E��+3+1rc� �QxN�z�˸||$�-z���� tV���!���I�5��� ��f�"����IN���9�\s§2�oII�� ˏz݉�5m��6���u|r�{~�'�:���i����{N�Ϯ��̲+e�-����z�`:�^cgLW�����|\,��7�G32���Y��Ɲ���5�d��%���%0P�=mp�U�o7�qadn�Eӊ ��4�xߐ�U��E%�@�ݽ�S��O���ꂊnj`7�(��2��>&n*gЦ�& *a��Yҧx9��8��0�v�oN�9���Y�z/�Do��2Hy�ޛ�p�c���\Rfi��2��d��$�Xj���py&Sz�O?�}m?_��~,����@�Mm�|L��.':��%�+��{K����ʬ��^T�2���b���;�k}8Z���tv�2�t��8�v�/���d�N���q� �4��)����%ݜ�#�XP���qz��)aG=��jpD�ÝQ< R?���T 8�yw���4m�����w�T���M���=��n!FGH7�5XW�S�N�:�6�'�AҞ6aN-S_��&@�;ڍ.Ei ��j�Af�iO���� <�� Sˢ^,��,�n�r��w���x[��=�q�Z�@������ ���a�oL�$�a?��>�0-g F��}ݸ�3 �3N$����R���=h���Bڟ,��&�r�|'��N�CP-V�,(��G�&|I�d�q��Rj�Y�2ue�����j��bȄ����6��*�Zʄӏ�h]B�:S�����N�r-���y�a��v�`"sC�U�Jކ�hx��/�ێo��?���|�]rYR(l��}��I���6L�!�\*��"ñX;Bi_�$kݱ1H�u�Z���ɽ\ו������e��I�}����K�'<<=~�~#Z����x�� &�N��(��ՐdӲٴ��U�,�e����� �+om7Z�$�Y�tFrn��˫=Ȣ |J@jݻ�5%�de�ϪM�;��EK[v?TAm���2���q9B�����/�փ�����C����7XO8v]g6kA�^�����*���Ƽ�5T��1��K�a�(i�ޜtV�\.y�7(��jbŎ%\���F ��ʒwd���uLH+fg���������)s&���c7�Ewh�t���� �9G�ȡ/�v��!%�r���/!�;cɀ�'N�h�~ �&)8@G���^�x�r�B��7;��0�MW�X5W��+��f�x*}����c�8L���&c��dq����#� mʕ\���_����s:w��g�(f��檔v��&�%������ )���q��_��X�7D�@�c�)��Y��u����$4����GW2���x�`����ևM_�!��*f��L�lv���2�Ϥ��m��x��b�s3���A�~����+/xmm�w�L{�������Z�fP��*�ͷ}�?����+�%YgL�%��=:2�>j��@8,��� ���u�M����.+����b�e����զ�v�\�/�Jc�O���j��GtW�7IACTx��pj���)�p�����<���k��Ť���� m践#��(��I'���#GKx���C�C]��Ȗ��l>]�(�ib$��� � �Wn�����%h߳k�xo��u��[(#��.�էļ$��?��~�_%2p�fz�Dʉ¨{TY`�l ?���ǒ{yl�O9�Y���b ���Ȯp�l�S�F3%V���ŝ��:~O��� "s�f�`�F��0I]� ������v�)0�7���ojх�u��v�@C��C�@�%�4�D��>�����4n$k���L?D ?��,��I�rI}l�B<ܮr��\�W����)��^���ul��+�6d��>���4q��gq���p�����;�2��D������É�qZ?/K��:s+�0 ��c�fo���&�Au��397�ID�T�T{妞�ƙ<$ ���m�wP�b/��}�g�۵�5��P+���Q�tմ���5���W�Δ����/��Ȼ�50|̿��֦�= �R�[�;�z����������HsR��q����!W���ܹ��[t [��T�Gv�~���P�_�i'�����n9Y�V:rBj��-�ܪ4�T���U�+��G��*y�Cެ�mr����{�����Q��Ԥ��0`+v����τ� G�~��/q�ر �š�KaB�t}���V.v�:��W���!)�<�i��A��y����']�58a�d�~�T��\ ��v�� �����K�G.����q���t�%]�:a2��؆�i��2�Ao�����g���㕽���rpg(������+�j��^o���a}\s �N2�^���=#�A����m���z�~�.vٻ_�O�� b�n��^�\S��ͪw������:����/���|���J���o�Ф�v�Y��pF� �m���<�B>(`�c��Y�ʁ��`���W��ǗI���;_��ul�K]b��7 �ň8�ߛƠ���Hځ�x1��У)/��1{���� r)=�ũ͇���`&(�v����k�2�N=w7��rUy&�4��FE���pW5�O�����o������<id4[�>2��Q����|��G���$.B'7K�4�����㭃���M�)틾uz}8'�AƳ:� �����K,�d"\U�[ZB0ՠ_K7�|r�#*��$=<0$����y����v��,��2E CY~�!ư���g�t�}�Y0��j�#����� �S��,�H�Gf-x��&�pS{��U�e[m �1=��ZSqq8h���e?�.�-��S�Y�-Z�st۰"��` ���Uڢ�?@0 1g����Br�~�1��ko�o}�O��B��@k��f;?�`y�F_���(?��;,h@P#|ϥ5v�#(���8V��!�v��4��,��FI���'��Yv�J� 8��|�N{��ħ�ޗ���;��0�N���?7���16�Z���smVzY(� Nڲ>��w��������U��?? ��o��$�������� 1�
Behavioral task
behavioral1
Sample
5b084f8eaac8043d63a289068ff3bbcd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5b084f8eaac8043d63a289068ff3bbcd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
5b084f8eaac8043d63a289068ff3bbcd_JaffaCakes118
-
Size
2.3MB
-
MD5
5b084f8eaac8043d63a289068ff3bbcd
-
SHA1
b8e802265838acd0f59e0d13bb4db1301a62bda8
-
SHA256
fdc1630dceec771d62c102a65d6295a473e9dfd0f7b07c35852d2b1944cd1981
-
SHA512
44478b64b2ee8e05c3868658a039368e6c2e292a71b52825f1d112f2b57ad817506b45d9084400580d5821f94332935eb60a71962386403a0128778ba965dbd7
-
SSDEEP
49152:92bHd5DBTTc2RI4CAN4Xvu++UcB2OtBX8sH4E05ri1RrD1oJjpRoo6BFq:92Td5DNFRF7Niz+UcBjosYJ5ri1RrD1W
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b084f8eaac8043d63a289068ff3bbcd_JaffaCakes118
Files
-
5b084f8eaac8043d63a289068ff3bbcd_JaffaCakes118.exe windows:5 windows x86 arch:x86
adf36bf9f0a5db5f5fe83d6623176cc5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LockResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadStringW
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ