i�ڊ��I�Ŷ�S�zEOGeʶ5Y�<��(��]�ru�|Y�\��XƁ�5��2[ʇb�Vh��n�S%D�a�O^(l�L���Y����nN��d�A�=CZ�М+F����d�k�6�M��O��&��8N��AA([\���G�����ЍCt��������=O�����G`��H�ne�5f��(Z*$���z�4H%�d���e���"�)�<= �%� ���ೠ�3D�����/%`fҩ�=��e6�X<E�fqM��=� ��v���1�{��O������>K�td�����}��l�������9v;���O���1vW��~�e�I�&P�Ү��;�LJ�'��q�����`��v=�8#K>p_� ���]6����q������g����z ���sT�Y�ϰj����tY =2$�v��G�PD)N�1ȝl�v�J� ��ڱ��w�!���<wg��jB�M)ׁ�x�>��+�Ȳd�B�D���P��w�.��=���Xrߌz��h���b�a)I:��R�A/�_P���ַKF�f�:<����[���m� �b��)����o��U^��a�|.U3��?������U�o���cCȁswS�|/�u���[U��ˑ�T�_���;�4@�^���1�ML �E�.:N ����u"�x[���q�� ����'$�F�s#�1ū��I8���J���p���T>���6���ٌ=�|'���b��]���R���>��B��<E7(Y,ʍ�ݲ%?�(]�oW|ɰ ��N��)BuW�z���� ��>L�fz>v��_�b����c�Y�Z��^�0��)�2�7M��AL\W�$T4E��[{�Sg�'�:����ͪWʍv���d/r7_Qܺ|!��c��s�8xs_�%b[M���X��@t��eQ�G˲YL��H|HB��%/J���R���o�FZ���������!e��X��� O��~&�A�[A/�D���9;����m�ʌ����v�%傧���B���������N'���*��H.u�߽1B��Јnw|�~��R|�'�>�ѭ�}�a,Mgٲ[y@Bu+��e��_����xA]�&���Y@*g�� mtf��o@t>��aPp�p!���BԀ\��.Y���� �-a5[�>��gCr*�;ķ�/�}��_��w��HYO6e�B���4O�����u}V�_�� �s�>�[�Rl��#:� �n���)��=�/!:�U��Ҕ �7�p�uDvJ!uH i��X}z�m*�٠Z0C)~�!�iҔ���gc$�*��w�A�K�� P�B�� 'h ��t ~�s��*v��������v��d�������X뀖�!#ߧC7�����s!e�98��RL�k�E��\b}9U�2hxv���b�X�L�����Z�\3hF/Ɋ��>XoϤ ������-��I'�@-c��v����{>�I�H������¾U���""Qe�N�Yp$!�ͫK�^;Q� ϏE���a��������k�i+S�T�xG��+�����v����BW��7���bȊ��{�O,��]�� S���!� �o6�P]A]��48��/�F���v����=����`�}R��`j�p�ը���b�wD��ҐO]������oD ���5x� ��LOY![�;��J���Vξa����?X�2�f��/��uAw��2�K�X�Xj����9�#���M��SSa�w2gB�,<c]��g-&�]�Og3����3�JZ�]wf����V��4����6��֞h�gt�"�>��y�VMPQDe<�@)T0��`�:]�Սv�^lދ�{�|�p�����,L���\TA�����Dd�B��fW�"4$��,h21^�^p8d]��.H�FE�D3%�m�x�U��"-�(���ɹ� k�^͆��Zխޠ�d��Ń�Rt���@ָ��%�@�`��2w5A_�o�O��>�'v�߳D�sr2N��KN� �6�KK��Ɔ1��s#�,t#��b�=�s�@cpb�G H>�K���H�{�Z"�\��9%w&��v�� #G�bǝy�0�ŴR����} $���>J0��U��BD��%b������)��=K�rp�ۅ�5?HB�[9����9�7r=t���\�8kg��r3��@����4��z�N ʮ���O4ӻ�_�s�"����A�=��8"Y{� S��GB�ݗ���ЌF*%����|i�̀�m�����Z|�U�� |�ǂ�ĺ��9��v�Y"PW�Ҋcc�����X=�b{pg ��,ͬ, ���)[��{��%�� 5��U�$�����Q'.�Xœ�W�?����q�;C^��yȋ}�<j����Y���m��<A6?RT��`���i��S�ԵK3C�d8@�à��2Y9�#�Ѭ3c���!``������$؝gk���o2�#��/[�^�4��b�reGf!ϛ+%�m� !��B�VQ�As�#2RIE���3+uB�*�����fS������ݰ�zt�ci�=%ǩҼ����Fjq?sDڄyh]�����L|+x�&��cEEoY[O��<-��u�x�-�������mMA��35��8��-A0�W!���f> B���"^�u��M<��th�#�.��� �df�V%�U-m��D���;�Jx��bY\�T�3̏���3�_�:_�mi�9��-��H+U�^[�Kwƌ�[�֠\*�d���j&����ԷO:_(�Mo����EM�R�����.��'B�Wp�[f ůk'�M\��gA�����9#:�^�=^�묭�0� >BL*/�z�Mx��[�P��F��V4��&(̵��,����".ڟ��6����z:t�>(c�p�U9�DN��y���T KӔG>���&��]E��lXt������`��{��=~ �d'(�CC,,�+FhT���E�MMլϲ��`�8;���\��pZ�.������pncTЀz5Johze�^��֢H!�5E�6ͨ/�'�������3��Đ Z]"��g�eR@��`o�.f^eg�e�rt9׳)�"� N}��%�F�B������B
Behavioral task
behavioral1
Sample
0a335b0df5470e8383d3119f3538631f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0a335b0df5470e8383d3119f3538631f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0a335b0df5470e8383d3119f3538631f_JaffaCakes118
-
Size
838KB
-
MD5
0a335b0df5470e8383d3119f3538631f
-
SHA1
1482dc4726aaa9ba678ce9b003639a1bbf05679b
-
SHA256
6406f4a21fef949ee901196b5ec1839cc678c4f7890b3310be79d687c2a40f89
-
SHA512
83dfafafc5e247990f3c74ba6ec08ba8439a50f49896e5d0f3ffcca389aef51abbea65579f28bbbb86d2128a72a035d25cade110714134736bfa1c44a74a6e8a
-
SSDEEP
24576:gl1D3j/nUyyY/PziFzVCxmFemSfmAxc8fYBD:gll3j/nPP2FzmdfmAmQYB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a335b0df5470e8383d3119f3538631f_JaffaCakes118
Files
-
0a335b0df5470e8383d3119f3538631f_JaffaCakes118.exe windows:4 windows x86 arch:x86
2c17677d74924b3a97191f06bac1d282
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeResource
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfW
MessageBoxA
shell32
ShellExecuteW
Exports
Exports
Sections
.text Size: - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 613KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 836KB - Virtual size: 835KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ