س���������:�*W�C�7(~5����yRx�~�5jFN�V�ŝhx����0=w^�O�:�\�r�ͫ�<:�G.v1����K�P��c���E~� N�^�2 h�����Q��>�5HP�z�#���MR:�=�vW�oV+�Ή9]�ZrW�Cs<(U|ɚ�ʥ\�%� ɐ4����e��E�؉���l;~;�`I��l���u%��xX�\iT��{��T����{d������nx�������bJ-�4���ӗ9vJD���_��9��A��ݧM�"����&:�N���D�B�J?��f�|=[�����7�39�;��!��d{��M������Y������ !wp|V;l��(UX�1��z�?�_ݗ��^M��=����������=�U�v�K�k�u��T���:> f���AE�g�����{�mD��J�d���/.�D;���M�L7g�S��YX'}[�� `��鎹x��`O���q��x~�[?]m&��Q���X�h��;�L���A0g|�PǮ(����t�.O�������s�t$�B� �9J��U�Ɨ�!�`��e����8��^�����2r�p�=zl��n�s�hx1��w�$�R��e��%8Fi�&�&�O��V��).���~˂� L���NU���������Dޛ������Y�"a�@���eӖ�1�NPڢ�^N�F��W�G��o�U�G�#G�w&�`���6Y�����v=Bs�u��r�'�w�#��˾��蹐�6;��y�f�b��ro��=x���B���o���t�]Kg�>7�5vԦD/��F��V��&��o|�9��_Z�x{�\{{lNȼx��wA�/C՟Q�K�����������0������7S�y����� M�ܧ��~*��,�4ۡe4([Hײ�����TA=(uLLe��I������ݨ�/a�<��XF�ωWQC��[��7xYiJ۱����<-[}�lj���R��q�){�LH>��A��'J5���:m�E�X<�-� 2m��DR�E�*���nyb'4GYSf��0�`I}����UE-�x���Ko����ͣ^�J Gn���M��D�������A�UT࠘J���Z��^�ay���y&5s�30m�������_�� �/���m���>QQ9O��jbȒ�𨺤wE ��#Zz*�y�o��=������(j��ri3�����0�h� �+e��R�X�;*�mF�6iZ�d�d��?�>�碲\Q���:KW2 ,����cv����w�l�����(%�קd��4�?�JƆ�s&�8�\^2�Y���Km^�@{�������,K3�9�$� gC��U����*$��yY���WVQ$��*R�j�&z���a������K簕 �����sJ�fΫv:{/�J�̲_������%��h RZ�C�ڍhD���U��{^�Eyͽ>�w� X.0�^ t�$���w�!�ފ�s�v���T"W���z�����-�#gK-�� p/�$[�4�_u�g\�1�ۋ �S5��-�e����OS�F�3a�P�p7���%BKC��bǺV" 0� ;�"iЃ+^^��C�! ����$D��;�}�tro�Gz�����>�>�9�Ew9Q��S����+�M��Ի<�)�䆊����9�O&�z-F��J'9��4H�,�/������pzӐ�J�{��\_��-�.�l[����A�W��X�ѡ�JG��L^�R�"[��d���C)^��6y@��j������){���b#<��*���=���t�@B�;�u�Z�_ YO{���'����.Vl�c�� ��+�&��V����Z]�w���Kq�w9)*,���>'n ^��Kd��WX3H֩k,��0�R�pZ���z�G�J��,[vsњ���!۞�R�@�rqY� S�fC�5_�@�QGT@�w��Q��iV�-]F���V�Ua�xf.�\�\ni�iU���il�Q�~����&�n�-��ˑ�1�_b1�q;*s�'��7�V1#~�v��W|�t.���7P`l$�v��q�3FD~��"��Q?Q����u��ω�P�w�����Ai�,�m'31?4�W7Ȗ�t�Xm:����G���C�)�.��@y�d`�Bie=��S����m����&�nc�ce��6���[��bt֍�%����e��y�{�=6ЩC4���zV.8=j����bH�����}h!i��8����{��y�����@fy#�5P���� ������/�i�?7�zN6T�6�܄'eY>̆x�ʵC@?~�$k�a�K�g�h�=��P1�� Q\�'��m'�����1j*���){0��T��j��T�B�J�/��Y��aaM�Я�L���#p��t��}�%|�_t���e��bQ�l�^S����K��_�uСn���#@����,A�����1��|^:Й`��#`�]����k7���QC�"l�#%�b�u?4TCS���-�����������p����2�`��瓒���C�$T6ɢ��p�����x��P�0<<M�Ք�.�ړ�T!!l7k�����P+����)�#Xz]��'��Y�Є�;f����(ۏ9!�/S�-T䟰��Yf����Y^�q;� ��"�>ƒ`�9�2���*�ΆrVnf��w���!�KJ�����Uyr�4���O.6q�� Z�g������hfq ��º9|��y�;;��������,)J�e"\PRi|,bh74�o���Zٟ�ӂ�Ƕ�`�"I���W��K��q-�)7Ze����������j��Q���%몗�:)gз�� |�i�����&*+ʀ��>3٘3u�W����5� ��N,�T�E��ʵ)�����R�d��W��r)30��A��XE�]�^���f��7�ڐOÌ�q�`.҆Ez�`�� R{�)�6܉;�`����=1Y^I�hɂ�/%Ι�|�Q�ILQ��I#�/&�)7�:�(�ȢT�uC<�<S�x�1�O��07�4V���ѷ�ѻ��Ikɳ�uJ�1'�) [G�G�-@]_N*<����6���.�:=S4��E���'!��E��P����
Behavioral task
behavioral1
Sample
ffc705b8f0e372fad929f28490829d00_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ffc705b8f0e372fad929f28490829d00_JaffaCakes118
-
Size
88KB
-
MD5
ffc705b8f0e372fad929f28490829d00
-
SHA1
196c175029dbc7fbd4ec7ebc5ed26c9714f3ed52
-
SHA256
50ab5a830ecfeef84a37c746a269e2997b05cbbb3c5f0ac1eabbe3fb32bc3ea3
-
SHA512
187176d0db3ece657365b36208cd793b03a7667f61949f672b3c1be4b660e32529f546829318f2b06a92b8e1fa6f5ebf441efed0a255fb06f1d582d1498f5cc3
-
SSDEEP
1536:VuO0dRQCCEdr6vaAHH/JqfmoOls61TPzQ8FNXh3Kw64I6LGt:VuneCdYCCJcmPzDzQsNVKpP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffc705b8f0e372fad929f28490829d00_JaffaCakes118
Files
-
ffc705b8f0e372fad929f28490829d00_JaffaCakes118.exe windows:4 windows x86 arch:x86
e3ab2e9bf5fb8651780bb0920b5fa0ce
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CreateFileA
GetShortPathNameA
GetModuleFileNameA
WinExec
lstrcatA
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
FindResourceA
LoadResource
LockResource
SizeofResource
GetCommandLineA
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetCurrentThreadId
GetSystemDirectoryA
GetWindowsDirectoryA
OpenProcess
CloseHandle
DeleteFileA
GetFileAttributesA
GetTempPathA
Sleep
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
GetInputState
PostThreadMessageA
GetMessageA
wsprintfA
MessageBoxA
advapi32
RegEnumValueA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
shell32
ShellExecuteA
mfc42
ord823
ord825
ord860
ord939
ord6877
ord354
ord540
ord800
ord561
ord815
ord535
ord537
ord924
ord4129
ord2764
ord2818
ord858
ord1575
ord665
ord1979
ord6385
ord5186
msvcrt
__CxxFrameHandler
strrchr
_except_handler3
strncat
strchr
__dllonexit
sprintf
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_strnicmp
__p__fmode
__set_app_type
_controlfp
_onexit
__p__commode
urlmon
URLDownloadToFileA
msvcp60
??0Init@ios_base@std@@QAE@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
shlwapi
StrCmpNIA
psapi
EnumProcessModules
GetModuleFileNameExA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ