�kwe�,���,Jz��i2��N��^�J1|��^��l�d��7����l�M|�{ܬ*�hS����i�F� �T�#ai+ �#���� ��,�pm#�_�%{,@?X��8^i�R�A(���7Ly�la 1��J�{�u���s����~�g�h~;I���?@���MFV��|�P�y�N��zPU0�����z��������`���'�D�;?�zn�{7�p>�et5݁��������fEI���f{|�F����� Yo�o��W� h�������B���&�uu���5����L�!%v��{�5iH��Z� �Ȝ������������� -WW'����5�%؝��36�����C���)/�w���.�>R�w��<�"���¿p�c?��D4�W���A���x�Z��o�2T���e1j5t��w��$B�v�%yk*k�R�q0ؽ���<�OCD?��V),'����1��-����w6��}tI*���C ��������K|�~��jq���i�c��æa9H 0K�[D�7=k4��io�<x2<N` h�R\>�١6��"]PȆeᢍرѪ�[^Ց�[zܪ�nop=��nĖ��f�Bͮȗ��n�6m���j &#��H`* ��C��RՑ�D�E�%ۗ(w{|~�j�I���>%�|Y��[�����5zoo&Ym��A:���|M������b��Ë�p��E��~MaF�ei���t�i u^�aM� �ym�̦���Q�.D���cU�W���v���TQh�, ��\U�G&��/�c&��:Y(k�� Fm��� �V� �[�o�5S{����N�|���m�U<�����-e����:�ɕb���axb�R|&�mW���ZN��}b�ߘ��րG�@M������T���X�ކBQ�^vA���^�Wtz���j�#�oB��3mk�>�L���Q��^b)���}�>ե��kd�w��Ь�M�ml^&{�+fY�Ta�O�˼r�d7څ�N��{ۜ�&㫯�Нie��D���B����# �='%�����̩��ī<[R���$j��A�W���t~2�������� �Q��-� vI��U։zy!��>��1-a�|�/]����j����f%��8M�bFxǬ`��u�,�t���h����,���К�g� ����:߶��}o��b�%>l�t��5���JC���2��A���0���mf2�1�ky�b�-lΫ= �)k,� �����_�w #P�A$�#Y:��Q��q��{��ӝ��'o���=g�9ebv#ԥq59� ���:�~(�Р���ܿ��+.�q)?S��Z)�O��_��$uJ�\��:�l�<����G�c@�b+�⾯�F�氼3#w��u�Y6R\]�OP4�Hh���N��a <�b��y�On$эI��Oj��K�P@V7�M-�S��[-�w^ O����kf�����G����D@����a�'��϶�cL��}Y��o��A#59�-�F�yD�̈́l++F7,�m^r����p-o�E �!�ũ����~8���(���(���z5Y4�h��"�U�z�����CSGn��!����jLx��rf�5Ӂb@�=*�AA��W5��u���tr�`���G7� ���T��kK�Y�~�\UbX�#��|����!8����ّJ �ғ��/d�9�g+�I>����'z3�8��fRi\Y�%��yd��c���I������x��$EB^W�sZ<_(J-|��a�t�u��""}D�;�V��CX�ߵ��鵧Y|�8���`�FQﲮ�n��Sl^ #41��-� ږ����(����ӡ�{����Y�jp>ft'� LL���dX�0j�a*�#3�� o"6VM3>V2�O"(٤�nv�JQ0q��Lc� 2�,���7g."Qc$�����C�$Rp�I�^�<TaX��g�.�n����� �8��(V^gJ#ARnb����T�(]L���D��ܘ!��G�/�kİ�� t|D�<�%��%r#�>^y��VB����dK§�sIC�F2�^RL@�����D���R{�r�)�� d{7��4�©M+Or-�LѢ��4�Vӎ�h�|U��!x�V������ܾF�8�1%[9z�����e@p>�>vF���Oޠ���]˱;� �VG�rUK�G++w����&��a���vP_��-����������*Fǫ��,�~5K-�;�I W-YU��}<�j����9�o8�@[..��u'���4��܍�W��ߕ�f?M$�T����e�8���|����4Q�����=�'/iM��t��tM�\e���Ԝ��=F��X�YJ������G2���n/��p��&����.�hoFC�ІJ����1����-h6�sh�vl;4.��{CH6aq�M���TE��:�!��p~����i��~NW�YC�[z�9�f��c-xQ�Y 恁q��>����V$-"�l̨���L���Jvf�C�|�1�%�������2W �铤�M�����]6��p�����^��ġ�ġ��ʹ�a ���&��lj�C�����T# ]�JGr�9`��nN��\Z���c�<�QN�H�8I,KF�:�pnÙ����9G�$�5��$߹�ԹA�ܵG. ��V���O����.A��:;�n � � ��[���~H6Ǯ��g��k�#��+�����H@��Db��R@t�>��=Xv�I��V*�;�0*�����ܳ59ى�6���}[���U�;����2#D���pj��s�{Q;�o�E�<�,z+����Э��ę�!M7�ݹIQf�0͂<�����g��w,���6�Ux������ %��D�� �x3�S������T:�/m7ڵ���*��� �8#1��%q�Iy9]�X����ѵ挣!H5�5J��^�1S_nvd�;���r�)˓Rj���m��rA\N�*7F�[ii$8�vd�Q���n�������T2;gE2�j٢+�c�uř��m ����W0[
Behavioral task
behavioral1
Sample
2bd19e73313ab40bb7ad378f98de23e4_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
2bd19e73313ab40bb7ad378f98de23e4_JaffaCakes118
-
Size
792KB
-
MD5
2bd19e73313ab40bb7ad378f98de23e4
-
SHA1
64a51a9970c1a51c67ade4c161c469aa348ccd85
-
SHA256
bc8940b5d0f8249c331f8d2a557af184063e727f81f9b7fc6d78855a86a60176
-
SHA512
1cdfd13ab2645dec4e65b554970f32f425a392e87fb4467d165604c001286901b16343b1e3c87fde3c64a3081b549fe863e0f32948987571d6821032e09b3078
-
SSDEEP
24576:sjQI1nO91QSfBv+vA8vUW+e4v//i4YZsJUDkw8cruzp8n:xX91J0vDzw/woxw8QuzOn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2bd19e73313ab40bb7ad378f98de23e4_JaffaCakes118
Files
-
2bd19e73313ab40bb7ad378f98de23e4_JaffaCakes118.exe windows:4 windows x86 arch:x86
b4ef5dee6b9d3e81c2d4c3bb663b44e3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamProperty
ws2_32
recvfrom
kernel32
GlobalSize
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMenu
gdi32
CreateDIBitmap
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
VariantInit
comctl32
_TrackMouseEvent
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 793KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 736KB - Virtual size: 733KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ