/t븦�R8?j�X���0��j.i��m����X�{�z�]N� ���I��w�s�G������Vo��a��l�h���&o�ޯ]7�Ԟ�"�b�`6�8 ���BK�Qs�a�8�!���5��Ӎ�O]iM�q!M�^��l�VK�� |2 ��2���3)Yu��n'�_lY�P8#�����"�ELd/��2��s�"�W@�@ �u))/�|��*+i��S�m�!18��=�?u x�cNz��� ӽ�~r��{;��^@��H��wz!�}��rp��&S�K�<C���7�J��̷}gF��64p�������Fj�U��6�p����:����5�àSh+�K����t øYd��Wa���,)m����`f��2~��x*?��?����n�N��y�>�+[x���6�e�#U��]��081e7�Śܳ�_>V:he{c��/��a�A�U�O�=���W���z�(��E�]���'bF6��08���%I\.�0+�~�u9r�#D�1� ��Ōn!����G$���d�9<���j��;��k�y�i�k���If��V�T�2�Ũޚ��w�, ���`���Y����x*dt�MHB�T!��!�FwT6�4��j%$Yl��� u] Rc��w���>T0۲����无�M�(�.���4tk�\�A�� ��EStu���7&N�w��8N����8l,���}#&=2^�ЛЉT�����o����'���y�T�XpV���o|����*V��JF �>��`��3F̕N�,,]�Ё��ޙ��|ȵ���0���$A���) x�'>�e���%4z���#U������|���P$6f�BL���o�W(�eT����]?w���WS�i#H�+"���������@�,pA�}j ^���Fl��V�,!�C��B���V`}?5u��Ј���Q{���� �w���z D-"��ݕ!>��.l�I��t��N ��Ba���f��ka]c�v��9��>A���VvB\�sVC�+<;��w������d������;|0���B�3��3Qƿ�AAx��7�*�/�t���ӂ���m.8q�$W�o����)G��P�������� B\Th.fR�/pB�jݲ�_g@_qO��;�.�j���@���W���w��~����n��PC"��� M.�zB�=���6\B�L��%���<�>WK��eġg&�+i���I�(��"ERDTk��X�1"���e�����[ �=ٕ��o��l��`)'�n3{*:��Ow*�H'� +���mK>�x�K?��XaXb\���2eyv@�G����7��[U��TH� u�VL������b=��?$5�,F�)�Y\}bp�@��߃�������E��������*\��?�Lj���>��&d�ݤZ�hOy���'�|�����I�[��}��j�:�!@(@��/�w�k\"�M�t��-ͣ�'D��U����L�M��}������^o���m��܈S'��!���\�4�U��BR8�4�)���J���<#m`�'ć�jGH'6#�/�S�$�FD$}[����b�?�����O�=�B-��|��@�X�j�G��:��/�L�,��{c�AR&W��յNCB�ɷ����J�z 1���k��.(I��2�� |E\�At ��Jn�X�D� ��%s�(�<i�� �����`���ޛeueH�OZռ����5y�6�K�-�k�Xј�l,}��Ǣ�!$��4q��o��q|�-�\����\~��5tၽ��鵕 o��Z�MK��y�;�.�z��Ww!l�����c���*��VR�/���HR�o�o��u�(�C֘J�nPg D�#iV6�#3?+Mjx�ѴX�I +,:���f�BtΥ��Ye(��I���gt6�"�|)܈mq�U������M:5&�����*�ȟ�s���eÙ�=pj,a��q��N�6j�Q�5���)K;��� e�U��X7o���p�yAɜ���^���v7�(2y��9�~�dŧd�~�۾����n6�_s.�����`F)��Ͳ���`E�Q\RyT<�c(M;a���x�R��F�� EB�;���\v�J�Д�7-;�E;�k�=L �l�*��K�z�⫖MC��7(0c(�Ug�P�h�ق���g(-�D��a�J��"U2#�H�Gf�`pb�� �����+K�) +yZ%���4����~�2|p�1�S�[��H �;����k�B���A�^�b�u���-RHuP�͘ ��@e�!��G�qmDc�����yX���}${�� �n��vJ|q�)z;@�S6� �q}bu>E�� $ /y_Y���=<k��)��?�~�`��P'Q7V���P��Q�r�����i����qz�z��7!��{�>;���^��r��'h�X��2���\�M.��/�p��M�Ts�G9n�/Ahri4d��زu�����'���^Z@p�nM�x�'�u��>ЬƜB?��0����c�X�Q�T�oąJw��b�2A��%#�) :\'Xo�o ����4f��^���H��s�}�V�v��ƴ2��V����Q�x�^�~ˮ~֖C�m͜ �W�;[hgB����g�A $�#�~ƔXkh��=�����5��洼D�-̘��ĸ�Q:��yR�șa�H�14ˍ��$��B9�8���)6�2��)����)@ҹH\�b��q�%�q ����[���r�i�w ����M���yǚ���a���;9fi�=6R�j*�M��W��������/��徖���w`Gw�:�_�������Q�h��6Ӏ-A�%�2+��g�:^�YRπ&v��Q{o�M�Ϭ'X?z��;���m�A�W�����n���}h�"9&4�Cw{a�J܀�����H4{���O5�����{D/F��.��'�r��O(z4K��������E�}����� iq���]�/ܹ��q���[֎�xG�ImZ�[�N��B�ꜙ����M�>L�� x� ���~�Զ?S��xG�^����LiS�gt�0\���,�uk�-���6�&~�D���[륖�,�
Behavioral task
behavioral1
Sample
0c040086792f55748e6a78e1f3a8400c_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
0c040086792f55748e6a78e1f3a8400c_JaffaCakes118
-
Size
887KB
-
MD5
0c040086792f55748e6a78e1f3a8400c
-
SHA1
40c05e0f4a668ab40962676e271333de6de30d1d
-
SHA256
b5d8c34c27659dbd07f4a3a67e5a9e2d23b87cd37859d9c7c149b6317e7dac42
-
SHA512
f111eeb1004f8dd76932e12cb605a7b520e7dd482264e610aa4d18b4ba5e15fc7e5729fdbc53e828db111c668b83affd892a3c559d7fe7f623a09d593407bf09
-
SSDEEP
24576:IYL+BF3hO4RmvAdYtjqYK+nu0ktqR1Gd0Lxm:IY6BFLmvU0jqYK+nFbG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c040086792f55748e6a78e1f3a8400c_JaffaCakes118
Files
-
0c040086792f55748e6a78e1f3a8400c_JaffaCakes118.exe windows:4 windows x86 arch:x86
390bdb5a784a9460d4d715fa1b2f3a34
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetMenuCheckMarkDimensions
gdi32
EndPage
winmm
midiStreamRestart
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
ws2_32
getpeername
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 431KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 336KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 688KB - Virtual size: 687KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE