���텉u���ԯ7��r�FWk�dc)sU3;�5�����<~>s�Zc蜦8f z�Մ�+��q�]��Iߤ���hM�n��JP�(�e�8�*�eB����%��I7��V��;�p.�gH+���P���?�|�m����M!�A6;E�u����ک3�9<�I��u�Ȳ�BM����}پ� �_.s�DSd�Ӽ�����!>���[^1}ʏ���S���"�RB�&���M+1��7�x��f�Ž$��1����??�Q>R&m�w}n~ܔ�o�1�3���vf�jr�њVX�jH�Y5 ��i�o��kD���,���m�|S���7TnaZù��1����m�� `��g������eb"�$��ݹ�4���K�<��{v��ﴥWL������(�ڌ�-��ޠ��� :n�>��U�c����%��{��G��,�n��8�x����f���X��'�\ "Z��[���5�c"Lɞ�$]Lڋ��鎶�i+zľ��KAC}�e��N<�E�;���4/^At�@E0��"� ��=�{#�[���}�5<���Zq]]�/��rR&��c>/ʌ��]$?CS��R�^^�PͰ(n��p+���K��ˑ���z�K#�+�hL�Ц������$V���I����a��� B��7lv�����Ha��XJ��d_�0>5Vw��v=5V�����#��3�`�oE2]��ݶnj��,�@�3�e�d� �$y������6a(��Qڵ� �k��+?4�N�����M18�_����e��S�*1/*����m\ڍ��w V�)�֥��U�� c����X*i� ��Q�z��������M:!Ȑ2�4h��$]oU���k���,�|�h%b����(���$��i�cC� �TY9yk����S-ʂT���;�_oy$CT��X�;n��0��9�lu�Ut�x"��O�ͼYq�p�{�9d*.zZ>���akH��������.0��6O�w���F�Gmټ�k��ELB{��m���Pq�Sِ'��NN�E?y�-��.A��S����I��h� �-bW!�h/���uRs�u��<д|*G�`�*o�uAΠ���yBb)�[�pP�bͯ��ɟ�����O!�'27��%W\���z�ܑI]�_ ��Y˲�B��� ��_ԏ��'ft�g��b���Ոz�����R�G��QӅ4x�2��Qy���W�`�q�"�7)�U�0ƣ��q�z��x�!O/6!���T]B���%�Q5�3e��Yb�PV����V!��*ny7��]�8Ws�[v�`E]i��1ۀiߏlYy���+Z{��د �6pW���S֛��]��F�j쥳\��nCj.��è�M�1yM�ICp^�>Ok�mV�d.��=�JϦ�����1n���v�/����$����f3��W}1x�`�&�&f��w� [��=V7�z�:���& KT�LT�=}$��K�eu��oh�I�����qH*��%|�!����p�36�����!'�b&�k�}�j��9�F�ٲNd���2I����\J�����Ѳ8�p5i������8���82��%�i7�" 3�����?����n,��2sG3%4o� S�7}�d�o��xI��cp��a��:«��"ݾm#��S�;X����}��[���iyY`B����"4�2�����Ә�6$W������4D��4 D*�������~�"�ʲE6��SrD���o�:���JQ�^T3<�FP۟]�ɻ�j �?�`©����Q(7l<����%.�˯=�QAK_� X ����A,�[sGEDt���$zU�� �}?��/�='�h:"��1Oa�Y���C�_Ɛ`���{n@$^j=u��G,�K'Z�hj��j:�V6��?.{h�t�{`�v�.��|L;���Z�f�8x�+�F�Ֆ´~؛g꽨!L���GUه�`�A�+Ѣ~������C��q+����/\��/�x��h��r|?�����m�3��-�j%[�%#�ib��/���%j��f�T��1;���n�@�V3t@��S\�sE�_ �r,�O/�{�/�j�R����t| &��@9[P��hu�/�V��z��wΖ���,��i �����Zce��\�% �ű���&وj�����o�ٍ����sa��Q/oCi��V����_�27,��(et�G ^�7b7���"��/,� �h��1���2Jsww8 ��0��/��ޟ:0U^eN�����6�N ���j���[D�R�ԯ�h�f���(yL��i�C�D�`'�������O��wñ��1U3�fi���.o�y$}g� K�s/�C_����D);���3�t�4љ�Y�Wb>?k�G��l��R��PH3�� �48i��ƆE��R,T�xQ��S(��c��Z��i<�'��Uok��p:�\�c}|�}�B�"-}+��N՚�'������U� �R�$����������j0����6-�������o��w�[�sĚnxO�ֿ�=���[��*���[��/�]��Z������1O߮�E7�ԈW�� V�F��DG�K� �z���Uڅ��Z!�n��� @��-�uź�*������ogg�/Bb��"�+zU��0���R � 9 �v��� t��"�3漉k���=;�0q���@lO���M{������֚���Gl��i����_<�um�rX#Q �� �����2�`������TJX'AqBݑ���k7Ѹc�b���P�7 ��kx�q�,�������笽�- �kV�\���<fjQƸJz�������aZkw�r�B0���ދ��ᾀ���W����v�A������4ː'����B���ڌlm�C~,(76]��N3����z�͒Qg9�[¾�`�Q]�_WQ;���]<!.�����q.�3եkk���ƈ��EU`��� �ޝ[��!%x^�3��j�M���GEw3�546]�?r���8��f5��F�5P]2,8��+�t��wڦ���E�3�5q���W�e�{J���!��ܚ����k�e^u�Tk�-�͙=*���-;IT�U}ވkƟ�5{
Behavioral task
behavioral1
Sample
4404fa824a02522892dc427951c5da24_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
4404fa824a02522892dc427951c5da24_JaffaCakes118
-
Size
4.4MB
-
MD5
4404fa824a02522892dc427951c5da24
-
SHA1
1897df0a72abf8858f2d54235f65dd33b3e063dd
-
SHA256
684b0ce7480ef2c05e28054148b94e776ccbbd50f9222d65d31da14f0fe126a7
-
SHA512
a97dfdf13a38bb3e49bfee67a1c15e3cf33d51bb9a12d9f66740cc12f16458dd31200aa61fba139f125c96c53e4dd66d9f3207e09859363e5fbd276ac13c06f5
-
SSDEEP
98304:H4m1fGBp1QjPCV+yi3ribcjqXZzLm/FettSVyfl5kHXsPgPvH56XYHTlxM4tBwe:HfJG8Dyi3rccA/mHVUmXsPKvHbpOFe
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4404fa824a02522892dc427951c5da24_JaffaCakes118
Files
-
4404fa824a02522892dc427951c5da24_JaffaCakes118.exe windows:4 windows x86 arch:x86
96ad91627a9fb9b6f0ff1d096f7c2aa4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
ws2_32
inet_addr
psapi
GetModuleFileNameExA
kernel32
TlsGetValue
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadIconA
shell32
ShellExecuteExA
Exports
Exports
Sections
.text Size: - Virtual size: 412KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 352KB - Virtual size: 350KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 352KB - Virtual size: 350KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ