�Vc0&��'a��_V��I��y��Cy{ZHdm��\?��0ы�X>�� ���M9��!�U�~�2�������I]8l�)hy��<yx��ɖ����3|J-�v��C9.���:�Wi��o��\&k�֤ 6�(��o�έ̔q��v*�����U1]�J5��j`��_C�uT@Tj��%L��'R��!����ї]_�";_��_K�{C1�:|��գ�c$7��g��8�`�~yn�1�%�^�<�u����Q�����q28���y�4�� n����B�`2������Y�P_�3'��,�\��j�@Fu�2�����O�#�x�ݙ?���t}qw��c�^g��- k�\� a��6U���M��0Ur��À������V�#QSN^�[�j��,��u�%3�ӢT�N<4?���c�3 ��6�_-p�� �Z�GP� ��B��r���0�F����2ew��_�<���ӛ�@��J�h2y��!נ��C" xi��pEQ\����������ṗ� ݣL{��wEQ�2���h�ܼ��}[\~8 ܠ���]q�z�#�Üf!�Y�Q�d�^� �=������� �LF4<H'�t�ߟ8z�$'l�b~���I�O�@�幯�$w�ƌLv�8(_�7�p���k���"s�����������Gu{�����q�[�Q`}"~�x"��X����=�4�N���70��F˺�U�M+�q�@E���Bn��EZz���H8Th�`z@s�;�N������{�� a�`J��&����8���� �Ώ ht���&o�����˞�\SnLv˙���n�J���\=�3�h���bUˀ�b��J�)��CO�me��"P�EY��s�g�|̩ �@Ʃv�۫������?�~*�Q��z��W�X4Yf� �9NCa�d�� �J;����zacӉ%W� �<�����C����X9ˍ���(� ��Ǹa��,ӊ�����}�C{t�o�]��!$yiU��EGL��L�c=&�������U'2Wa�D'(*n2�qY��ԓ�s�2jP�6���a��4�Wz��A�3�W?1��Ȱʡ[��+�ҭD����"�l!�\�$�����5M�n#���M�0������L#E��)��B�bL�>�6`���<�&���:�WJ{�n�-�������0��h[gF�����V�v;��5vx��5.ܦ0}u��7������u�%U+;���J��C��zefG�mB�O�BZ ]�<>Đ��6�����>��F��� ����������Dp7�T ���kl�<�plV������.�*�z��|$�F�^B����k%`X���:ʲ,U��U0\z���?SHG�\�~�\$��dj퉲�C���sH�L7����� �0Gro7 �V/�ǧ鐡;6�Rw�_Raq�����K:J-W��}R�J"F�� �ʤ��H�+R�خT�M\���7kax�1}%���bb Ov�8k��,����{q;J }�Oj�ƴ��h��-�����*cN�+n�������Eo �cڔ�މw�k��FP�gf?݉,�����C�%E��F=ĭn����t͎b!�>j������!j�X����d�<�m�H ���6g�,rs��G�4}�M� ��爎�(cww}��yi_��KY�e��J���|b�R�̳o�Lx!�,4R���T�I��x�5<EI�����nNM�8��b��1 ��f6�+'�fG#CĒ�dn ��P'| ��DIc.g�@V�;g��^۞�K���E�����G�s��Y����^{0��Pֶ,�Xǒ��c��'�cv��cU �ܗg�6��1���P���D��~Ho��*���=��9��X�C./�`#����L�=���k�x�f��>чu�Q|�C��q� g$Q�ߟa+�%�c���r~�$�eƽ�����-����`ו_�A�K�z���-�(*���CR�b�1��l��d����4�p\�4���[�Ȃ��0�9��{I��,GNhluMDU� ���� �ߐ����2 �����Sz'����8�b<��7������0Y"%�q�|i֛��4�@��Y4-pO�8�{_��q�\�n�������Ü�4�������ш�K ��^���E���C�u�]�����P����Yq,���?uǔ��MԲ�@l�ƒ�z�!Hv�z���p4Y�I�:���I~صa2]Q�gt��\)�Y�/�q���`Iٴ��ݿy��t�up��t�V$�'P�,�PKQK̒A���I�3D7���~mϟ�}|q���$��o�x��gm���&�1QVĻ���?���p�7� [����$I��/��Ъ�e��E�@��n��u 2�:� 4;��^�q����s�W�7(;��ۼ�>Lf�m��p["E�C`-ɧ<���)�gX��ۤ��M`��A��#,x9��2>�+EZ���B$W&Vl�p����:-�IT�H<=I�A%�����Ī&_e�*!�.���V@��.q�'�0��5�u�)}�[D��$p^��rjN�ܧ�d�<M)=�����~�;�VY@�|=���𩎤P��P���N��#4�����|@��m�ݻ�U@�AB5a�!� �ֱ���d��B4+��?|�pl�Z&��Ϭm��7� �Q�J\�^%q�Zk:��ۋ��l� M�w�ǝF;�W���ά�ˤ������'PN��T�����l�����#Kl�h���ri��{Tu��Z��_�!A�aD���ҹ�\��5�1�s�3�K}�Ƶ�$`R��鮉��r/��͊����Mt0����ƓM2�n����N72t��"�O��C�F��(9d�!��S�U]<�X� ��jxٽ9F������K�`ְ��:�Yu4)�����cBu�w�_�hta66_%'�;�L=���X[��zh�w����P���+��;t9 8 �C4�� Y ��t#]�/�� λ$�J�w��Pa8��fS�SlB���F����)3����8��^�.�����Ẕ*��wIoA!���x�3���Q�?08�K�g�>E<c�e�kB�$���
Behavioral task
behavioral1
Sample
0ef3aa9986a7a34daedddffe301e38ff_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0ef3aa9986a7a34daedddffe301e38ff_JaffaCakes118
-
Size
3.9MB
-
MD5
0ef3aa9986a7a34daedddffe301e38ff
-
SHA1
045c66d6783f50a40372d0bafc9c4ae724e1955c
-
SHA256
ab02710736ea15a67757f36509615a70f4ecb499ab696d0482bc79e71b416aba
-
SHA512
f9c7c890cf27bbe0c21003576e8b0a8256e1ab9d84c110aa101ef6ad0597f75331bfad91cbec17e500a173669776718ad0f98f21a5ea67446906180972cdd599
-
SSDEEP
98304:qj3m9eeKUiiOfGAOEPBvJ4VRSU+97nvJPM:6Wket2fGAOEPBvCVRSUInR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ef3aa9986a7a34daedddffe301e38ff_JaffaCakes118
Files
-
0ef3aa9986a7a34daedddffe301e38ff_JaffaCakes118.exe windows:4 windows x86 arch:x86
65c4c1b6ec76744bc774e839978fdd5a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiStreamClose
ws2_32
htons
kernel32
GetProfileStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
gdi32
CreateSolidBrush
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
SHBrowseForFolderA
ole32
OleRun
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
wininet
InternetCloseHandle
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 527KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ