Ǭn{l��s鵞�� ��S]֣��O��2�ŋDO�~ۺU���_����P��1E�i\M-��L�lB2�s�{�IH��q*�ȸ���ʙ{,f ��_M|\��i;X��`9�!�S�����{-��̝Y|���j�6}@=��dh�?��2:��-t������^��=�\�6��Yi��(��`�$���=��:_F�lm��k�����qࡋ�UyTwF����[���4��v�)0E �|�d"�N!�Q0.�(;[~Ǥt+����/B�<��aG$!_�vU$�� !�\He2%.�3�6�����Zݦ@=ϽJ=����b��M����dC+�m��s/ؑ�`K�qdk�S*�j�%S͖��ѣ$�X�_ �7/zc�����"ڟ����Ya-�g��U6�-����I�X�{w�̓�)�LT@�]]/�J~�L��&Ϝ����6'33�{��~���f�������A~���Il����g��AMi����Ǚ�-5<�d���ƒ��MD���[�vS4�+U�D��q˯Ǣ��Rͪ�r�9��!s`7y݄� H�7�3��td�(�'�AS�u����֓=]v��w$�1v��@i���}/~�4�T�f�� ֭�ѱd03/��2�2��!9$�k�N��c��ڕ9��7/�;Wd�P�0 ���[��Z��D$K���W@a�h��S�����q�gX���10�| �'��c��$��=�IWI2��f���Q'S���!��Q�K�������� �Z�GbǼ#�Z����O��4L��Iz�����D��v�Kp���^��:<���|���+c��8}͝O��Wkd����<�]ZP|�`!?� ���Ad���Ѽ��I�]gwF�͟$��(�r6fy˚㜝��zq�Ԏ�ɗ{"�˔�`��y�Q%�N������o�_8w$���i�/��s4J�saW �"�A�H���x� �4LÏ�ql��2������7X�}�B#�g���`���c ���6�'�W�k���^���q�+���L�) g�� �����$��*�C\��h�kמ��y����ɷ3�U��qn���^C^t��8uӘ�2�x �j}f�ו��5�]�z�)J�L͚�d�Z�G h���ZC��k�wHSd���u���D�õ���6�y�ü|�SI�������.����}�6�`}0R�� @,&�rI���9 �����z��1HW��Y�e�6������tp�6�Z�<�vNb���L!����O�C�[R�l�������h���y�Yc��I��`ʰ��5�?�c<Q���FSx�ۜ�(� ��g:��B#�R����IZ���pK� b�R�VL��Xv���ek$6�h��֝H�A�A���u �S�~����<��w��q�ő�ٞ|�y���:Y���ĬZ���ʹ{�C�������@p�ey�%%)j֤��vl ��ϸ������\������=v{� �/�=�����L;}gK ���-w��RB�3U����T�8��y��w��q�襱'Qj��' ��+��R��:��J�����Q����� W8��cL�*~�t�����"��4�Hm��7,�J}V<d�T��fd�B�E9�2� GfB�H:֜�>J�������?K� J�zo���V���%�s�d���2�˗��b��-���?δ�qZrIȻG�b�B�� �g��C�҇��Tba �k� ��B��F%5w��FBtz��\J���Az�Q���/�#î�v�l��I��ƅ�Ŵ�7�ͤ�U" Uڽ�1������S�Pw�;�!n��3�ߎ��*�<��U?�[o���{��o��{�dY�F����\��Q������X"`��}��� c�MeU�J����^����iq]h��6�IV��6�q�$�N�_5��>� ���Z'��;!��:��jV�q��a)>Sl䔋n��]e��-ƼY�S�G�'�N��&�<2 �=�-Fb�E����3��z��[�u�wM�s�;���q��%����`5��9ϟ՟?G 0��s��'��-�<`� ���JM)�ag����̘�0��Q�K�Yw5�pE����� ڔ�͞�ҔS<����e�rm@"�e��$���'�s��(��� C��W��5��)"�#c^nW��~F�B>��d��F�?a����;�U���/[�$Xk>w�{|�{���xR�u���O��ߎ>m��D��X+����!YQ ���utx�����i�w�ʁL��dm��C�$�W�4��h�E���ңlP�{ԁ�z�� Bg��67ɜ?G1����[Ʃ�n� at�a,�~y�@m��&�A�"��QF���YGW)�S���b���E���"��U�ϖ�}!�4��o�� x�1����]ͤW8W}͡�7F�"%y�^I "4�T����p^��/��;�����.sF%]Ă����Q�����H9A�=��r�4\EV����X�+/N,~����]���Z,�3>|��ڄ��]D2^8U�r�]a>��t�@a4�[��$�ؚ"����� ��NQUg�+=ʜ~��@�=�Q��~�$92>��˖!�CL�����Ve��~���`�V����$}+�l|����"�3���:�}�ڥNй;���,�vy�Z���ha(���w�W%Ի��z^X��� G_�d��;���"�Aa!U|l��}i:@�=��\�����bw�LVP�|Y��1�}L�6Ǝ���i^�Z��|��Ui��g�RsA �>���D� �E��B8�@pJ� �1�Z��d�5�� Ei =\����Lň�0�Ki'����O�����K> O\�U>�lʭ���!;r����tf�\�����|~�2�@Ө�u���+Dֈ���PjޟSn��ʸC��D_��ؖI:� x��5����E��~v_�g���*E�����ŇpV1�ڮ�F���]� >���S�IB:cE���w�`��BW�5���S�� �0�i/���n+4}��j* 6��584ګ�6����ޑ�uxR4bD�L��U꼫����E.��R�V%~�֚�[I&���!���
Behavioral task
behavioral1
Sample
ff911612e597dc7cc624c7bc2195b956_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ff911612e597dc7cc624c7bc2195b956_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ff911612e597dc7cc624c7bc2195b956_JaffaCakes118
-
Size
716KB
-
MD5
ff911612e597dc7cc624c7bc2195b956
-
SHA1
8cab216999067d39ae02145a869c629cd64cbd88
-
SHA256
b5cdf706315c4638d1d11d476c9d2abc5f64e630a3f4dac46e6093b3efa8b39a
-
SHA512
9245b64cfb8bdaae7b38244540a93b685dc2e6a0dc08ff1b48451cbcbf0a91835e1048db7590cf8b6774571ba5699fc6a21bce41a7fa37059e5dbe3195c3de7a
-
SSDEEP
12288:uxwhfUkdYtP/jReFP0JQ2IdY6xst0AfdNAOfbIhnAgYsFUcW2Pn:ux08kqtP/8OqY6xst0AlNRbaAg7F8Un
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff911612e597dc7cc624c7bc2195b956_JaffaCakes118
Files
-
ff911612e597dc7cc624c7bc2195b956_JaffaCakes118.exe windows:4 windows x86 arch:x86
03a76559953edbcfa48a613bd0211a1c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord569
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 668KB - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE