!gB�}�+P���~����e�j�R%���-R�9g"j�������a�xA��I���B9�?��T�-<�*"����[���}Q9�j�}6�j������Y�jO������ߪM�*|�!;��{i�q���(H��,,� ����H���d�knQ���[Bbn Ŋ��W�"kV�r�_u���z��0��e!�g2��]F�=��>�����l�w~gz�%�8��crzܗ�@��θ�!7M���U�Uj����^��'�H��ҪD֣� #��hF����>��Y�fM_���JPp�*��,�#��;p˛9S����I��2�����/�c��?��lna)Sxl��]=pSd�D?+�7�F����F��5����u��Q�B��H!��,���-+ޜ���9l3���q��Q��|X�$��"}�K"�Z����)J�ᐟq�=�?�@��[���a[�;<~����?e�� �P�!MW��Q�̓�,q��$������)%�E3��n ]``�Hِ������n�oa�P`s����K��dnzح����paW�f1��R��x{��!��w�����}�cwD������ۉN�*��93%��Z�ǘ2���L�)d�>F�����xk�[%�F��g�R�D����R��t��hᓑ�����+�[_����,;7+�y��� ���CeՂ�I�2���*"�M�����%���R�-�� ��~|H�Pb%uY�2% �$3&���A���:g���W5U��n��V�� @�� ���2�Rb��;v+� �����ck��8X!rD�0�%z����.�L����JJ`5Jd�ج:;}p��U�h�>���t�{����,�Yn�H2��=U�=���۪. q�6@~Ө�W/�*D~�ʓ����D��4d#�ꃔ�ϝH��P���+����oRb�D'�u���^�b��jS������č&/Cjl����)��4��f �=\�3lJ]C�o�Iҙ���`����7��8ft�.�����3��]y�5Ƌl �غ�rQ=��^����`���{�P�en�c4��Ӏ�k�B�-?zw oe��q�.V>H�؝���S�K}��ٺu,L*�"H�$(�'A��\-�1���6y�k���� �;� �������N~/��$l���f��D��[���@'�r�E��ݤ�H&�C���rg��1R�tl�s��@��%��2��{��vhS�/��o/m z��+B%z;��#����K'T!��U��Z/�%[, ��\����V\Ɂ�U?-��d�y�e +OV��J�����,b�ĢB)i�h��4��� 5� �b����G�҉�ӊx-�m�E�>[������g��J�`5��Ƴ/���d���K�2b��8�/K�Ќ���:�d�፸��&��ǵ����W1�c~�D�[D|]1�O�(�_ #��H_�i���u�4u����ό�@CK_��B(��%��lW9����{��#�f���9�EN\3����k�D��(B�]A�t-�vQ�����GG/��U�K�5@�Ew��+�����f�I`@Rc��FX���\;�� l��p�h���L��5yr�����:��_���Qu>�[UI[�i�zK����jsiM�1�F����`Iu�Y@��T�����-;���ц�'�H�����6{���;iDK�s}�ɥ4k�=�n9p$��m{�6��2c{��p��s� ��)wh�8Ͷw�l�(�IV���NO���ͨj1�o�KK#��s�rE:덶̞6��9".� ���k�C�џ�j,�8M'T���s�Z�V��!�ec�z�0tOm����\�a��+|<��|2������8�X�U��)�����U��ƞ��q�&������W�*�1ս�������Y�o��Qyӕn���^��G�*���{2;W� S?��w5��7���ɩ7ucdH��@�5N�����{"�q2���70���5�d��}�����jZees��=Z�uBR��ݱXV�˩u��>���2s��� o�T�\�(����"G���^��Y����ڭxd R�'��N��%�̨��Ec�N��xJ�4d���T�}���!��h�se@r����\&\4(H<�+�����q���!0��~+����p���d��&?t�,��'`�n��^������f��鸔m��]�&��#����v���1�p�`�bm4W��rqF�x� պS���5S�S��}�kZ�� Ks|f�h1��� g��f�&�iڞ���Ku��F�>��W�ͦϧ������M�ں��=������V2����g_?ޞ�[k�h9��ڃ�կ�Dt��:g)%�����%�o�:PO?k��<���}�Ɋt=k=枞�^�fM���h�<s{�Q�`�,��k%��Z��"�r!NN�{�&�9k��g��BJ�DRc��⧑QP�uB�������^�Ox�����t�����u����� ��f�A��ɤ\�4=��Dd�ب�%�/��L�I�]/�,o|L�k�����T ,��Kzk� ���ײ6%�ρ���yΑ���n�z̋v�f��fI���<�p�;eW��� �ϻ�|Y�ˠ:�M��о�M��b��U@Ho��s +�e�pN���+�sO��}3[)�'�W��ir`���GȪɍub<|:���Z���;w�s�����c�#o�?�@��[�h�D�m��IZ�m��`�����sBr��]f&�&|�H�u �<�@���y��Zb�D��@Oƛ�ȑBZ8�&m����N&��S�^HB�c��L��%�qR&��,�e>b�td���ri;�Hl��u�u $1f-�]>�ت�ƾu.hp@�'�'��x5�Ȟ<y&d�����x �����=G��DR�][b��=k��(D�Ãc�C�M��f�lӑK��\z,�������ϡ 8x��nRp���IVM��;a�T7B5X�H�Y��vl����1��]`��53aL���?�?�aG$�=����������x���^��C`�W�����O &��m(�{R���
Behavioral task
behavioral1
Sample
0d2b59d2a9f9cc95ef322d67bb76d197_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0d2b59d2a9f9cc95ef322d67bb76d197_JaffaCakes118
-
Size
876KB
-
MD5
0d2b59d2a9f9cc95ef322d67bb76d197
-
SHA1
649900fb0f06b64b5c54bbcb18145e504f4c2d53
-
SHA256
b42aa60dc825810f4d22ede845e69f663df62ae2e02c8d2c6a4541788d63a8ef
-
SHA512
a593eb3fe47c01cc298ea0bdfecd61de74314d1a68dc3bf4b30783f3fffd88ac3c0146c8517995a2a53b72df3b925805d3b178b3350d69cd67a27f7136f9ffe2
-
SSDEEP
24576:7hO7RTRwiMtSlu7mCuxKYnO3dE3zGi4PcgLS:7oRmDtsCUxKPHL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d2b59d2a9f9cc95ef322d67bb76d197_JaffaCakes118
Files
-
0d2b59d2a9f9cc95ef322d67bb76d197_JaffaCakes118.exe windows:4 windows x86 arch:x86
4cdc74a14357f88b66071834f521cc14
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
lstrcpy
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
comctl32
InitCommonControls
user32
MessageBoxA
Exports
Exports
Sections
Size: 20KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
WinLicen Size: 788KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ