O;w 똣�_̒ ����y6t�'P�V#Ŏ�U/��'���w��!'�����m��I���Չ�⮵w�"BK9��m'�1/U� ��� ������Di#Wɧzd�+/�] \�g�StiI��ʺؽ*��+4� �ي�z �Ҵ�wG�GGe���Cbϴ�(g�w�p����.��>e�����֛��,M8k*HDy+�"|8boB+N�� !���Up{�T����#fʝ��ًJ$J"av�hò[�.��lq����q�_�p](�f#<�$�U�B��$�'���8�s��5�qS��Y�+!⫅�'"���S���%G��[ �C�� �}�Ǫ�@�1�)5'���(�0�nj�f�Zf���j,�(�d��C@��E6 �'�� X�O\9��c���1���Wp�ַ@=�P����ܴ��J~w���V�%;Q�`��*�s���6��%L6�46"���!��TUs���A�Y-�n�������|���A�pp`B(��z��Z��a�Y<C�AQˍR�J �5S.�֍�V�B���˦���x��X�CऎT�������E-�>b].Wk��l�4��KRx̰� �X�M��6��3���z�Uv���R�`I9�BV{�i��(����k��Sb��dֆ�^ �Kte��$Rv�P\���a0t���N�����h�s��(�dy��J�)d�rZ���u�p������EO֔R>x��3�:��b������W �y���;���/������$-�h?g��}���.���!������,�Az6�l�j���z�} �zR�t�����UG���Fr��-�8 Y�B�W1�K-͌2�T����u�!V9�{�S��Mmx��_ms�ì��:x �R��'����5�^K��qYhp�"��wP4��m��ʭ�u^��ϭ�>��v��`RY�bߟ.���l[��ʕ��kԬ��|�k�����4���Um��mhҚ��Ü�^*�Z� ����+@��E�Lƶ�Ct��?���q�9Р~>��Db�,�ܩ�U�^��1l��j�3�y.[���;���>{��������. ����iм���<�^�7O���;����[� F�G;i �� &��T�\�����tߊ�b����:~X\���˾�R��l�EM��Hs�la���[!M$���6��$�:�:�w�[��:��P���j��C�����x�%e�v�O��㴗+QvyI��f_�j�Y�_:�ID�h�|�uV�0a�lǬ�C�(�X� �����i�pm1gA��R�d1���3"ѳMN�͟�c`-6,�S/"����Ge���[㝥���A��t%�����;��}�$���f�������/�x%����X8 ���8��oQ��a����E�C�Et���+���?���܁�g�|J>�� j�����p�Zg�>��+�+SQg��������'}ר��1a/�RA�,��%ͣe[�l�,K��_Aj�ǟ�/��H�op]�Hl��Ь�έ~cv����mP�ބ�����H��EGug�/A�L�`1u�P_ᅣE1����{�~�6 7�xE�& �����t'f��c~^��8�p<�y5c���XGb�5P�����9���� p��]qS�>�(�Dp+Kg![�������(�zh�:ě�H�����k^�� Z����" �z�2(����x7�iݪw��ݺ�|���R�J���ꠗ����4� �]��Zڋ����8�F~��� �R5J-����N�3S���R�`R�zN�X�Pk���/�TO>նsi�eί�����R�퓒Dw��z�*��L��A�/>0��T�F��N���i���6]�p�%�N��^��jXC5ݭD���+�_��"�P%x��\5��$n�ܒ����ew�ε����+��1���¤+lk�i�{0%1�Gܣ&�+7,]�U8�P�"c�w��$��C���&�_ r�F�X�N����4)t��"s ��~��0U�w�f����yYw:X'�|æ%bтoaf��m�he�۹� �x� N��v��4��M�j�^Ft��N1��,N����8E��K\��܆6�'����dhH��VgF,~ѧ\?tu*��uh�@0�nj�yW��2�fL�U��n�k��X]�� PIU��S���58qUiV���;��aoqW�H��� |�G�_��H�����``p���4���t*�n5��+�q�u���4���E�+���x���7�k��>|(O�{�@a�'�����y�/��ݬ��H������Q����7�s�b����1D0�HGoӥ ]�|B���Y6�I05& Ge7s�96S��/���ܠ�yUi�*���\�<���,�Ƣ/A =��"��T�'����~����'�26�ȉ!h"���s��_}�8-� ������t����A���k6���ڔ��] )B���5AA��������G��^��e�4u P�ݬ�I��t���#��)�Řɚ IN�v�����6��$J��7�G�х��44 ��H��)� :���r��n������.��� ���i@JL�����E�N 2���(�U��G[��D�%�r�p!�fm�Ň����H:�c�����D[���U�X�/��،�W�z��՚��Vk�d�<��+jh�J���@<f�e�����4������w,��O�t�e�vwb���ԛ|�I�p���e�E�Ȏ����sl��ȴ6ͿO��Yˍ�6�h`�3j��i�G�>ŀh���;�&,.{�������ʮ�vY�!Lq�{���Yv��x���{���' .�D���Q!����Q������o�$�V�(f�%�����������������)p�X�G�s��d�v(1�]%��|�8 ����e,��_�˝b.ymd���rWGjPs(�o�����c?���q!�dܶ,�u���`.��4��'[����<�T��=�x��<���W�d�/��T�4��Ndn������s���*R���;��;q�
Behavioral task
behavioral1
Sample
2b45f2c32fc7180d3cdf3f9799d59e12_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
2b45f2c32fc7180d3cdf3f9799d59e12_JaffaCakes118
-
Size
112KB
-
MD5
2b45f2c32fc7180d3cdf3f9799d59e12
-
SHA1
900268f4c921a959216b8bedca4c61ce662d2ef4
-
SHA256
ac6e9ed13bb64a42fddad7411d9a3e555091b04ecb13144cf0b2e7569f783c31
-
SHA512
e05018799458852307f4e39af58e1244166e23e890716b78fdd910b70fe42698a15f78b8e861d78910694185e89ee3f4c7c11eef2ed25a05d1b84983058175c1
-
SSDEEP
1536:GDOXDlHyIYUeYvaqh0+mcooxsmyNEAowUOJPUh59gJp0h7qChBr8Xic6Me+2MNh3:GqXDxJhu+WuAxUMP5urN5Y2IIq2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b45f2c32fc7180d3cdf3f9799d59e12_JaffaCakes118
Files
-
2b45f2c32fc7180d3cdf3f9799d59e12_JaffaCakes118.exe windows:4 windows x86 arch:x86
e593591001d4f4bb05c98a06f18a17fa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
AppendMenuA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
_onexit
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ