����������I*q��b��srFwۣ�� 6�̋b����������՛�����ffa���j4}�Ѥ �܂���aɄ0�c����w�p֡�ơ��2M�º �tO�m��fhl��5��s*zi��FV�A]�ۣ�؉�@Ow��� n&��?�9�pwu"3@A*��Z�Z�Ef�@�s8�_�P���l+_�<o�h ���j5f@�?tZ�l�F�����. ?��P��ݿ�i�=���΄��=ŮjNng�kQ�Q��*�ZNP��!�+U�w5s3�(�x1y'��P7b�ĺ� �bh`ˡ��>�w�N����I:��&�ǘ��i��(b��M��x �?D0��)6�����FA�ńqw�s�ü��R|����{�faA]F:F!�tEk+�ѐ�E��0z�E��t�L��~_����,�S,��¢�Ѥ��� ���wmU-_���d{�(��Y���e�}��LQ�eY�/���\]��t�㔴f��ȡ0N�!S�X�6�6>�����QZH�Tb�*mx;�D���&�45�T疇"A�_�H�s�N۽���bu����y����f8&��r��J�u^�_��d�����ٺC�|�h%^��,u�Hㅐج�;F ���Np�}��{���C���O̽����#�옃��Nh_n���:T{^���[)JKTk��#���o�z��s%�M��*��,��&��4�CUm�E��P��W�����ź5�n��p��t-���=Ԡ2[�: )� }m dG�7O۱�� Z��5�f��,M�'Y)X%��5��~/S�<���V^g7-���"���^%��c�m��^!�}���P���W�a�i�N��H���p�L3���2���0��)���Y&�7���(��x8c���`��'�v��ﭞ���`��m��$�����lp]�{�=<M��N��ja:��M�.=g`� ��u6��d�Ȩ�I��Y�3j�����hq�����Eqǚ,�$~m��xGp��Zk/B��<4�'/ڪ������`�n�Әѻa٣)+# z�t5�m����o͉��P�r�Y�ni*�w�s�P7��kp�{Я�/�琓�����M��BK�������k0T��3CY5峷?��n�RLh�Z��J��#���n�^7J�&����:�kzZ�f�4���x��v����멪/�[���_��3V�I��V�(z�O/���aS"������硑�Dya��Dch����w���]L�q�y�-g��:��ރ�NX�~����n�T����H�?��?t�c��]J�b̥8Z��N/�z�7sc�ӘT�\g�}&���I��D�k:��AU���m�4��R��q���3�el6�a�aB<���)H��7RYY4.�����(�����9��_�q�S��A��N<$�>���UVz�X7���7�3 d��ٷ�&��j�;7ߤ�d)mb��U�S���eZ'��3�?.�ɻ�� e�v|圍�'7(3����� ,v��i����o�,n�(,� �U?��3���*%0��K��-���6]�?�C��CR����6`0��x|X�I㷶_���'-2���5�C����=��������!^0��:Rd0[�!������ �r�;��z���� QB"�ir�0-�����B:/�|;��`�߷@>����aXO�89���t� �K�xA���'��$�6h�`zP��{~�j�\Y�N[� 96�MI��o�����Y*g �ݗ�i+}F�NeL�B�ç�/}@�n>w����I;G�1^�I8�_84!�1������<��B3�����i���4��O�r���5i3��9��nU<j����j�Na��^��5rO���9iRzz䪄��@����+�f~��\ن�����U��)�kUʭ_��K��QH�q�D�C���+�����Z�()vl��i����c~�YS�D^��������yր7�β��`�j��2�xr��I �(+�x���v�Xզ�*�� �C��ɀ�Uz��m�{��q��X�cy������vJݯ��&<�/^e�MJx�D)���ŧ;���t�%��oK�HJ���E�$q�����2��R�tB��?^�4�i��/k�ͭ���Yy�Mп嶼ե�q]��Nt�_��m�g��߳���E�dx�;��8{k�9��&I���J5�x{}��Ҟu��v��l�QТ��t� fo8�rM�3`��I�S��L�����N�G;8�zR���sTgM{q��� �5��q�o ��-�h��g��� ��(,D5j5)S�[�im]��b�?�c����7�N�9�A��\6q��z��5o [9�۾:e'L6}Ƨeq���b�b@��.���U�������0u����r-��]���v�R����h��)5%P�/���Á�e�˳u�P?:M��-[�#�8Ynձ���x�L�okO+%82"�u3o���l(.�<Ҩ�%���V9ELz%��A��f<��w�� &3�?S�d 5��<intQƛ,�D7Kh��)� ��tSإ�[|0�(@J��<ľ�T�*�23����߹J�; ~�:�S�L ��$�p �����R��1,�{E��0����$ȏp�ߌ��AU���`F$�C�drs,�&��vv �5;<Xȵ�%XWT������N���8~6Y:M�(��Kl�?�!����נ�������c�h���*�Fc���1>)���}R)^��h��~~Mˑ��?�l.��NU#��� �&\�Q�n$����~�����w�ni�#�lz��y�ݕ�(eF3��Z����!����W�i�� �ǁ%����e�h� �i�Pk3��Y���f��@C���&_Eִ��^��:%�5�yQd)H�|� ��o�֔�����^d|�)xI��ޝ\�,���wCo��: 7�߶L6f��ܼ͂!��̠�Q����E�=y3�����RKrx /�\�cC'CR���ݠH4 a�"q��ic(>i��u�llj0��9%!=�ԯ^�Y O�`.��\�<��r�}����>�K@63ӂc�
Behavioral task
behavioral1
Sample
JaffaCakes118_0f65469247c893137885b37f49118cea.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0f65469247c893137885b37f49118cea.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0f65469247c893137885b37f49118cea
-
Size
338KB
-
MD5
0f65469247c893137885b37f49118cea
-
SHA1
30cd2f989e620a5af45d256d497acc5a944c0153
-
SHA256
9a1206b183d83d5a660f38c1cddfdac17e0b6d0e7a0b08e0f8c9c404b008118d
-
SHA512
6113873cc617e45290b6325d4257a79dfc2f8ac7fb3603186f0312836f9198889e0a5b8e0243bbb58213109101e453ebee496a212479b9b86e697e29bc18c66d
-
SSDEEP
6144:bT78U/SD0DHymIoUeHR+W7ROJyS1u8+2LS4DuyimUHHChs8uS6ERR5:b/I+SRKON1uCLS4iyizHV8AERR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_0f65469247c893137885b37f49118cea
Files
-
JaffaCakes118_0f65469247c893137885b37f49118cea.exe windows:4 windows x86 arch:x86
0b946e3b176d70134ccf44937ebe670d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memcpy
sprintf
getenv
memset
_exit
_XcptFilter
exit
_acmdln
__getmainargs
??2@YAPAXI@Z
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
atoi
_except_handler3
_ftime
strlen
_initterm
srand
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
Sleep
GetStartupInfoA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageA
TranslateMessage
GetMessageA
ShowWindow
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DefWindowProcA
PostQuitMessage
Exports
Exports
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE