p�W�����5ģ���|w�H�[I�����P�Ae��0U l�ق�'B?jm����hp��^ax�� �AT�,Ra ޗuV�*a�ߔ1%�1�5i���3h���H(O�FuZǨ��v�T�SJ��^:�����|����e�k2���T8ߕ��6��X�ȩQ��I���F !7����r�����s��7nX��85nc� ������7q��l4sA�UK��o�/w[w�n���� +#BK �X���Zla���譞��ܙͷ܃n��=2��Q$�W)WgdfP,��A�i����c�n��#��yr�(X��C�i�dU����|'~���듊l��!�D���@�����Y�& H�^��1k�+��Ef�[��E-�ai/c�e` �w;&���k�=:��� /�Jb�1.�$Q��QܫVV��s��Y�ب`�,���@P���$n� ��p<�cO;�iϦO�5� �@y�C,h�u�CM��Ո�����t�!�۾UDq����%��G��oW���Xd=R����M�];�)�O�I�����`l��ȸ�hS�&R��6�w�8ש"�v��s���a����I#<�e9r�nC�h���Su�Q�=���S��?�Tx��{H,N�ٷn��_�|�b'ߎ���IL� �����pqQFp�@M!⽠��r?є�pQ�-�Gu�yR7$Us���KF��<vC\�0�j�D�w�)��0- �4�y�e�20<��{G��t�]���W� �k����a2��#k�W�b\G�p�`���C��Ҝ_b�^4��}*Y�ر���/(��@ǝ�J)�=�R�b"8ٍ�4ߖE�f&���>��h+B�nj�>��lsP�ƕtC���X�n��� �\_�Y!�˃-�2$�W�A�r]����ٱe��ٝ t���fk�]�0��XIU� ��֗/1�����H1զ�N ����Hi�m�ڗE]�����e˵Br� ���v��_b��E� �d�Jg���o�a�goW�P���K�P��Z���������B��>_.J���O�B��K�:�X5j:��h����Ij�_��z�7��K�t���wlQ^&��j����^uop��c��E:ִ��6m��+���0�k�Y3�N^����}М�8���gbo�.OC�h�2�����T�#���Zخ- �b�#�LN2_�:ȯxz��,]6��ok쏳K�t0�C�fjS�]U����R��W-�� yd��>�����V@�њ� V����~��&Łj���P�t�;j���am��I�ۄ�Q��*U�x��#7!��M�W�KcD`�72���H��(�1ozz�+�7�)��_(TW�[2!�G#k�YឃO�d3��ƾ:��(%�x�/����!2�����I��b]=[��ݺ-�����^J�qx ���#��?����u�~���,���|�o�_!ٻ⢪|<5Si��.8��j�rDo�lz3ґ�U��4zOn�7�TA��?��zG'2m�4v�3^�W[�3wYk��b�"1�T����Mi���m�e" ��w�� eI���{�Ы���lO7���90��[��ԡ�E������������@�u�=����������Ml1X5�(c�-u��Aw��G�)��A�*�����r6��N�H���ـ��Y��{a�c��fN��Hx����%*v��9�������,3�w�*s�o+}����:K����k)�Ky.<���(Dӥ�h��Xu�%�zm��_��pZ�M��*����" ˁ����6�ւ���Ӿh��)�0���c����������j��R�������C֫'�p���?V�d��`H���ۼ�s�6@����F^8yY'mE�8�sbMR���g���f�m7N֢��K���2ˡD��ֲ��"�4����3ݥ�8h�Y�Tk��2�$Ĕ�$����Qo/�-@�^�����[Ϩ�"K)����!� ���Q����6�k�׳0����mr�x�����J���%]�M��F� h�{�E�p��V��2a:構'�s���F$?#Т��y��X���'_=�;D5�T�^�6��3b3��|\Qm����z�w�L�_��y2�9�U` ��I�M���g����p]Z�(������5��}v:lW���K��k%¿�B(2z�h^�u?E^VA�F6�|�,��-H�ҽcD���vW�w������w��a��S��߽�A� �X�.j���F;D�);C5��cԙܸ��D��Yv:Ő������-e���%^�0J�n�Ͼ�2'Ji�x����^���l���a��7,��&?o�;'Π&����_@��闔���&6��0�vDr�$f�,�����>"R�sG�![��vNjQ.���p=�W(z钾h�1���h髲;)��ο�f\���[H6Kƀ\�$��,M��~���|.}���{d����ɱ�n#�Ṳ���������_;o���x�i�%l|��]�_R��ۨ��� l ��;l�`|�tۍ���mߝW|�H���$�\o�T�މ����oQ���2�z�|P`�qwq*�{]��Q�%�W^��`�� �n�߶�t�T�B�&�a�5��pm�{0��ݧ��F��<g\�'�ǥ&ɐ ����8`�XNl��bvO��+U09����{���a���}Q��MP�͟O� �3�HG���e�3Ք�}�����ix��z�d��c��'�ilЯu��|7�F�SUf�S+Ke�y4���Z����xqqh��7�h�%];rC�l�a@�/& ��%:���W�b��{�"K~CΤ+��Au�;�+r1��'����c�9��dJ�5m�o���_�a@�Ǫpǹ_�E�Ӕ-�o���)'G3����c�&�`?א��sdHk�9��L�����-[������rm�i�F;��`!��Rd��at�B(������i�z��(+�OK\�'τ6&�/ۅk�!*Y�hȷ-���R݈8�ѱ� HO���2�6?%G�ɪ�[�"�CP:��"�;-���}$�%�Iz��Z��
Behavioral task
behavioral1
Sample
0bd7bf66648999b48911bee5b9dd64cb_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0bd7bf66648999b48911bee5b9dd64cb_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0bd7bf66648999b48911bee5b9dd64cb_JaffaCakes118
-
Size
748KB
-
MD5
0bd7bf66648999b48911bee5b9dd64cb
-
SHA1
a7fd65067a182dd926e4c0f7e57eefbd3b7171e5
-
SHA256
717616e0034962486acf462344ab84d59ab74a20783d735d3530b0fefe2c8689
-
SHA512
eb379d057349d544002d2f57970da7725cead31d48f059b3cfcef9af49fcabd5d0426ccdae4c1bf3282876645483fef5b149fe297b28e71f57677febc78aa4f3
-
SSDEEP
12288:6hE7IHcSmonjXaA0jTgpJMes9dH6ZjfpwqTv:cE0HckWPP4Ces9d6ZjfKqT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bd7bf66648999b48911bee5b9dd64cb_JaffaCakes118
Files
-
0bd7bf66648999b48911bee5b9dd64cb_JaffaCakes118.exe windows:4 windows x86 arch:x86
4778b80210b3f487adaa1a21e5bdb010
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarMove
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 604KB - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE