B�4�q��gBpw;�Y�1z����q��D�h�?�H��)��I��<��8��u:�wE�"�NL�G3�f*Uw ָ�+=y��25�[uc�C&Y^��Jv�ƻ!5<��f�j+���]��0�XD���H��]�ɔO��ǂ~|�1j�RټPǝ���b��{±�}r,7�'j��4_�{@��cK <='qD(������~sı��o^y����-cCD��ݺ[�-�n�[��3��Ⓢ�������3��|�C��a@3�ɇ�A�*�WF7���f�B��!��阘��������N������=<f��,���V���V̙.gs�}?T>}A�6&-������0�*��9�wN9gB �e!����k�悧�9�e^���av(ԇ���}G���)-����:4�6_��[�=��d-�]ux�.���s�,U�V������ �/������J��ܼ��������18Y��E���Oٸ!'��m�:�N�H�E*����C^�f��� �^S���9esu� s�i|����������J}�Pe�A�Na��j?E��#2��!��'b�\�Mx/�J���q"մA^u4�,{R"um��_�����H��*'|°ΜtO>��P�~?�� ��V`�>!��4�Q�69�3�9�S�S�8=sz������c5��_6��� '�a0k���5 �J�A��1�0��/lI�bI-g ��� B��W�?�����PU!<7�ދR��Me�b�~��V��6ό�k���*����E��p8��w�I## ����t��F��DB�5B�w��@� ��f�Hp�=��r��Λ\�V���>���.�r��Ђ���{����O�ݤ<?9\�//�ؖ��ٽ�q�6�x�.�� $0���9��`��-��'��&��� q��+�P'��i���c�~s��!�Ez��@�Ć���l�W#�mQP���ʬԬ�~9�}�Q�䫠Փ��I������d��@��Z��hJH�a�ue�������*�v_�^�)�{ Om ��C���c��c�:������Q>�J�\jpSR��j��(�*����/,sz � p�d۪`����J%ht����6�.]\㓗���2/�����p���l����/�Gh� [y��抙W �:���P{�sC�o��+��sx]����@E�e�v(� ]��,�F��.��=��Ug07����`���E�f�p����'�O����Ge��π����o�;�CU����XS ~a�7yH�� l{���֙�y�,ܟ��>4쯊����Z���u��K�� P�{[�:C����zp*4��&�_����N9;B�� � Δ�~�\֣J��ǡվ�W���n]h����b�b��%�(4$a�%��^�;zҚ�����n�����3}�\Af�_o�uʟB����"�V���ŕ#.W�5���5'��A�Of7�L���N���\N�Sl'�%���T����?h�A�@����h� �|9��N�����VmBI�J�l���^�U� ������F6��3���9�E�V�k��1h���B�]8s����Ix-E��X�7��~2ʆ�����`e0s���f8����:ڎſ��_��O�n�%o2���(�+9����V߹�4z�(��ɝ)LN]��\���Ŭ�b���cKv���+d���� 4����>�.(\<7��!���Y&_ 0ݝEsn[�N��}D��i���-�<n�]�.o͚�Sitt����t�6A�1�VE@r��6`\ǽ����%������N�lZ��u�\8܄NG˥c��\8�s4�(��nU��虡mT��bsCm;������\ڵ����"��cp(v/�c�eCy�&_ �5�Z,Vf�����ik� 2ί��F���� )9܄�������I�͉��tQ�8t�$V�3u��oX�6a#_Ng�`�a���O|5ǜok�a�8���T2s+�j��ֆT�]�SU`6��<8_��,}bng2��+�sT�`G�}�<� 1W� �Q�k3��結��t!daT��eB�ֽ1]����ڗG�FP�e�*2�u��x�(�-�vV��1�������_8�BM���"�D�мl�0*�T�E������N�6'_ p������9����8��G���a3]j�h �>��e\^�~��W�x<Sݮ�v�Y݈�� L��+������Q��o�N���d1D���<���E�ۡ^ +��H`�m@WFS��G^���G�Qgx��L�[,/�HS� ю�Hm�t������3�r-�G�>��Ծ[�x��a'�������z�'��?�8���'��aE~/�D�ȃ���S�����%��?����84��F��ԈqЗ����4Q`�PfuM�u�$��)��y��qCٌ��݃�Ѡ�M�IX���{�`�<�"�n�Qsx���'�;���}��o��>�6�(�#O���YEU8��F��]Y�;��;o[Z�����N�.��pE���h��1�z�,���վT�y�EZ��0{y9I�у���AHm�.MǦ!%���haJeY<섃2�Y��N��#�d������қ#l��߷L_R�9�t�R�SN;�Т鵲��`����D�5��y�r K˙�H�4n�v#-|�oi���O�_��Ũ�tP�{�$8��d�ŏ�6��K��)Ě�Q�<��잩k��-Y��/�C�D�}��C�����q��3oKq"�|tRC���}��(���5�#��!�����Rs�ρ��DU; U琢����]|ps�j�����;Ӳt�i��'5�-BT~w����}1���jp��* �d��Q�cd��~��!xwb[�O}��ou,�1��,��;>�NM��pIa����P9K�^��I�����$���,ў@�� IA���ܚ�?^NkO��H�Zs�5�m���#�v�(��f����Y�wR9�B�W�f�t�S0n'��K�����.O�We�]^l��(�]ZS�u^1qۇ��Hf�Yq�X�!����A��#�=�����8����r��7}�<>+�
Behavioral task
behavioral1
Sample
5229fb4c17c9ec436a114b440d993cce_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
5229fb4c17c9ec436a114b440d993cce_JaffaCakes118
-
Size
1.1MB
-
MD5
5229fb4c17c9ec436a114b440d993cce
-
SHA1
da2c783dc5320bdabb5e3fb4e47b356071b60fbb
-
SHA256
b7a21b421b5650a04c7deaf2bf37c4c1e1fa97916dda3436467a4b4d1ef580ef
-
SHA512
b712e26ca40571469541f7af558b0d50750d01431de6f1f81d6d61771194d97dd0b0b70b1cab05c4f1683d50cf501e17834eeb8227f424718683786976e13eff
-
SSDEEP
24576:TTwBPxVW5p+huDNjFmMquB5AJ2lHEGCbYB/:T+ghpgMdBQpnbY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5229fb4c17c9ec436a114b440d993cce_JaffaCakes118
Files
-
5229fb4c17c9ec436a114b440d993cce_JaffaCakes118.exe windows:4 windows x86 arch:x86
6b4e5697dc02f06c95d5aae99d35cbbf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
IsBadWritePtr
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadIconA
gdi32
DPtoLP
winmm
midiStreamOpen
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
ws2_32
WSACleanup
wininet
HttpSendRequestA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 448KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 902KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 996KB - Virtual size: 995KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE