kEm�����IY�hr�n�#�bE��A(^���A���͌�pa]����II]U�Dw)��"}��cp����=���f���*|��=���DHy��|/��� s[[�3s���l�i�Ю���/F"���c� $���������>�@�F̛����8� �m>֏t��*m��gf�4�W4jo{���������}�t����":�}H��\� N)�H_³"��N4���|Ě;�@�Q�SOU���J7c����Ú�l*to8�ʸ�ob�.��j�@?MZuh��ͅg�aG+-��|xŚ?���Dl�4�u�Ղ��K]�3�#s���^�4.��@�<���3���m���t�� 2�{�)�����~�6��S�,7��cq����F��&�{6ӗ�/�Q�~e���܀����lW+��g�5����E�̌�i50��V=�s��c������G�Izc8�KBkG��ij ��^^������҆�SP8��E��P�BQ5���9��9�*�[�b��č��W�u���g Or��J�'{0+��n�Q� �r�|�QW;��v|�)�m���Zaz]����"\q5+�l'�v��B�g!z4�꒡�u)�X��ԕsL����N�/�����& J���D4b��Ɇ(�U�w�'6��HwY�?9'Ӥ�u�9�-�L� ��[α?}άUi�U���V��R��������M��>��e�O9r�j��usy�KdP(/� �Nt��\�Ɔڅ��|�#�7o�`2�ȭ�!@c�V!����%FV�Y1�[��Oz%�[ G�� �'�x�fK��� w�~ӕ�b܂���D��FVob�EES��e��ʵ����8����ly�)��e���`��9νK�V�>��0� �%���x�zw��ą���e�u^J2x�+���t����h7}�)��57@�������m[1j��f���b|�9�kf�j�C����sH8?���5����p���-#|������O/���eu!�0F�'��Uk�����WO^�`��pL�e��W��-S�/ug�.��?� ^�-��5�NB@T(|'O�\ͼW��b�z���×8�0�`B%U�4��r�ʿ>�P�p:ɗW�?F|���vcz�7&ϲ�0��UmJ�yf��5H�1)KQ��H�q֖�n< ���O��7�&6}Y��N�ٻ��'��8�{멕ޏ,�9\7���w)�[��qٕ�� �V�VJ�w�����2"���pih��x���(�.��IĪ�e�w�� l ��)���f��c����\�c+� :�ۺ���˟�=qN���B�l/;A�qB�ͣ��p:���,a�^є����z5{1����ǫc+�����u `U��^!�^?<�e�ҋYR�����ӆE:���A��J��N������RH�DsH�]@9F�A=St=���]�\4�J0Zσ��q&n�/��ѣ��^ b��W�F��|�A�c��vr�uZ��I0��D�ה}���y+��TeI�!��GM���9$������α��ܑ�w�O�����C^k�Gm����9i�h+�����1�w�O��YC��Ł��DOc�v�BB�w6 )� #E�"_��u���}�i�}ś�������)��5�m���%�U�)T_��r��Ei�K���^�e38�X+�)�u��������Mq�����0������<wg�DY�|S��~,�|����mct+�;a�e���i���Mb6���������J, �T�k��h���5j�-N}.Ǽៈ�er�F�\oɠ|5*�1g�<��H�u,��-qG�K@Z����[M��`��'N�I�B��h�<>{��z�M�^a�w��s�T���!�3����L4^B6�������A:�[��������2a�8g��|P��B�=I��^y�����&u�$���� ��$�,�Da��4tAc4�,�E� ������dM��<��Esp�3�s�m�o�i��]���Ơ ����X�w�+�S���Cq��s��z����í~ -kx h�9Ne�{Ш������oO�,,��� ���1������R��X���������B?��[�{����e<$��Q���( 5��a�,jc00��}2/ړ䗟��R��S[X��l��̘���U�:�-\X��1��R�by���i$��(�B7�q�� �o}����1k�h��Į�jh_}��M��?b/��� -*����K��?��t�C���[/ZGQsgu��]6��lI_FG�Z�c�G�P���T�-�-h��m�8�ģ��<�LK��9�7��l7��tkK�T�^�MPż��h���x&ِ��*�iю- �M�|.�0H����#�<<F7�G���-��'�3I���ҙ�Ј=��(��֨+b�M��b��S�Yb�H�fM��^�n��D/C�c�ɹ��,����K����4vH*u^[���u,�ݾ�7��v���<k����H������`\2�.�X��d��Q�,oCX��B��g �<��~�m�څh�K���Nm%$�V ����u�}���^�W��Y���0oNG�@�2A"�;��d ���K�L�"5}�p#�m�x����a���� ��Q]ԑ���%g�x��&�h=�+��b��6T���6c�z�%b���T�g�Dz�%[���>�(�*I]�۾��rDz��UϷSqu�t�_����[.0�#s���C���2t'n7rJ���>/$P�-�`�"ܷ����o�g��!S��||6w+���L���H��� H_m�G1�m=I��JL���7돉p�o$�ˮ[���!�+�y���';-p���Em�!�l;2\�,�9Zl$���B��}�2!��"�������\�p��Cm:���|Nl���X�s���4��if+1�5h�`? Ͼ.mk�D����Ln�?j�c�@Ml���~؛�8vWt͙�5W�����+�eL��S6Y��%A�0t�i��U�9� �6>�+O���C�*��+gOs ���X0�n�c;��U��m��+�`�Z���6.D�Bg����]ͦ
Behavioral task
behavioral1
Sample
06423b83dc5ba54a546e60fabde14f64_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
06423b83dc5ba54a546e60fabde14f64_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
06423b83dc5ba54a546e60fabde14f64_JaffaCakes118
-
Size
804KB
-
MD5
06423b83dc5ba54a546e60fabde14f64
-
SHA1
2721912e4d0b7cd6520f847b08600950ba14f424
-
SHA256
ae05b5089ffa1fe3f3511a6a29503eca919804280fdd13b44bc78a11eae0fde6
-
SHA512
71c8505b7fc0f0f2458dad0f8e0cb9092eb2b87c03a36bd1f668a3372d70ecf458e5b7e06dfe4b948f666a0eb63261ba1f9ac6ad593b8eaea2be93ba9b7d42d3
-
SSDEEP
24576:UAhdgGniO7CRj2nvDZ5msdc/o9qoVFj37UnyDZ0fzhd0M:UAhdxi/je4/oD8yDZCz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06423b83dc5ba54a546e60fabde14f64_JaffaCakes118
Files
-
06423b83dc5ba54a546e60fabde14f64_JaffaCakes118.exe windows:4 windows x86 arch:x86
03ce766e263a0e6d968c8c6ee716bd98
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc80
ord4282
msvcr80
_fullpath
kernel32
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
KillTimer
gdi32
CreateFontA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
skinh
SkinH_AttachRes
msvcp80
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 682KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 780KB - Virtual size: 778KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE