H��� ��F��h��`8��mRU�p�Љ�,)E,�'"�b�?ݖ�`�L)���Z��k+`d�B��Z���1����q��Q��k�P���#z<o��aª�~k�_p��sɑ ���Lv��]l3z��1�n������� �������n�(���^?@���#N?�-�j�a��;bq���X����}h�Pe^h�|�DrZҲ�wz��cGS������W�b�^4x��"|���=����p���<���B���D�V�^7,����T!��o1�?��FS����Q�K�V�6C'a������Y���[S.�6>����!�"d�)�7E4��WG���DPG�ե�������"�6�*�4C�?6� O�����r���fu:(ȬS���=S���}��������C{��枉�(nj㹽[7؉��]��>�քyx�YzT(w�����T -��P��H9�E�}zqv��m�I�y�|Y�[?���d��) 0&<]y� ��������1�=�i�1�,Q"�\m���/e.�~�%1(H#�¡�$�/j�N[j���U���~i���C z������z�B��!��hY�q�}b=܌��X#��}�����cVq�U���:J$j�&�ق��w�-���r��It���u�$�:}䗚��{AO�7�2S�k3���d�x��;s�A�����:A�Б������*5������.�H�T�z(65�U����)����4�ȭ�9Vhw,�KxA|I.��Mf7gz��+��Z�����du�d�)hYW��ϣhEM}����O)�@E�JWS'��[��7}���a�O��De�<#�aN1���^�����[�.��8��?n<�E������AA��tf�;L���}�@N�նYH���$�*Y�.� Ч�� �X䓯i�q�M��Y��D�hf]�Hx~y�&�;Ԉ�ԱT�CU��Fk3l�v��+�l�F��r��I�qN��f�� `�C��ί$YT{��`0�<XSc��N/|H�yF�P�(�����v�P�iR:���Q��� /�S�Wd�e���Y��7Ό:>����j��ID����b�KZ � j��g��B�YN���DQ*[O��}�1uxV+0��U�M��P��X#�g�,{_�tgo�f�hV�#�Q�`>�Fǿy�����s <M��b��9֣��b��Cl5��%�3?�W1��SiHA8�X�� �3*������6$�=2a�P�X�t�J�W�3��m���%���T.(3ysr&�͜��y|�\h/)��`1?���f:����{��ʏ@����)�Dz�-��\�����9h�I��纕B��N A����$��`��Ǖ\�Jp)������h����\Ż�+j��`O�]�XJ,a�.ȳ�l<D��'�G�/��g�8+\� ;vۺ��őΟTo�B�fNز,���"�e@ȑ��z��Xa�%BYɋ$��alu����^kb�\��u4(��w�@f@u;Ni\D4��.M�ԗ��!��ē���Hz��?a�B�6B�)H4Ǹ��̵�W]��/̥�O���D�y V Bܭ��� _�~�R�{�8�#Dv��/�|}��5��W�ܗ;�<�;��w�Ł��D��N-��p.j��*G���t2�MC#�NNM� *JN�����O/G��`�r�0�sz��Ŭ�m �������;GZm�Y��\��Kr�V���nP� ` �&���[G�>�`���3~� ���ʸ��8��N��~5 |��4� ����E�Z0(1|�4���j+#�gu�x��8�͡s�g� ��F�^�����d��a��P�����Od�_�n�ؼ�_l��3:U�j�O.$�gc��5�sKy9ò.[��_ih{+��꽼���]�W$�c����0�bg'�u_��r��I#��(��WNz�aVhp̼���6ЗҤs��KB�My������� ��� '�_n26����K�!w�x #�I}q�G�̎O���ґ��G�B��Ԣ?�ɨ�V,���r��9��� E�9I��|�l�@&�9U���h<"��&A?;���K��0e(e��H��Fג@�7=��ڢÝT��ԩt�*���i[DU�N��l�V���靡S�_`�x��4���hD��Ȅ��\��#�rPB}t�팹 S��\ u��T� �l�z�$e�m'�9�xx&�)%M��,@h�|˧�gV`#����\�]f��o2��2g�/L�=K�.[�R���,��ట�m;� Y8�JڬH>Z\�_ h����Z��T�SV�,��Ʀ���Ͷ�spy�Uu�� X+[7u�3D�<�|�̔ ق��HT�F�����ǔKO+Uj8�I��K�BX�<��{$i+�K�����J#�JP���.f�K;1��ybZ^.cӲ������E9B(n2�B�ҾJ���RI��C��#��ػ��h\����Q0��_��vg�V|4���R���R�H=���1�����T�p �^�N`��M�s~���;=���߹�r� �I.�e�� {Z-"�/��ۯoL�,��Qo� �,��Xj@��U@��hPw�$��h[��۩�<(\���K�����Na1y5�(�Gǎ��ښ��n����cV�L�'�ų�u�cM��$D� �m��Y�I�k���!�(�U�d���<l��P ���P1z�B6��?��@[M�<b�|-D��O��#\��vDk[��\�4��0,��g�8"UY �G��$�?�U<��ЧE[��c�{CIW���� ��y�?�dْ���b5����&� ��i؈�����n�L��wZ-���A��5#Q��#�Y 8�I4�� Qc�7Q��(�W�fQ�ܖ�v�����P��;�����wq՚���O��8��s���~y�t�a��9RJR�'��ͩ�{:{��({Rzo7J�,1�1u��pi��r�w�~@��n���N7J�Gٮ}���:��=4p�R�?�DȗY���{�jP�X�"����������I��HȞ��*#���-�:�!�U����E�*1a�˸N�wq�rK�t�\�'ߘ60�?�L{��F�x4$d�)�Ml�nő��
Behavioral task
behavioral1
Sample
11debc4ad6b9d84f30913abbc434f376_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
11debc4ad6b9d84f30913abbc434f376_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
11debc4ad6b9d84f30913abbc434f376_JaffaCakes118
-
Size
716KB
-
MD5
11debc4ad6b9d84f30913abbc434f376
-
SHA1
3932404c5803cc1de28e22c985bcb9e16f657ead
-
SHA256
596e15823876ad3c290d491e054b14df5bc83cd6ebe8e64d8f7e778b35b224da
-
SHA512
57dbbac91811f75770ad28f3ddb4370a20c22bbd493f034a940c706b190457cbb2e3507b1127d283c0a95b73fac1d9471e16e7ae91d6f7aa408620c34f06fa3c
-
SSDEEP
12288:afWs4B9RwTqv8ZVETOur6vXKeF76nHrUooyCY+F2keIpDQ481SDkLZ31A:a4tW0Oumv6eFYUooPzNpziSDkp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11debc4ad6b9d84f30913abbc434f376_JaffaCakes118
Files
-
11debc4ad6b9d84f30913abbc434f376_JaffaCakes118.exe windows:4 windows x86 arch:x86
3922ef0edfeffafb85a042db5d6e4b84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ProcCallEngine
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 658KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 704KB - Virtual size: 703KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE