰ�� k��� ��c���TT@��i���8�!L�d��7�rf��n�[�"Nѷ4R0#�� ��T49Шqk�3��n��o;_s` I�u$>-��W�����Ʊ���fL�f��&�����q#�a������OL�('��`L�(��_-7iL�N���-������)���mg�^�NYy�͑�Ccva;6ru���q|M��Ǧ�Y���R������� vY ��:�{z�4?�KԠq���?Fmb{@���@�Ka�dj�a�6����D���O%&�����[�hX����x9>�ՙ��Y�wm];,�����%6"��c{D�r��`&z��,KqD8Y]�9���L^�q�o�"r�-��'㥂��?a�=ߑ�Q����:��WoD�5O�*{�mM�_���-�_�/��<(���v��sr�4�;�{VA�$W�9����x#}ۦeU���E� �d7�N㠝'H�{�y]/`������hMg4�`]��d*,����kLfw��[c� ����xM}�a)������'�I>#�)B�t^�t���`��(�������L~�L͍.6U�1��S���\'��6�c�"ؽ�{�n�,�:�NF�(��1�㰽c6� .���/K��ށ��)����D�YN�*XjP�c p@����m���� Fi���-���0���ff��%8RJhY�����%�8�Z ���|lo{k�>���� ᐩ�ٟ-=B����j��s_���������wAҷK��I���:��\�������<z���59��Y� �/-�̛�3��c�T��QHq\7W@��p�2�͜/Ǝ����%2Y:.�CD�r����ԙ»ٳ���{��0A� ��� �?�)�<�� ��D�O�ނϲL1̮bjD�yN����͇�i�M�x���[�H谞�Ia��%��0��6�,�� -,��TB�͏S����R���f��4��C���$���2s��+��/:���XV��LTX!dÌ�J}��?�oT��?]kd�������>G7���/�~�M��(����}�[%��"C�I�F4��"��T����f�N)�h��H ]���%n����*�I�(��1j��]jE���Q�Y���b�|?u��e��5)��e͞���B��Prz�OV�v��s�������9���Q�\8�x�����������ɦ�����A�>���Y�T� �xA�q7iY����2mӆ�� �fV}*U�#2]�����\��"B�PC����ܸ�����&��&�m ^N��2��%u� NW�E��sxwx�$�ay�e���4���=�@�*)M��w���N���_#�2R�]�?�*II��y�}�2�:���z3D��+{"����+��ysR�s� ��/��T���?^Y����-'�1��A���N~X=B~NYS�������_%����:�:��/S��;ʱ�̭b��q�*h�@�����\ք�٭�Pyc�(^� |��^y$���i>ږ�1m*{̅�V�{��Ў�6Ui[P5���>;���� 2a������{��d���|���4'+������T_b��}F�.Sr �m�X��G�a��P�^r�m����ˀϱ*Ѱ�m����im�Ym���`�@�u�i�]$j���MN\;�V�\bs|����J�����[����N�]����>��D��UH�=���C�������Ė&K0z��zz�@��L���I> 2K?�NB�h^R���f1S&��\,kk���Ok�0�p��d��j��X�gC+���?�������ojR5�����u#S˴��z�S����ԏ�;V
Behavioral task
behavioral1
Sample
038cedcd19e2955f905ab2aa443fb9be_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
038cedcd19e2955f905ab2aa443fb9be_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
038cedcd19e2955f905ab2aa443fb9be_JaffaCakes118
-
Size
718KB
-
MD5
038cedcd19e2955f905ab2aa443fb9be
-
SHA1
71793fc5c228b942d41be9cd62d43244eb2d50de
-
SHA256
ba0926a3ee5c2b388130f7b5e264578176027d611d6cf04d600cbf1619172d32
-
SHA512
286d29ac456e5243772804c24087971403375ee834010b52b4eb6e2c196cdcf2c5c1b589cc5fcb06990b5f2dcce9abae8e89696791d2bef46956336f3d2336fe
-
SSDEEP
12288:EzT5xAiSGjBV6bTPusSGZepTmhGZmUbtJUlpLNJ1V/mr5fAi:cJjD6/uijwZzUT/e9fAi
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 038cedcd19e2955f905ab2aa443fb9be_JaffaCakes118
Files
-
038cedcd19e2955f905ab2aa443fb9be_JaffaCakes118.exe windows:4 windows x86 arch:x86
05bfff552227ef8bf54b1163eb3a344e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
comctl32
ord17
comdlg32
ChooseColorA
gdi32
PatBlt
ole32
OleRun
oleaut32
SafeArrayGetDim
shell32
ShellExecuteA
user32
GetDC
winmm
waveOutOpen
winspool.drv
OpenPrinterA
ws2_32
getpeername
Exports
Exports
Sections
CODE Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 630KB - Virtual size: 632KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ