����:��x��/j����26ߦ�KI�c����H��0% �Կ7"]�Ϳ�q�Q�&��j���aP�6b��'Q$9��o�ƽ*��'��9c�ӽ�~^���)ݻ�:�_2�ɞ�c;�~O�� �ۏg������9R5�î�Y��>��N�§��]���P̩֗�"��9���#=� ��\Bm��8�/�����XV��'��A�yn(5��Ͻ,���<m#�[0�X�:�`�XG��t��R߭���9������8' hVЏڧ��CS�j�]�Ry}/��VAڜ�Z��U�� K�ߙ� \��*�|�M��bo���y52N��k�h��5����A���غ[zc� (�������!č>fqt'��AfW���M��1����j��]��/?�ԆKx�i�K�:�"i�F5���C\b�t����|(f��>��;~�{6��}e���}��=o�����'�Džc���" u��qUn ]kֽ�~~��F�������}5r���bt&�NĠ�m�W�1 ���H PIu�4O��b��=�H,3�m�6�;S��j}U���t&c�=�mE]��*����Z������>͈ ό%Sƈg�L�7 ��19%��F*Z.����$��d'_r��z����aBL�����YOhF�V���UM��2����][B OH����9Y\�66�{�[ձW3�3���m�m��G�KH���0�˕DV�3MP�� ���T���8����$���`B�:�؍7HsuS�v.�a���[Bme���Aݎ.�9Uz�x8�V��#P���md�]����St��5�Bw| ����1t�����yd> :�C_� 7�c�e�8X���������\��^���5��,����yҌ�6�2�M�e�5�����{�+�h�����zF��EM���M�V����tںb�G�������G�� w��� ��E%���=��G����l�~1�ӫ��2�ơ��f^ၧ���&�Btqt�_A�fꒆ���������ad��}�.�_Nt�6�����-)Tq��k�n�=��^Ybb�����E�^�wD�W�������k���"e$Iyk�U��v�����鏵�p�w������Z����hhf�g��!��8�U���.����4��53u�\�8�#���8���a�{,~�^���Ԗ���������mMjŪ&�����Z:���Լ.@�����8����j�x�O��.8�; 4u��^e`}����<v�1�w��C��h��Fnޚ�� ��?<�-=v�\G�����|�Q*ި��ƚ�8��/�axYo��'d�]�@��}��Y+��f/7�Y<b�[$�6t,� �.�Wsn�9`�q-6Ul"W�^zg��+.�*`�d��r~+Z� DC��|`�}}�۷�9�e�ՙ�;����P#�Z��Pג*���k.1G#G�Ḑ-�^������ f�����c�G�WÖ��t��TEz2[Z�Z�$?6�Yl�{4�P����y�ceD��M��l�Y<��\�͌��n�Ǭ�l���sG���Eǟ��x���jOu���~]�S���o��8�|�g�(0�e;]�6p{�%"0厭�! f�dyy��{?$�^����έAf�����p3���?i���-����Ù ]�db��0 �4|��N�m����}�[���aHb��,�-�JK^`�Fت�����r����u�B^����p�����3��/@�F�'��L euVG7�(̪��N�ɱk��:{/�M� 4��E̗V:v�b�B�n�Yߔ8�X�Bz��D]��h�`'Ad:{4���bi�[�;7��� �P��������i�t�Q��Y+��(�6���� ���B��G �0���T��W�4�~�e��!����{�-�˶t Rd9�9��E�x����&�������� ����co�C�q'��I� �W�jĝ.�6��yq��p��2ڠ�(���(JP�D��k_�������):m'i� `2G����Y�6�HI��M��@���:��8ཱི*��I����̴ y�z/ ����a�}д/�ѯ7r�8^�"�ż��g6��0�L�ڶB���֨�u��_��6�4d>ծCfh���.z1�K��@𑴥G-�I����Ӥ� X����b㫎:|���k���P���}�<ݯ�ߡt\A[��Pv�e���:�=��<�Y� ��w���lZm�J�we�����\6����0�<R�O�e�+��$;[�Od�1s?eĢ�(�l�TV�@�l����\��n�(6�7L5B�ۊg�[���t� ;�&�"0�� I�Fm,�*�npمq܀�y�&����>e�Ѕ%/'O�ؕ�0s��t�)~{\�6�6�=P1b�b�Eja33m�ц�\��E(~��b�[8�7dP����Qh5����@^stf�Ke����O菏�~��t�{DB��[���0��潮���v2ܹ��F��%*[|`n0=��H�������c�����\7�zָt��z��`�ed�/���m/�����*�r�@��T�я@�j���[�5#,[G_������:i��9�(�w����j(Z�ٴ�xQ�����45+f�:"������bC�:����PɷE��#d���v]:���B ���-=����6(�2��z��R�~��H�3'�SID�Oɂ��;#@�_uC=0�����ު�v��=�@�8a���^�1�s����t$�L�u��V��"*��\��y�����W�ڍ����@�m _^�S�ؗ��>�2}Y��*�rw���W��(Ung��_��|��h�ě 7��iF��f�>�S�-�����W�HSõ��G�GH.���h�My���t����v�B�����Bd���U��9����:��5�*�n��k�E�Z�f�v�Rnq����nT_���^Xn�7��G���jJ@�쓺f�N��2�����d����/�R�W�&B2��Zύb�պ�̊C�|+n�&��B�X�++(��m����/1�����]�� �FG�QI�t�e��\A
Behavioral task
behavioral1
Sample
60db7a6228d00df4c0c97e73a9c2648c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
60db7a6228d00df4c0c97e73a9c2648c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
60db7a6228d00df4c0c97e73a9c2648c_JaffaCakes118
-
Size
3.8MB
-
MD5
60db7a6228d00df4c0c97e73a9c2648c
-
SHA1
91f42397a9f2387246ff085dddc9188312f7201c
-
SHA256
c56a153ebd369e64ada9f5d22f94aaab76faf8614fd0ebd64532134aad5d4829
-
SHA512
593e88640a24aefcc2ccf72effc5b8316e78a74c4ae0b9cffefee270b594311449d3da74ccb307225047e7befdcb2e3a228d8fa3fbf971571fe6e307dc544ac1
-
SSDEEP
98304:tdm1yLiyUMAUzEBgQpiGE/crl0Br5B7Euw9WUa+XQGDhTw:Tm1tyFzELcGScB0BfYWhYh9Tw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60db7a6228d00df4c0c97e73a9c2648c_JaffaCakes118
Files
-
60db7a6228d00df4c0c97e73a9c2648c_JaffaCakes118.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
.text Size: - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ