�ѳW���UR.��q�mtN�����,cA��W��a� ϫ��d��ך��Ds>9�Ll�[�(hD�z05�� ��B�o������ƌ��I(f�����+���c��� 8ͮ�� �o������!p�7�*�%s���Z�'�6b}و���ңϴ-Ig8mh��tc�>x��^o�sv��V��z#�?P�TM�⫨��$�_8�75d��Q;�X[��#��pA���IE|��� ?��ٙ°z��I��W/�)iR��"����Z���t����js����I��,1�*xT�]\��^5B>o`(�B��^gd�{�>z���'�C���AU��F��: �#sM��Vgv�j��(�=��u�`�k-�o�e��<��6o�,x��'�q�w��Ϟ0�0v��˔t�a�PA�<��M�Mu"�����xJR����b<tB�ڑp3� �HR�R�E@�w�<��y@��?�Į�ӑ���7�������͏/�����0I��u��ق�A����@k#8�� �It6m�'��� ��_�2���vȵ��j�/�Aq��]�C�4��תy��i���3�AEo(+e~�� �N7��h\��rđv�g� ��g�Z*2��E�ej��$��p|�V�7%���j��R�s���돸��ɨp�3ވ�v�u/.Dh-�#_�HdF��g����[�po�����lyU{�-f�6�$Ď���㩧��[٤S$ �*_���\���U� V�(�D�}L���V5���xʠ��l��L�MR;��gZ�`�<f�MTՃC�,DV�X,`���F�HC�QO��������劦��Ҧ�����������@���, ��_��1V�?�{Ypm�_7a��;�o�Qo��R$� 녆v�<rI�t���:�eׁ�C���^�E��cPO���� ��˻�\ ��և8 ������m�6诊G���A"��p���8���'aA2Ǧ�����G��r����!��~����" �c/?g@ ~��I��%.�C�rY��D�/��X#���Z�ɷ�d�ѯT�䑕w��ԗ�7�Il�HQ�b�1����И"^��P�:�y��0�9� �/��V������0��Wk�CO��+�!��[;�nтE�V�f[��6NJ��\ ��gHt�gu`d�DV\�N�O�4�l͔�N��!�����G��q�!���n�����y�Z.���P ��ƟB�;.�x��)s�g��o���z��^(}c(eL�4��>�����{��R��}^�Kty��E/��@�؆��rD�d���!��U��-������P� �, ��|��Kb4[��L�F���%{����n�x���zE��5f��C���~�r��Jr�g�`�i�4�G�,�YV�/C�s/!+�-E%ؠ�U<��`�v��]cc���/|\P��Mm.�|�x'fQ�-����1���'�~��tǽ�No���EK�Zb?�s��S��zO��T�"�`��v��~B��rkF�iy���������_@���Ǯ�x�uP�?��Ve����_�D�j��Urh((#\` WP�ۂ?r��iݿ����"Q;��Ps�e,�,��Fqp�}Z��+�fK���=�#�]?,Q�$��d��+8�pZJXK�EI ���Z�=��D__ZfΤe��Kʐ���#�fl1�#'j!3�f�L�q�S&n�.l+���X�>w��h�U��i��;�XՏ}�����4K���0����phy�/�zH��LL����F��K���~6���t��X�����O�4��;l��Pw���E��P}��t�Q!�_v����b�{�.Xz"����(�n�X{T1�N�Q(e��nQp�Ħ_ɢk�Ŏ��B�>�Mݏ(�@'J ��Zy3O����+��^�έ������!�?G��f��"�~}>��HɛIx�32ڴ��j��>�0@j��E��vQ�g�ko����o+4س�eƶ��x���_)�7 ̵y����H���.78ʁMo@~Q�'��3�_x��|����$Z�x�!I�� �X� �D@�m@cX�lr4�����a��;^��h��`T7�yx}�xqoꗾ�$�&#'�-W���n��2m�:�����?�yn)��bW�-T,������2�7W����7,K��C�n��@t��m;����^$Y��ߡb��/V��`-@Q��q��0��e���u\ �\��^H�~+T�j���T#ꕇG���0L`3���T|4;�H*͗ -���EC�I.�DJ��5Ւ��(� '�]�H��H�C����l�Ȕ���#����=�̪:��*�%°�,�L�����l �*ھUn�à�!�]#������Fx{t��壶pz�=�����m�trw܁f3��>(3}��j{���'J�#�OԨ9��ф��p���<HP���J6���W����R����:V�9����X�ss����zfD����!S������B[�|��<����FTk�����رh�z���j����R�I ���v`+ţ�2c��= �x���x��،��禘����M��a�/v��ui�YY9�L�*"��)��F$�����#�5k&���#���Th� ��}C���;�B+�pQ�������,Ƙ�=���0�Lq����|�f،g%�`ZnW*�$苉��n�0Z�-h���*�7��6<�ճ�X�*&0�L�V�qa8�0���O �d�������=�������XMX='g� ٱ����S�UYcTK�Y=��n������W-ɻ����]{F���4�R����k�Q�D.� _E�,�g�GkBx@�'[�ѥջ��S��'�@lp�����銤�Hfu� ��ٓ-�5Y��q��%��Û %���-B7���oty���6�{�!�]�R�U���TK�@���馚���n8���Z+��[-(,)�j��<lt_m�{w��C�|�>���P ƆƮ>�ڳ�Z- ,P�+����;C�����j���v�x�k���f����H�=ś�t�P��ᡂ�G��67,A��w*���2ں�R$K�FPRG�)��W�'�i�k���O������UA
Behavioral task
behavioral1
Sample
165e4d214d44fe8a92f64b8b5d9ab136_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
165e4d214d44fe8a92f64b8b5d9ab136_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
165e4d214d44fe8a92f64b8b5d9ab136_JaffaCakes118
-
Size
256KB
-
MD5
165e4d214d44fe8a92f64b8b5d9ab136
-
SHA1
7525ba681b0a8a5f3294c754a1653b0517838ef1
-
SHA256
4e856a097842d9d98db7fcb66b91248dfa9d8c851f0cfebb7c651f77eb4d578d
-
SHA512
1e4dc8bfb0e8b6b5bc31eb237f59f791f3c63af601f44dd878d89cc9fb3ce78a9f544a6f6d9c850a4e0ccc85ff42cb4aca7de5473b25fcecfde0367b99070072
-
SSDEEP
6144:IKdNxZJcebNypGSx6X5fPRLfUtXr2zH/iHDCRq:IAX0MNyQMk5fRKS7ijCR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 165e4d214d44fe8a92f64b8b5d9ab136_JaffaCakes118
Files
-
165e4d214d44fe8a92f64b8b5d9ab136_JaffaCakes118.exe windows:4 windows x86 arch:x86
344cd10791ddf047143be0208efb3626
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord529
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 240KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ