O� ���tK��D�N�t��ڀ4��)���2O�A�&��l}iiqI3n�G�>{�I������V{��e�vЪ�}�*J#�3�zK�����}�G�����E_R�ԧ�ѝ��Dq6�4o>GiH���y�1��-��c_!��ܰ��ʻ U����a�O��E�����"��]��s����:?P#�)����m<�U�ij�l}��]EC�w`a�1��χ�]��l�SZs��q�9u ��U�P�۴���@�����f�z�8�W�����{mU5}�(��3=!�.�>Հ�1���ly�4�O�Q�˹��ֲ�BAJs}L|S�q���=�9���~��� ��1"1��_mM���~U4�5Y�mcX���܄�R"�)�� ��^�~~^���cC0�ץ�x��6��QF���q�'��NXPx��}u�8��6�:�{�2�\��@i��f|�(J��UU^4����T�F��Z���=�h51\����6�g1&�M���^>T5hgW L�,�F���3���L�������j�#�P8]�n���f��L��Yx^���UP���c��'�s��P�.ER*伷��K���`aNP��oY�_"$��˾��::;6},D��=h@�9FH�c�.ݎ�� �x %���<F��ړnTg�D0�W�FӦ���)Ĵ�v;��v����$��ZS���p��1N���H+3PN,Fစ�#���DLD������i��v��5����}���)�0�ڂ�D�� ��[e$�5%e�x0j�K�B�����n�QS��p4{�����I�XC�#�������r0p��J������kR�3�"��=t5e�OtHDK>���2m�_�CM�VC�Z��rt���=�N2�7.�X`��[m�B�\��{|1e�\?���ê��A���1�q_x�>���vmeT���@�u3�%/�?��9�q0Ҟ�V�6�Wi��^uO'bY�n%C��>��W㈓���p2��9ͫ�x����L��o�l�����#� ���y�f��ߞ$�h�1V{y�*��.0��S�a�7��� FS��jL�'�˫4�|�ik��/��λD�b%�˥!�����"�������i���oA#�!ь���o��E�uwP?������m��gMD�Gz"��A4��&Y���d�H��'�T�������e�d�sh��άL (�/@�dL�P<��9�g�7S��5��i)AG�H�[qU�I�l6|�ӟ�N~B �E�e�bh=ݨX�x����P���k�M�)�G>��a���LB^l��e�~랏��U��Ѽ���BW��/D����e�x���BJ�5鑗�_.~6�n���#h_�������{�4�Y��VTb���[��6V��ኘ�{�Eі&����ʖ0A��|�}���z>?R����������"���ky��+ �����8�3����l���o����KƟ�[3���`{�"����O��V\]Oا��� �����r4\9𰕿��� .3�����Y��N��l1�jT̥�ʥц��_���: ˨�U�� U�h��ؚ�ƽ9z�(�ߍKU��U�`�šXk����8���]���0�����B�����B״l�^��^�o��A����F����&��|-p��������̏�t��X�X���=�?��3ӷTj�P��Þ~3��M�� �r���`LC �Ǹ+Ę��5��d���j��lz���Mi�@�+�N��2~��8���0��6c�,�^ ��w����6Qt�"�}^QJ��1�S�TϜ�h��채�$=L��y���I� ��o^��HlO,l����Ԃ�5ԛ��ߝ�O�ɂ�1̏� ѹ�Z�P�\s"<��!pz{@�?X9{��@*2�>|�!r홸����I�� SF��;���ݙ�9�E��lM ��PK�vHa'�8o��I�iH�岍�!s�7������fb@q�QH ��.�2?�c�����_ �� �xbzVn��"��$����C����I3`I]�065b��@�4E5�� ��l��Y���z�p�_�|&S�_�L���� �ɟ�8�P`����nDii�����!�����m��qK�|�!wp����u�(aX�u�k��6����S{Y����P��X��W�lC�a>�����"�8��37}�FdT���� ̮s{d�s��}v���U`�rC9�k�,����aZɛz��E+���= ��Zh?G�)=��|���R����E�Ѐd�N@�]P�Y�>�H�!j��1N�?�y��k�L�MO�f����o� �k��� ���u�V����"Ś/�������o��o!ZT�Ŗ�u��%�����0��b�?CZ|���2v��:��d��&�A��@�a\��Q�ﵽb&Q��"�Zw<��VN� �<��-�|1,��Z8�~jb��%�So��ߩy��?͙}����uա=��Q{B��k��]�~�S�@QF��P������,�j��ه��JmFp�lE�>�}E����!���H���:���MD�}�@�i N�f_Ԯ��V��$�t�����������0�f�w��<������dH�z�;oam�=�T��0��������yb��2�Q���nNd�v��'e��d�?���Cs�H���f�������Z5����<�����d��rxӏq�R�(P"ZD�������1 �����o��<_���w,�����N�"[Ύ^�d~r�<k�]�("I��V���dq���R���|Aq5����,Wu�)��'8��Q�4�����R_�ڶ�'��@����{j8�K�Y]x��hs�G����3�!�D�XJ����6�G�� ��z�ldx���"@��� �C�{n)`�Xd��X��Ǘ�����ʪF����~�,�=�,�6GrȘ�=�m�Q�6�� l�2r :vg�.h���#�%�� aqG���Q�Ƞ�@�}��Q�<�̉t�&Y��t��NPN�a�2��U#pŽy�%Z!d6�����K�(u�"���=�go�D�`p���a
Behavioral task
behavioral1
Sample
41c91362931c39b8bd42904fbc6f529f_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
41c91362931c39b8bd42904fbc6f529f_JaffaCakes118
-
Size
16.9MB
-
MD5
41c91362931c39b8bd42904fbc6f529f
-
SHA1
8dd10b94a78d6370bca8aa03379aacd8c2f44f4c
-
SHA256
6925fa8355d781f625c145b79bcf479c6c23ff06c25821adf291e6cd83d8f936
-
SHA512
d5fe948a359aad108640b6a48877a1887671d78f0811c4ee7431698af065bd21d1809cc0d3fcde98ef0869aecd25543c5a0b0b45a3ebe95079233ffb485d844d
-
SSDEEP
393216:+HgCUyjSjp8WTnmb1upOuJWEscq3ibrdZqaHY57QajTuKm7hhj0v8fh:1yjqp8rI8uQO3jro7bfnm7hO0h
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41c91362931c39b8bd42904fbc6f529f_JaffaCakes118
Files
-
41c91362931c39b8bd42904fbc6f529f_JaffaCakes118.exe windows:5 windows x86 arch:x86
9e74e122ff6daeab4a92610375b6871d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_GetIDsOfNames
wtsapi32
WTSSendMessageW
kernel32
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 27.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 16.9MB - Virtual size: 16.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ