~�5����^� 3�Z��0��� �g�QJFN@���o���b\�������p�X���$��2M"/^L �%P��2�EG�!��TA�ν����,�>��w��?��MЯ���1�ϫ����#f�p��:6=����tJv��%d���y����&�֫���?���%>_42���\�pq��N���h�/1z*��T,�����G${�gn)H��q.Q��N�|�:I��A��&%)��6W~=��\�4������GJ�i{QJ���k���( <��>���٣��6�s��Q����W�5a��&�+�J���3��<I��"��O.A�&���Hv�.TA��!!�0�� QZ�j��@n�Q|c�/;����KB�dԑ54���wIG�|�өk-^k�Ti��3=^zsNDQ���k����5l���x���%ĤJ�����n7iT��1�Z,o�A�NwM,��P0�..�̄�h�I�$w�a�m� %f:�"�������3ZS�)+C�Z��L�4�z�HS�P��٘�m�a�9I�;u�5FHX?]�u��N��wm�=%A�J�����T�C�s�F�v"�#z��,��@�9jZ>�����*�p!����Wx��Iu� CX�2�"k��Hj&Z���u��Y���{�r��d�jc��Ǒ�:�Ε���-lChX)��B�����l�5�o���P|��~yi�ĞΣ��-�͝�7|_��B�5n�!K�̯�gB�k�{Q��:���m��⯍��!��Ɗ湗[�?��X�"�Ќ@�<j>��<�'3��Ɏj ]��^�ifr�5'���->�g۽�|D��2�d˘�h�(5Sn�q/��$�./?!�ۥ�_L*�v7������3�CY�پX�F\�������%,N��F�m�H$?.�)-�X�Ţ���X��!��4�����1��]��_n���8�I�s w6c?-�w����!S�xIw�+���A>�Z�g�-��F��.!{x�2�]�J�o}Q�ƞ��tT�#PE�6�c�}R����Hx'�þ<�b�6�dNw�#�:D�~��5�D�)' �,�YC�5t^N�7�u�Pą/_�q&��[p.����d�(A�4�L��x�K�v1ճ�|& |y���[��69"�Ð�E��[<h�;�u��T^Rf$����J$v��_6�����זI��+��}���h�۴����Қa��I1Y�`FO!���~"翢I��k��U buT��t�K��&F��P�B�k+3�ف@��Tp81��^����@��i�w[ԧ�O`z�rB_��\ �6��!Թ�T��r����S����VbO�Y�|�#gX� ?�QosU��o8�۲�W�f�I�a7`�1M�2 �N�ߔ���<�+�gA�k��kS�ל#�`��e�����L��a�%�ך�w`?��"�#㘼�F�z]����ȑ��� m���.Zu� �����Ҩ���jh��^aկ�W�?��Sd�)���j���;�O[�@jL��d��.K���j��et��9?��� ��~¡�� ���H�����`ό�{}6����+���#�Gyٖq.a�i5���GmS�E��rlɟ�������s?3�g�|Q��3�,��m�w�చ�����Z|�_�d�Lߋ�xםj,��� ��"!q�vd�:>_1L��l����Yhl�$�J�������u�O�PZ���z@����z�()�*i���ߎ8M\[O��Aɾ}/%;g9���y��*J��b��$o�W�'�|r���ٓ�q|�ވ�c1��m7�3Ҋ|�����2~a )^CU�ہK*�5��h�_�+�iKҸ��O�6�������J�$�m�p�0U�6B��=Qz������Y�|8To��)�L�؏7��������T��y��6�~7�� �� H���C��N�����8a&��5��s =�$?{0ɋ=c?+HlLj��$p�5n8-�Sx���C s�,g����(����B�e�k� ��ڏqyxg��.pqG9���L�s'����I0��&f�G|b[�Uy����Y"���{�)���Y���^��C� ND�Hpɛl�-��wZ,H� b;�SI�ԋ%�D?،�3���$Z|�����u���W~)3������r r��9�nQUW�;����m��B��.���aUo�W*ew���g���L�7|a����!����ݕ��2`�۳������VD��&�b}���v��P'Yv��J&h�w@��H!\$ZE�"P����j��^��k ��4����Y�*O�3��������Au��i!#&��Y�|��=�̫X��+f����|� �r��D�D�%w��40��1V�^[s�f`����[=�����x Տ��^�9x @(L�� �V�|^�P���𬬯.�#c�pk�8�(q��86,Nr�I�����O|��%�μ��͗M>疣��!��5@b�u˻Y��t9�Jw����QjW.}��a�S���x�� �u/�3�̍:\H}��zl@ �#j�1*�a5�4ƌ*�� �ޡ����G�M��R��������M�Q\V,�D}2�K���fYf���,�B�nɨ?)��:Up�fh���<�"�b^1�給@���MA��oM�&���&;d�"����Q�����_1j�Ǝ:�]ۙ�y�����c�mB4�4�x�ܓuQ�ꌈv�&v�o�ر_l I��i;�e�_�V��VJ������~(�!��@����OH'����F�)�^�D���Z~�P�ǐ s��C4+;�e{��@vu(���:yf�YB/ZQek�@�YE����w��W����S��p���O� ǃr�4�����=}-�GO�. 9�D�����2Ϡ_�c���ל�i�wP*�ΰ(����k9?�{?���C�f`}�8C��&<4��ċ|s�� ����Zi9�9L%"�����t��$_�b�K��S�}ރ�om�V�[}��c���(�j�� �A�Ҫ�f����I͋�������7� �g�op��7�Y}�Mm^�x���0��� �6p��Q
Behavioral task
behavioral1
Sample
003c811760c94ba77c83ed9bfe65cee3_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
003c811760c94ba77c83ed9bfe65cee3_JaffaCakes118
-
Size
3.0MB
-
MD5
003c811760c94ba77c83ed9bfe65cee3
-
SHA1
702c81682d08581b0dd975bb0b03841d85fc94e8
-
SHA256
acb95ee64cdbc79f291f16113248342ecb7cd2a804ae05818750b9f4cd8d1f6a
-
SHA512
a5c25d9b3d95507fb7eb3cd97302643086319f6f9fb231c744454614e437334f92b8fb526315a2105a715038f4c64ed40d471b29c4fdeff6d41c44c676d8caa9
-
SSDEEP
49152:+Qz+9ZFllyLKFsaVMvzFjs9XiwQmWGVctyBbJ+UCWLSsdYXegYNaGrRGyfT9PsvK:1z+3FNmaVMrFj8JQBGf1J+UCEj7gQHGz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 003c811760c94ba77c83ed9bfe65cee3_JaffaCakes118
Files
-
003c811760c94ba77c83ed9bfe65cee3_JaffaCakes118.exe windows:4 windows x86 arch:x86
d15ce4eb27dc68f19b22080ac4816335
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
kernel32
GetStringTypeW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
gdi32
GetClipRgn
winmm
midiStreamRestart
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCloseKey
shell32
SHGetSpecialFolderPathA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
_TrackMouseEvent
ws2_32
recvfrom
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ