Q��n|�J��].�bo�a%��Y����J��";� [��J1��b}��� �lӚ��?����kSИ���!�:%�o!;���"���]]��$���I�rMN(Hx��Y�g�|l�)��0N: R}^���<-�̀�"Ie�t�#݂�s���3rCg_}�(ix�K�EP�~����n�D��Lc8T��7_��n~��c�8����7&��g'}_��M&;B"���kS�'�k�6�y��H�?B�h-�f��y�Q#�F��@$��ac�����%AG"/F4��B/���TېR(�ER4`������u��w�\��k�Ε|�`it��/)"2얤_�qH�����߯��Y�9Z�Ѥ����FA�S�a�ᱮ�K[�F��'`�b�u0������!�?Z������È�Q(�"у�� 5xpp!�Ē��[��|�����paN���GG�w��]ri�*�>U������[:(;� �<P��X}I>)"�'%$�_�Di� S������z4]�}��l��-����2�U;����j���h�j{, 0���>6�����#l!N9Hqq; 2�U?�B��v:�U0R S�E]y������ �dP��ܙ��86<���tĄ�\�i"�=�������)R�o��ژg�;HN���4@��?�`7�BN��1t|�5UX��iď���2ҷ�Bt�.vE�]yH�'�n��k�����λ��M5�'�<[�"�!�UW.� �RCSgf�\��Pq���Q��M��=��0E��(�f��:�{s���v��ƛ�eo�C�g{���vv�l5�l���?� L���n~\�#�b܌�:���~�����HE�#��;���d�E�@)9�cL��g���|w�V���F�J�d��G�4��>#Md�I6ѧ��PiAk��-kx�ʕ)����=�r+�+��`�G�1���DiB�2�}N����Tv��(�"�������%���� ��<_>5���v�yCQۋe�K���������5�$�/l�����b��s����7o�U�˰�u����x��dA�Z`����.��%x�'���H��Rn���B}��:>adH�e�/� ]������r����xI�.�v3Y�F��F%����G� �c�*e�/��� �E����B���p![}oE��� ɐ��z�-$a����srg�Tt`^`[����j��ᕃS�o>/�b�N��R���<��u�H�m=�)g�a[����y�����@cޱC����X��{ �����1�:�tY�/25�MF��!�|M�ƹg�G��'���,ջxK�J�bd]���8�7�և��/C���Ȍ_���f�n� �hPq�����QvE_� l�Q���!P1����Jug�e���w�����D�R����Qp76 My�;텨�?l�G�[L�_m��> �S:���MV�{Lȱa��l��7ہij�!��0��� �l6ʝg��fw�)�>3��aW-�oy�X�"�~Uk����q�#�<T�>���I��ocVF���;酿��"N��z�C�����>��c��6��ɴ���-�� �me��T���<@��mR���&�ϛ3��_�tD}�a���)����� ���)�v��-v�]$�b�q F��3�%�sBN9Q; ���a�������ie4��K��I�Z��JES���`&��xS�"c�"lT�l$� &���G+ �5�w���Ŗ�<��| w+0����&��w>��qQ!l0f����y�8(%�,��Ez�K�ݴ�axRk���;rc}��jt��'���X�KL���A�,��/���`q���/��}�@AyÀ�W!�����襟S#�r��i��[�z0���և�m0╲�H�2C� p��$J#�%���j`��c����T��^��@���xF��:�<��U������#3�1Q��*��8��*����!F9�;_$ �<�rW��_!�E���m��l��;b��8T%di���ڇj.~8�>�pMBdd�q�Gf_�d<)�����xn0 1ГC���l�~ߝ�b/�ث| ś�e�(��j��`�:։�8W�������������Y�]Q��� ף�#.�H�OP�k��\UC��6MX���f��ϑ���!�iQy4s��C�� h��פ|N��v��d@���B�35vx�l��Ь=����,a3�C��B��%n6��3��܂�I��)(���A*��!U'�/&v�1xk��������6���t�m pH�ق�ϖ����������T�O�LRkȐ��a0���q�����N7XB�� �d���`�qqڄبZ�<�9�(վ@,�⊚�I�Ű�b0���N���䅱��[����2�� � ��m�Z�Y��?-5�q6��D��#V/�O�\QzW%��L�GVδ�+��z��l+�����P����jc�ȾFH���7��ؘj�$�Jl�5O���O�1`w3 ��g�H��Ǫ�*�n�-hnL�k�Y�ɚ�8,Z��]�"�8y>�W��ޡ��rw��]��BL���H�h����o��������$�Ͼ"AR`Ԓ���?�|��>'�������R��g�[gPNֽ�t3�9A#���2�@��<�!�) {�[v�ʸ�F��g ���~�x�vB}+�0�Y�Mt��K��L����ח=�F���L�Ϡd�����ݱ#��� �$�����%�N39Ordo��j�:2�U�8lPߋ͟���_D����^�qN-*���!#]D�6`M�����ߑ&���,3��O���9j)m֣4!�K�Z��qb�eޟO�k��X���+�X:/��������'GC���`)�A��ꀋD8�"�����>�'/:I�"k�����'N�vMǕ;BQ�T�(�7ߖҍ����.� A�J���cj�a�F��I�Y����6@�;C�IS�`]�(���ԉ �Y?��m��9� �������H,�d,b���h���{�(����F��9���Bz�-J����e*��&.i�?��v���Ao�9xs+�˅��ѼE"�>��j֝wHф�F�� f�)]F
Behavioral task
behavioral1
Sample
f389082fc0a4fbbe5a7c47ce5be86160_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f389082fc0a4fbbe5a7c47ce5be86160_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f389082fc0a4fbbe5a7c47ce5be86160_JaffaCakes118
-
Size
728KB
-
MD5
f389082fc0a4fbbe5a7c47ce5be86160
-
SHA1
afb79e65b22e6024a0b6b6534db9a53bb621ab46
-
SHA256
c5756a76bf45dfccc65c198802ef1239b2fa989cd29155e75b3a0a97f76c1a06
-
SHA512
ff08fa84a7ae175ddf756a2ce769e920cf34e079266b861fce5efd11b8371838d4c4db9af2114abfcca655cadbe952f5dd69a45e1e028879e2ef1c4b188e46e4
-
SSDEEP
12288:9rAQ7w6zD+jGfIQKbNBodUZXTlqoaiW2RkZ27NipO1CVfVCL9xATl1ETAo:yOwy+jY4NBoWXRvaiW2Rr7QowfVtRGT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f389082fc0a4fbbe5a7c47ce5be86160_JaffaCakes118
Files
-
f389082fc0a4fbbe5a7c47ce5be86160_JaffaCakes118.exe windows:4 windows x86 arch:x86
b928e5004a193a5a26fe9d6a25045f33
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord632
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 716KB - Virtual size: 712KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE