>���|D^�����Oq�g�Br��jhFv��5��4Y�����u�9�lo�*sӭ��0?q���4ξ��L�XDq��3G���MlOT"����R��ٕxK���:�L����q�R�s�*�Gs�T���-Tl������8]��{Wv���� <<I+mL<�ír���>��)VE>&b��n��cҙe��c�kr�����~{̿+��n�����c�*ФȏE�$�� ��Q�/�ڬ� _�K+���q+�i�ԕ�߭�/"oe('��Ŝ2g����ޱ��ҀA-�����*O{μ��ېFL_�w��=CՇ�Cp��#�x��C���O���r!�2wx}��e2خ�Am��g���/;)�F�!0)�:[8����Q42�L�������9�@@x ��5�0-��8q�~h��}�h��Mk�u�O�n��ָ�B�gU��CXm�Px3}��O�H�`���8�#{��Ma%�[�㪧�{�u<�����z������c�A��ߙ���1G�4�t��=���(ib͵I��X�j��X��[n�r���G�o�i;�1,o凜L��R�t;�!������ext\���28jB� �X�kEH���T�����58���ڴa㬥Yjenw����W�{�T ݗO,_x�U$G[�md(:�:O]�,�<�<Yrֱ�.�Z��MS��Yvt&�� y���Y �4��֏�R�|��Y额(���g�ﺖ�a6�2+]����z�ߥ�C��]��E4�U�T�;xki㵍Y@tI!������X��`�o�r9+[�UC�+O4�����7ʹo2X���j�����vJ�Ò/]�i��r�?��� Lv\e�a��U��w��V�����,�|�:�H�[Kge�r�\ߜ�bD���Pu�9��r�j�v^�^�"g �!#� *OOtbE���P9)%�Ĉn<��]�I��:�(7[�0�j��=B$Ӑ�T>a.�]��t;�/��?�)�K�C}y$��K�&�^���ި��y�-P��nˡߦ;e%Z���k��y�+d&�x,,��߯9rQ?u����Kcr~������d��ǡE���4�r�R�d�o�$ZL���F��=�����-��M/I�fL �B�6�2L�A`�G��DžB:B��Dl���q�7�ݍ�$΅+���M;���.n�+�Xȸ��"wI��X�#�d����nH����:{òh&.s���< 9Ū��x�J���hɰk����� �g���J�YhCr�Q-��ӯ8�v(g�⇷�?�ET�"�8ޱ�=�7� �(=)��a���p�+g��B�1"D�D�l����")�Qt���.�D�L<TZi���z�5�����U� i ���b��0���7�Y�m�m�4�w��L��YJ�H�n3-�P2f���*!���4o���%NL��'���[�9�1;��ǍsO�i��7���{�Y���z7|��u ��*�&�����څ,�o�?Sl�������U�e����}b��kc�%��eD�I��y#�&���ح���S��CF��Έ�7�ڵ�I2�ͳj;�4+2����Eܹ+y�k���+�f����N�t"�J���=��f�.�����8!?C�/���x&("FR��fkN��I0Қ�jx[<S�@���=���p�c���b�Ͷ wjF>����X�� ���B��e�>��^jѕ����y�a�UZ(���,95r; �����gJF���e��с{�7_4�W�Fal��ǤV~Bo�X"�y`�$/L�폶�ȩ������D�2w �q��خ��MzU�����i�����~*\L�m{i,�ڻ��B�<7�#��G@#��a�l�ͣ�����p�1JvL��yD{��<w�&�;/��nkJѾY�2��6C�(.��Vk^]W���Nk��|��#�|4��%A7�0k�,1��T�����w]o�Q$��-h�ӱI#��凊�Y�'*|�N���� ��P�GS�D@D�Q}5ʁ��pN������ҜDT����2�Q���G�_�X� �y5�+/���GX�h��j���$C�x�hŅ��*�1�i.J��0�r9ἤ�u���BV$r��k�g!j<�3��ƌ�H�'����'�`��?-���X�iȾ��ч6b_6���=_.�/&�1&Ø��T�Fv0~�9��Ex��Bz��};���������^��-+Ǧ{V�oC� �Q�LG��J))�R���L ��O��Ȑ'��ɤ��ڰ��+�]+.%���zlD������Smu²QQ�������گ�L��r&w�x)&-�����a�K>�����ǩ�8���>.'6����6J9�;~�ΡO�zV�&��@KV���48�����1���!�3 ����%���2�� ���үi�wf&�ښN��������u�,M6���{hQPh��vy��d� �"�&���jj��6���ڎ�>�M$���]jJLS�}a��T$Z{��H�/YL}��U��I��)�^��b��<�@�? �َB��\A����Ȕg��&LJZ� �K�Dו|��^�n~ ��uC9)=��L[���B���5�k)��uZ@�Rg�]�2:�i�W��y�B��(��<S-����;A����}s�ॾ4��E?��BO%n_܅��+&UA�����4,q�� %N� ��'���I��Q�I�`n�M����?n�B��l|tԜѪ��9�:f��m���B}d��(RHʇ�Ub8Bi��{OCjG���ϟ��1��.�����Z9�h���tQ1a�����3w�D��t�'l�:��0�a��T�~��C��.D�K (Ǭ�F�m<���<�]lY�S�� O��߰q�o¦���B�[��5���U%���T�^}4�$��h�gg�=��d�ZWԤڼ�ֆ@�~�g�&FM+ј�qCh�#4�U���S贊<���Վu��z[�T����A��{��^7i<�6j8=��G�Z�h]k��I�Tm6�2}��qޢUݗ�9%�%��q�UK}־�T�_a��ѱ���������
Behavioral task
behavioral1
Sample
52a466d3b4b86c5a660b2e091e65aa47_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
52a466d3b4b86c5a660b2e091e65aa47_JaffaCakes118
-
Size
1.3MB
-
MD5
52a466d3b4b86c5a660b2e091e65aa47
-
SHA1
2f42a4dd71d59800ebc25bd4ed707266ce15fa38
-
SHA256
739c510404845cebed5801bce67c9b004ef81853a9affeb0c66964781c1d1571
-
SHA512
012760fcd142545b2213101e4f199322d9a36ddc31fb2a4af066b4a6f737b6bf9ac7b6f3f9704a01726f9916eec7f9ef724a58fdc439736ea20679ac6437a9db
-
SSDEEP
24576:m6nxmt+5ci8xqdTi+NqkDourf8fHdcmw01PM6Zk1u:Xnt+0dJtDn8/+mJE6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52a466d3b4b86c5a660b2e091e65aa47_JaffaCakes118
Files
-
52a466d3b4b86c5a660b2e091e65aa47_JaffaCakes118.exe windows:4 windows x86 arch:x86
5d7107b2f987e3d8ffa5350a9b708f42
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLastError
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
PtInRect
gdi32
Rectangle
winmm
waveOutGetNumDevs
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
SafeArrayGetElemsize
comctl32
_TrackMouseEvent
oledlg
ord8
ws2_32
closesocket
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 442KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1000KB - Virtual size: 999KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE