�q���~��ї���i{F��~��6f���R��++�Jj�ȪM`���+�sK$�t#��:� \�R]'��Y�t)�*2;p���X��*ME���HRl��W}��І�Ԡ� Y%c���zt�������f�|x��ĹO1����O�ͮ��D�Tw#H�s��͏6������s���Tƕu#�U`3GKx=��MMMl��Rķ��>6S:^fb�&���;�H�*�w+����Ԗ�lgh]� b`#�'K�-�f V�=)��kMH��|���pW �H[]kr���`ϻ��3Πy�)��þ���lM�@ �'�J���6 �Q�'U'M�ݍ�ם�%��C��b>w�Ϙ[�o��G%�jB{�����NBXL�x��Kn�"����V8�!�.Xr>qd�+���#�����4¶��DW���x��$1�q�ʋ�M8թOR�%!�ap�\>��זC�$�ī4���eI�8�`?3�˃46�O]�)���"��r�>������P\�fɷ��ء���z��P��x\;���DM��sԎvk�=[V��_1O��D00t��k9�_��8D䥞E��~W��'���w�×�'ۜ-�^�Bbq�3$a����%�k�AD6,P3�>O���|�e~�B!���o$ M�`A�ι�Q��p1��EL�vրc��"�;�*eQKR�թŐ�_��ͥ#�[�_�|��e/o �����+��fIw��F�V�@_ KjP����� @@#�����s����>��C�A�p��d��EY�>����:F9+�#u|x��4�p�����ESF���?o�I�C�㵙� �4�56���X��d8�������o1}��}�&�GR��^�=֤���C��hd�SP�+ұ*���=�(��(�h3$Z�U����F8l,�N���)�p�gr5�F�@]�$^[�b���H��W*h�����a/(N�r�~��rF�7)|ﳠ6Ӷ�9�!�jU�@V��������E�Dȭf���A˵4��� �L������E�7ů�k"f�n����%��_�!�n�L~��(_���k��D ^�Z_����$1��zR�'-�^�R>8M]o4��-�Ͱ�oÿ|��@�o�����!��Ȫ;���b���c9�Gp��J�Vp�]��IDd��_������@�wX��i������y ��sc�R��C��#o�����o8{�aJ2��x�{���� �s�c��V�_��X����mg"T�����>{��〮X)"��%B��b�C9b&��v\�_T��s��2i5��˂��a죆���M�����0g���#�hU>i��t�]f-�+�$�չ:y4H�1��G9.��%�$���p����w�G�]x�;���p2c�f����;�3zV���Sd�ᄑ��E+A�Z|̎���A��q���h��V�<����R\ �O���ObC>+i�@��I�7p�#���N�'d�j%1%��)cR�}�=�i���)��>П0�'�tٲ*<?��S��}m�K#_�o�<�4?�ޝ���4=&P��[aA�}2�M3�H��u,B�q�c���Vb\�U�@�Ӛ4��D�B˄�S�F�(��8>&X� 0tg��7�t��e1=���}l��3���`��yA:Dbn����z� 6��)*�� ã�:siB^�"�ThXm���^M}XQtV�SD�Y*%�]��B����S�mdn�ڈ`t�9������t4���9�E"w�U�{=���\����8���s'�_s�f,D&e�!�fN]�Qw�Z�[��6ʷ ƻHk���Gӥ�����MPSe�� ��>��Sl&�T-�����-�5�Md�%ԭtDqy?�����A�e���o����{�U_G� �|�)PAƀ�*�����M�$�����1�ن9�;"v]8�mk~8lL7);#� ĞWܬ`�� �tP�7���S��Y<LEo�T�� UO �Bi�Z�/"�n�Y�� YM����Ph-Gcx�D��n�7�tJ�$V�}��N� q4��Զ�@�~5����3wm���{� ^���J�z��Yd��/��+7�iBQB��T�������j1�� QPrDkb#z�.`kޱ@U+݉Qc#b�*����p�)���(�F!g���`�Sb��F�FP�3 c��f��C��?�ضn�ڛ���V9һvg�B���T���,��o�Tg��9�r�b�eEKß�F/����ɔ4ρ�օQ�6Zf5q잵`�g��{+��C@$�U���C�_[��l<Z'����A$��VMD&�Е�&��>��� �G����E� r�7wS� K$ ܅SI��'/����[���� ��Ù�,�0 ns-�3M�����Q�2�0�w�����fۛ���YL�e��N=.s&� ����R��} �:��+Iـ(�3J� �y<K�%0,�п�:P2Z��LC\l3*>���6��U�Z���{��1c��w�k���H���-t'#��Y�]L=T|cn��s���MmdYE �5b𰑤yu;rC���t�C�>��䖅8)K+�Y�b.��Po]�O����$�v���¼!1}��RM/�k�G0��i�ib� r.��L�("*�9�x�iN KA�2},�k!8�n]g]�8�"݇�/6/��+4 ѧ�?"rö�gO���+B/.IE^0�v�?gשK��j�I&)��ΛM�!y�8Ay@4�'���d�{���lJ�,G��kM��l�X��Un����Yv:�0�S��cLȳ�Ԡ�X���3���b��������S@v��ol����Z����%kz��1����&c�i��P��3���-�����O��~4�6��쒌�T�8���>15 �^�:�5�G����˻pF��0,D��tZ���`5�QS�w��P�2��@-�Ӗ ��A�� cQ7�?B2���n�n��Y{���U{��S���m��=�(��6� �]�9 ���������*���E����q�=Y_��},|8I������ތ+R1e�H�MJ�ݱ(ޑ~�7�ۤڝ1��k�K��gw�`5���Sv7��D�
Behavioral task
behavioral1
Sample
0bb5da27d38e7d0265a92d4feb547c19_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0bb5da27d38e7d0265a92d4feb547c19_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0bb5da27d38e7d0265a92d4feb547c19_JaffaCakes118
-
Size
77KB
-
MD5
0bb5da27d38e7d0265a92d4feb547c19
-
SHA1
7f8e94c634ca0340d75dd3576ce5664bb9af3dd7
-
SHA256
7827cd5a98881cafe98f2769d455064d3e7e90a8e1f60f4d8aacc4314b07bc5c
-
SHA512
4a8ebe3852115b3bad7940bb145129d628992cea58107bb909142ca47940e80ac7e9148363ca0eb39eb2de1aa579a43390a40b923d6d5c806ccbd14c7af5a3e5
-
SSDEEP
1536:J+emiK+CSKjo4nxnDLo8bPfhIsZlyEDsFpnYaoE+xHbYQG:J+TPbjo4x/rbXhjZUEDCK7YQG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bb5da27d38e7d0265a92d4feb547c19_JaffaCakes118
Files
-
0bb5da27d38e7d0265a92d4feb547c19_JaffaCakes118.exe windows:5 windows x86 arch:x86
3ab863fdb8ba5d2bf9ba6f111b03ec1d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedExchange
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
RegOpenKeyA
shell32
ShellExecuteA
ole32
CoUninitialize
urlmon
URLDownloadToFileA
wininet
InternetReadFile
wsock32
socket
msvcr90
_invoke_watson
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 638B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ