;i�Og��*�/F�1��p=�=>Ao��i At1#�o�&S�S�������!#e�~���«<D53g� =&u|�Rj��E j�+���&=�>)�FE;`7[-�8�w�����d�e{�!�c�σ��.�ma�� �@�Uj�1�銉��'<���%'-���O���z:c u���ųY9~���ރ0q\��C��5I�0+�� Aօ���c����3���� ~p��bmY�Ftj���-u};�ܩ�R�9���<��Xo7�;{$�/6��9>uF��"M\�S�=�T��<�X��<|�"�T�vU�h%�����3[`��_�E���=�����'����28*n�!^]� ��(q����v�B���_����Z���JRE@�}cb~�Ą�ъ5���=�Q(����?��ȳrj��j-'Fpd]��A��v�s���xڍLE�I�p�������~r_<|l��Y{?��[_B�~�֦��y�p;侽���m��Tήѩ<��S!�k�J���X�.�����ʼ.�Zz�����&�!�v|Ug�؞�� �䧬����W�;��hf��������n��⻭�<���Л���� �kh��s!K��J p+v�����?����#W��Ze���z2�jE���y��%0�ㅧ�f����k�#��',}�k�Ԧ������+D8@�_����D5��>�t�)���U�&�v��_Å�� `��AH/��`*8���(�������W�w���l�'�W�72�F���]�@���9<D��HEX�I�Qyz��Y6;��8�D���S����%#mo3�T�P��<�w��L�]��@?���1�{��e͟�Aes�HΠ 6������oIh���9��h����<u!�B�}�ְ�T�(Et$�7^A%G�;@���xg8�����{�c�ւܫ��e~�r�p������V�fЃ��Y��4$z���Q���0n�ؑ��|��E����=\]wB�!r�}:��}k_ ��h��R��Zݸ4|����/�h�߉�>�u�'�N���.r�Ō���m��]�\�f��Zp�9k���~����͜I�L���q����M�Qw��8h!M���!+Ġ�z\����ٕN��?��u�~�d��Kπ�K&�KB�ewQ]��BE���M�'*z��p�����r+�������@�� .k�� �QWw�U�����z%�$oyX{��q����oB�`��(� ��چe&�) $���m�ܾ#�;����o��V~_��=`���8�q���pp�ۇ�'_ o4�@��zwW���L� �+���c�4�x��������Y�-��}*�o'�r�;�i\m��r]�L�Qo�՟��g.Tڛ��L*H�]y(^�Yz%����3�l.y�V�����]i.j1gIW�8��Q6x�F���D��J��9�(�)��Zۛ~�Uz����s, �` ��7��R �;*��c����U���".��h,o"<x֞v�"���M��*]Ȥt�S�꼿d��z��v�2��G p������KQo�A`t�#$�<+��o �عvF+�����M�Yy� aI����|�;�����/D�Us*��ɠ°[�&��,*�����1km��_��VeX��܈W>o���}30�����`�y��9ĉ�f� Ei��LR#.SP��g�k�G@��4U�b�v��w��C�E��^q��dE���S�>5���܉P�����4��BSV/!�#�^�a����S% &C��V�.H���*�����X��8����mXj�7o|� ��d�u{ɰ�vk,.`�H�5�N �e�1��J���~��������b�06�h<%�~�@VkT�ҪN�pQjg'ю BTR �qLX1�ڂN*�9�t)����"������Ӟ�i:}^�unN,����ut�1���X�o:�j�RG8i� �+d9��=����tO���kx��w$�|�2��"=��f���a�a���#/%Wm:4O�S�+>��V��'Ǟi������uO�T�bBΥ����Ƀ� (�#��7�t�cr���J�|OLQ�C�!�@Dէ��30J�Q���[�!�a�R��C�� 81���G"��8k,��ـ�J�p�:|�X@�c�Zۖ����H�3��6_м8p�Pp�� +.*��W�Jdm�!�)�{u��U��f�j�$����c$��!9@�J��owMc7�)Y[`2������O����\nD��J� B� &���|�t�g�t��.�o�T$h�����H�����m�N�����p�5��j���/��:��W~dfΧر�40��4,Wl��`7էT6>7 S�/Fb�4�2s#����'1��f,D%C�x��j�ChU8u�v܈��LȽ<���nV��ըh�!����ltstDV��m���3l_���}��x��F����` ]�j����];�S������75�����4�R�@�6��U��� ��|,���h�W��%�(2F��n�)���z�D� �+�*S8��ُڟ�-!�)�������Ժ�$�3\�I�u �CO12���O>�I.���WC��Ų�������ޯ����=P\��JG�+�|f՜�\UDk:���B���NSn#���6!'�'��$^,���4/�rp�&�eﱪ\���˦��e��KDj"el���≕W����H�wԝ��ޭ��2#�cm�$�GJ�Y�k���"��n�1�u�x���k�U�+v~�����w<6-�S���K�g�Ik���!�/O�²�`v���a�Ri(�y��̦�7��PJt�.9!�7]��iB����qږ��7��bu��������~ғD��橞D�&tah�uHI ���-̵�u��z�����e�7�*��;oDV�r���ͻ����{������prWt5��Wf�i�ф�o��1��(�8��)�T:r;�F8U��ɦ�]��/��n+��n�;��.�Vc�Z��F1=~���T꛵= �o���u�b���py���j{�n,,r�9l�`�nͅ���M���"�G����S�Դ��
Behavioral task
behavioral1
Sample
5694cffc6411a7b4dfaf196cbbd2c977_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
5694cffc6411a7b4dfaf196cbbd2c977_JaffaCakes118
-
Size
696KB
-
MD5
5694cffc6411a7b4dfaf196cbbd2c977
-
SHA1
1113340cb503302933e9f185137f2e21f15b9fea
-
SHA256
704be4ea5320852e82bb3f23ee5e9e9717611ecbba13c713418750102d7dfb64
-
SHA512
129fbac8c0bf38670a78fdffd68327d04533add971cbafc14f4b2f9b7a01bbf12d6ebe1d397ed88512fd490dac0c3d039d83613578741c3dfde84ca264faaff0
-
SSDEEP
12288:KatfW+gdFIReCSiVr6QFx6WTAN0Ay3MdRQO5Ufa3KteuOCzGOW6/C4X:KaljXVmQFx6WTI0yQOuIufzGI/C4X
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5694cffc6411a7b4dfaf196cbbd2c977_JaffaCakes118
Files
-
5694cffc6411a7b4dfaf196cbbd2c977_JaffaCakes118.exe windows:4 windows x86 arch:x86
20669c9785e9d10d634619793757b234
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
midiStreamOpen
ws2_32
WSACleanup
kernel32
GetFullPathNameA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostMessageA
gdi32
CreatePalette
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CoRevokeClassObject
oleaut32
SafeArrayAccessData
comctl32
ord17
oledlg
ord8
wininet
HttpSendRequestA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 529KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 624KB - Virtual size: 620KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ