��-?�&��A�lO�k�?������=�IҥB�9��S�^���7�K�կH�Q�I��T;�G�#h�<e�s B�I�b�(��wLH����,9���Y�m�K(a���!�>�Y��w��o�j���d.=���Z~!m$�a�0#��(�8�Y6)�� zB?8��eM5^�z0�di�n�����p%�6 �3�TR拣�%� u���܉�_��,1]1kuK���� p�2&�u��B��=E��~�珯`�ױ��}�%����Iy�u�ڮ�����8��5����GY���\��w5�zzr28�N�\b+�[���I[�w+o�v;O�H�}�����儑��\g�����,W�f�?\.{���3r`�zry�#k�W[��~�P�Y����S���l<������)d?�/�!�(���I�v$�Hk��x� ��=����O����<���u?��c������̤$�.l��2�=��t���7͊!k5�z��|���`x���m�<��,�|�S�B��%�:4:�d��� Q�EC���XK����qi4�Eb*��b���/�|m3"����ʖ?Uq*���v73ן(�SG��藗��o_�%��Dwم�w�$H|Dk���4r���f��)Wv��i`A������_0��͟������ǫE8|h�����ʯ�rxP� (�1�� ����G�9*�ߑ��M,��)�P-#�?hUYr������$���PyS����Y�������ME6>E�b�b���ص�b��[d�۲c��ڳr�<�b&�WF��e_Ʈt���>'�Y���£�u�Ҙ����2+�y~i� ��v �Y8�$�o��mdf72��f@�ő�P��UA�S�0��l�4� ) ���`�2���.�����:��+��"ư�+��h�O�:�He;a��xpo�*:���N���lq�D5��w7 N�� ���J��S��I�!6ð�*�D�!r^Oi�U� ʷ\iT}�o���&��u�=nR�]ə�ؔ�K���ٌ�'�hG�+� �S�үR"�����&Y����8��;��}X���h"�ط�R,u�v{*�¶I����N��3������8V���X���D��ƿ�]F�#yR3D���k��{����A��2��a�����+�P�^52��!�Rek<&�t�W�2jmp��w�Ł��_̞Lŋ��QJ�����$iF3�H�F�G�]9�n����|��|�⛴��U�t0*'9�8���"�~��q�,� l�1�%���;3��"���NL�&��l�������w�ڷ����᥉b�c��-͈�ܶ���\-,.�9U]y� �>`A�g��o��ivy�Ť��t�}���k��VֳI�Gqܮz��$�����b�G��o/����r�G`o+Ȼ�2{�C�B���?����9�(�q�� ��7��5[��T��)��܆aK���{Du��6+�aaԋ�I�M���O��� s�zA��qh�8V���q��ݗ��7Lc���)ۥ]@��ҽ9�R{�&�z<}<�� �������<�؈�-�^��1��ѿ��*���\gjGI䞣i��L�}�*Q�{�G��xB���0x>vA�T�x�+����dC�.{�1ETrkF��N\�lٌ�ź�&?���njw��c��ACwdp1����Y� +�-B��� ^,�@�>a��z ���/a=�j�BL��H���SRg�̴��E���@mJ��4����A@ǀ�������[����J��X)�0���e�3�de/��J����MH<��-�u�z�q��lR-������1X3��C��QL�!$���!UC��-7;��&=�E�s\g�� <�&M~�d��1��&4���xX����-�|S*}�X�)� HR�2�Iq��>���j��J.?.�*s�W|W�r�$��nۏJ�Dc�v-�MO���%�BLثh!%1��f?���7�+�Oq+mМ��w�nPo�(�,]+��A�2K\���-JoopEa�xP����cKGt������E� ff�ِ���"{�/����id�_&O!a����(��x���<wm�օ���-A�W��8���&���Ϧ�=`:.7���ig�%:�(w'�?��'����I�+�~�_��>�W"�ژW�iޤL��~���bݻ }C���J��N�`D鈃�)'֞kV�n(4TK�e}U�F\Kh_sJ�ݝ|�= � ��a4���(}��vq�֏�f���䖀Z|���r/��N��@p=�����b� S�L�>Ԓ��ꉩq�pҶSوB����l�v �wu{�r�}='|մ�)?�����\��g� �������߹�5�<�V�:���s#pHV�nlؘ!�!/���H<��#�`s{e�QM�!�'�a��$����W��gz��=��n��!�����Ƭ�ԉ̳vO�{���S��p#��"�ٚR�,����� ��~�0o�^M� 1Ԛ�.�(u��<��S�kz�$��L�D��Iwn�<ڼ<���/�������v�O���Е�ca�G�E��V���_����ixu"��1?�(�-���[�a3\.7�i�����9W�����nT)1H��V��&I>ŠmoN��қ_�\�@�@ 19�o Œծ�=���8�C�����c+��`Ŝv���4�R����t��a?���-����aj��G��UP�}�9�&iY p\��}��v_ �ܮ��{p�_�xg��Ybm�݈�M���\��ĉS�w���$�j�o=IRņJ�0����"Z���zk,���9����m���M����&��l�LJ��W<�/(~%sM�2Z hW������V�o�xlk��������M�+�8U�ԮօK/���\��p�|p���s���}�K��S?Ca�J|g�>�@�0�$�A����v��.�����6B]5}��/]����i�b���5�\"ay��q�Q���U��(:���C|�J&1_'q��S��������b�D��wq �(Tx�z��yh��t8F�3���u�U�3�>�8DK���s�/JJ�Ȳ`��
Behavioral task
behavioral1
Sample
14a3ad9382ff4de13c1022a018c0c360_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
14a3ad9382ff4de13c1022a018c0c360_JaffaCakes118
-
Size
168KB
-
MD5
14a3ad9382ff4de13c1022a018c0c360
-
SHA1
be7e44588c10fe4bfccea76b5344a0dd9848d146
-
SHA256
4aa646618a4377238b9a8e05788081b36f554a87ff55f4c407f2729f188fb257
-
SHA512
0aa07785913c87f9ff632c38a9b8aa72eab0251885141316fcec0e8aa8393cdbbdf6e035bd47786bee3b92176956e26770d4c025b9afc3d908616da160346297
-
SSDEEP
3072:G+1Tw6haORuAmOmxrHgHdsYaxTYzRr8XN+HXzpJWLJZQZyAduKsFnOx:/1WdWd9n8XN8DpQFZEyFVW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14a3ad9382ff4de13c1022a018c0c360_JaffaCakes118
Files
-
14a3ad9382ff4de13c1022a018c0c360_JaffaCakes118.exe windows:4 windows x86 arch:x86
e68802b61b8ee49cd2bb2ad2ed5f17a2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
advapi32
DeleteService
ws2_32
socket
Exports
Exports
Sections
.text Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 156KB - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE