�s�'�v�x�w���[&P��>A�h�?L��ai�E�y-���0'p��ǿ�2��o&)T���_}�Ώ�E;Q���q�j��^t���K��� �*j�PLo'��W��/��B�U5��O�R�Z=�+�,���$'D>���D��^n�eox��%\q.DBbl~�ԞtbO�k´������͢��A>Z���6��uT�G �~�������3���^�>%M�ݡ���(����L��}�&�S�Dj�ϓ y��Z���h�^!�)m���Ž�iu!) ��p��D��� �X��d%z ᴰ0m����P�nwT~����G�`fk2���� e�N1�\�c�k:��ՠ�v��Ek�Bμ����K�E�ǴP\: b�P?�\����ƣ��P�|�q s�钼2^*�������ѡ%�S/��$B�0%��68}����� ÌѾR'�Mb��������� ���������,����)ni'ov� �/n��C.,����O(�(�VD��r��K�5a.\�6���nN�&�KF9�����L���H�[�y�|}m-�Uj���~,:IL���}�S�@Y���EU�F0>��!{" G:><�Ч���Q^Z��ՓS#S-���z��:�,$P����:ӅE�'BD.鴜�({����eƢ ��?ϡ�������'fR3>�Z~�g<�����bl��6Z�q^��R��G\�Xu�� Cs$��������+yo/�:���/��ѧ�u>��[DI�(�D�[aH�/zFX��U~���Ə���=��5�ԣ+�Ԛ����j�v�����o�(��Rξ+�V�m����]N�F>_�P8oK5��/�]~���K]6D5�Ծ�^��~�m����}X)��V��.�>�Y��kh�m���Z�ϻ����zK5Wy�Y��y�������H�i�]=�oDdh��Lo����=R�^�Vɚ1�n%<>�jL�u��D������8W���#���=�Z�R���fW����)��W�t��i����J�Nk&2�~J/Q�/��Sҷ���Ax�N�6ߪ�хn%y���6 l�k��{�;�����?����pD�k����2�E��t]��\�5�ȭw�^�1��������DV�9OH�a�jN���L/�ˆX [�v� �Z�skK]ܒ�$�P�;������.�j�Z�^)���0T#�z}����!�q̬;x�{'`W6+2�J�D�W�c����q1H����e�%F��훕KH�c��Ц��@�h�y�b�{5�E4�&����>hP���ՋF$@W=J��I�(�K���n�1"�ꆍ�[��%�����]ź+��V� �<ZR ��i�l9���|2���Q=�(�|����~n42����M�z��"D�]����r���u������x�����iA�|-ƸA �&6+Yv���&H���YI]��A�D�s�ؠ�_-d��R� -w�z�jw �%!>"���^ɦW�����Ľ��`{^�N2�=��� \.�H����Cx��ʌ�X��d���5`(�BAS�U%|���īÉjeS�w���L��pD�ҡ/Q������_��`˒V3X��6�m������m�gƿ�>��& �%H��c���}���sS�ZLϘR ���ą[}i���n�q^���Z���b�r�}�ZV_�O�m�)�\����j�i�5Xi�h�A���y�ݡ,#_��wX,�E�t���ةNXc���vwni�QF��^��foVbo�E�'���T6�-<mT��Xƅ�����p�p�wnuh i�E�Ģ���a���v�&� jCeA5�ӧ��P�D�<�;.��V����,�")�U���E,��6d�^-����l�;16:�Q�|�z��go�|#���K�r��.�`:n(F0�f��� *�k_�9L�z��cvPݧӁ�Ͳ��M�k�l���2�L>���Ҁ�����وux��.��h�B8X�}.��^Z5^�ΈĿ�� ˯=�k� 6Ǚ������yǜ��u2��!��PS��@D���ݾ���)�}��>zC3�g�Ug+��iE��� �[������Y{p�t�BY��3�6��a����c�z�&bb��k�$u- ��Ǥ���v����k����I~�C#��@rs:� 9[͚�( N�4�@�_V��'�Z�����|_Ĉ�%� _���t�J;�����;�^@�����3H��s��h����o�%w�����q�O�,�g�K�̜��:���F��),5�ɩ��̗�} `r�0�������x��j���rҺ����1�fDZg��� Nv�{0���$�}B���r����7��Q�3&8���A��$>u?�����B|a,t<tzh&������o M�����F��y���|1�cw5�w�'��eQ�(�h����_�Ljz�_�[C�Ez�mF����k��e�6�m'g;���9'L_�I�))`��G̵���'��iPR�c���L �T��M�N[�;���9dƚ�;�������w���G�2��wL�W#K��?�>Ki*,����wjٸ����d���Y��Fe`T��XƊ�����[��$�;��o��po)`��B�)4��&:{K/��x���Iy��!�Si`퐦[c`m�-GsS+_��S��epz��@���깗ž��|��G`i0O�67��&���q�y[����S�Ia%`t����lh�Kr� V�K[���)]О��E��X�p���j F�{6r��֫9W�������<�N+y_7�dR���ų0Y w�GX}'M���۩�*GD��@fv��8U�'��:7;�qk�@�9��qF�wD�K)ޮ�BCh�vY�)�@��#/�/�8#�� �FW����D#h�2 �YL~�&��ۉh�L�fD{K���<i@σ8r��̏��.�ϔp=Iv�;��6M�� Z�h���5�"����t����_���eƧ�]�WW�X�pKix8\���u�<��=�8�!�/�e4�m �"�g���d|0M:�I����\=g��� r�!�x<
Behavioral task
behavioral1
Sample
3f4a7e7374da749fb4523805970b393d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3f4a7e7374da749fb4523805970b393d_JaffaCakes118
-
Size
1.3MB
-
MD5
3f4a7e7374da749fb4523805970b393d
-
SHA1
8677a8cc2f309f125d7018cdfb509cb8fd6f553a
-
SHA256
d2d2026db882c659bdd44a555be4aadfe2ff33118c4c05724b2fce1fb9e287f0
-
SHA512
206651f10436bfa6aa9dc387128991cee12f30dc0f0ad22c8787e8834726cc1f7c18d3a79cd55554fee256d3092e67d8305c9917b5ee42a9006cf3f0b9ea4a64
-
SSDEEP
24576:uiybUhRrN+L9DTONGZJ1LdbOqXjicS8mdyP8QyZoHHfn2w4mBYVzjowvjSgZ:u6qhpv1LdbOqTicS3I/n4mBN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f4a7e7374da749fb4523805970b393d_JaffaCakes118
Files
-
3f4a7e7374da749fb4523805970b393d_JaffaCakes118.exe windows:4 windows x86 arch:x86
79fe3a117fcd12a09d3de5331f378317
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsBadWritePtr
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetScrollInfo
MessageBoxA
gdi32
SetViewportExtEx
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
DragFinish
comctl32
ImageList_Draw
shlwapi
PathFindExtensionA
oledlg
ord8
ole32
StgOpenStorageOnILockBytes
oleaut32
OleCreateFontIndirect
wsock32
inet_addr
psapi
EnumProcesses
oleacc
CreateStdAccessibleObject
Exports
Exports
Sections
.text Size: - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 611KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE