2�b�?t �66A�2ZΡ��������W�:��?8[�XI*�g�{tß�W�fDJ� ��ER�����,�D��L��P�Ԟ= i�[K�o�j�/Mc���<��k�� �5~n�#���n�!�|���w^�OP~�����V���V}�=d�=���RlY1���T��穮-Z��YB��p�+e�3xӥ��K�����/#Q� 3����L���Iߔ�Zy{�L�ꙇwX]�J�[��I��`��lz�}�����ڬ�������r�buq6 c=��K[��j������ޫ�b��x�@�3�D7�IngU@[��EYIf�����D{�eY�k��d���Rϔ)���A�x�9�ػ��B��67�j6�R��%�L@�b�C��m۩)NJ�����>��#�$KrD�$��D)����$ƞ%[�4��D�N���AT�{)�;�H�+s?p-���W1�[Z*m��3�g?���b���V�IL�2� �[8#�<ߤ1�j��\�8x��yZ����t|z�X���f�,'����s/�����g�ι8��4I����������7U�����TO��X0Agi2+0F�Y�]�����w�T�߾����{���;IF��>�O�y7��p�� el��)��DɁ�n{{���s���c�1�3��Ai��u�T!ھ�C�ږb��?|����1��4����P����~WS���#U �;��3�1g�u*A��&��&9ov;ض-l�{'�N6�P2�f�n�!pd����'�oY5�M��OL�#�ZV«�(��(//��~�2,�;����9���䛛�#�2#�������ѝ��gS�k�eY!�b�Ὠ ��.���]�d��Aja�����rT���N�w����<.`D���y.�M�M%O�W��s Al���d=Mv����)T~��?��$Y������������!G�A����P-���1���ʛ�{S�=gN���V`�����aji�����V�ձҺ+�����f7A�m/w�q��q��rҔm��;+�P�%����d�t^��u,��O��8���$>D��.�M""�bG1g��M����������P�SLC�PL�g���<���&�[Yh��W�ƛ�l�-i �D��]9�b��/U7�Q6q����^�p�h�V�3E�U��`D��o/W4�R1�����O���u����Cϰa�Fb�������F,%L1��:t'�f���b��'�9�=�+�-ʜo�K�)�tS�1�Ī�I:gJ����B6��]^�Y����w���iY$k�`�+���j��D��ɟMtQ���ڃރ�����C�ǣ��W�k�fB�ڍ��B��<���!ֶZ1�r!���{�mC��3i����.�3��(����)$g��r=5�0�e�)�g��{����D�?|�cj� Vfڣ[�z$ޚ@���<[����|0���ʂ�,�\j����u' �^<�p�2n�8�9P��y���A��,�u@�Z�8xy��iƓ��%��J�( ��R�8ӭ��h�@��8R= g�'8��C�]s��ա͓�ܲnI�����w �.�V4�1_m\CsW���H~}��g��^|�Ф'��%����0��.�:��]ePz�?���f&g ����=��<PZ^��Y�%z96�)���@�~q�)�B�oe5��"��PP���שl31[��t��G�NnQh�g�b�)�q���w��ɽ�\M0���_3���g��5� �&*3z�hLK6�;�����܍,BNV�-�:� ۙ{P���J/li�RT �����q��i ���n����gn����-�M���W�gi��S��l�[Qq��Ky�ʯZ�@V"�i�����[�ۧ�P�E6�td�ޱb[�S�"�BY�E��.�A+xEq�l�_�봐�&��$bе� ���@oz|�ϻ :$���/��.nx$� ���������i���� |;�d�#gM���1f$r6����ډ80qCoU1³i��g�Ջ�)�6��ʷ��|�S��q=*�3��N��ۄ�[W-�Y!Emr)e|�G�q�����\k�2n�&*[>J�Y����Ć!����Y3�Sf��ͣ�����xAsp�>L�����>����xe�� 1/���{�L+���F�i�J��w���X�A���V!w'�]a�O-˕Ր��F�_J�8X�5z��mT'"����+)eoVzL���O��0h�z7|��m7�#��K�_gY�'��E6}i# �S�yr]^���w�F>��YO���}�R���ֻJ��<�GЃ��N�i�X=�t�@�I32��ܗّd�!�xLN�f.���ɟ,������d!�8J���������/?j���Q8���97�Iڰ�7�ZK� �߭U�ϑe�>��O=�9� �|k�w�VUw������=�7�lra��d�j�@j��"�EG�d��<��N>\6H`'��ϒ����-P�xJ�q��z͜X��0V��C�M`�.j�Z��N�P��^#�Z��d:��!dѹ���C���o$��h�]�B������l_�a�4S�w��D�1���qC�b��W�Z}?��@�K��N���;K �cHǕY�g{ę���XM��]Ч�w]TG�.ѮJkn��=]"k�^`1_]�:�4�Ă_H�Q��Ά1�=e�zeb���0��$�Q,��,b��̋� m4��2���b}�Z4u��9����8����K%�h�!�� ��]����0���H��r{)/�b��+�D�w���R�!�~�r�<�����1���e�����?ih�JhO$%����;.����k����G���i��S�+�-ʑ���լƭ��B�6���bh�꺿��%��@t�o��[c�X��H_YNYg�M �h1��#=!���U��N�z�mF�����N�Cb��4��x�7@��k6�0�z �����w�EU����k_���� �K�V�����7�����b�����50{-3͘Ľo�H�BD�bQ�(�Ԗ
Behavioral task
behavioral1
Sample
f3d4424a7015f22974375dea19444ea7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3d4424a7015f22974375dea19444ea7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f3d4424a7015f22974375dea19444ea7_JaffaCakes118
-
Size
128KB
-
MD5
f3d4424a7015f22974375dea19444ea7
-
SHA1
d183dbc8a4f28b781761c95c4583a4c8700e3ec4
-
SHA256
75bd397e45a8572d71c45301476bb3b38de388ca393a396aac8c08adaf88c3e8
-
SHA512
fcf88143bcbeb623f7c1d6eb98f8b04b00d2e0c3606d7fee9685e4f0d3e37c47b5eeac41ed0b7e85520f9215a8fe2f07190be2a212607fdfd2e938d2a72103fb
-
SSDEEP
3072:3Imnb5oF+2hmB/HLrjm5ERhykI0uKM5c49yH:3Iei+2wBjrjm5ERhyKVM5c49
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f3d4424a7015f22974375dea19444ea7_JaffaCakes118
Files
-
f3d4424a7015f22974375dea19444ea7_JaffaCakes118.exe windows:4 windows x86 arch:x86
91dfe53fcb56cf791a6d4dcec0da2b61
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIexp
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 104KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE