�r}"g&�_��W��jR�GG��½�����]�ih!��R+5;���t�s?�v�� ���ܶ�F��v+��<�/I9qPO�.���z��S��,E��x��\�#L��2at�.+��Q���{���GI�ZyE�ت-ΰ���j�E�M���ucE�Z�X������4G�w��s�����G�~]��p�a��Ul��%.O�q�?�|�E?��8�Lw��,V�?��r���(�Ͻ�E���b��ﺭ\3��y6�i�!��|ލ�d6]��ݽSe��b�ӮR������_u�ݫM}�^G��ѥԼFiQ>C���y�*�"��Uy�w�5��ܫ:.�B3jK��#��C8 ��/�-�x��'r�$Ѝ�[��z~K �6'��W����lo�����{Qkt���>J�QSa��?o�x��t�f!��I[���l�Z�������<��1�UT�{��ۨ.�[Pk`<$ק���w����] ����x/8��j��F����)+S�˴ϭv���R&3� �Zնp�«e �P����5�/@�L\��Z��$�ƆOd��G���z����V5�T�k2P�q"��27@E���_��q��2A�� ���v�čsP�n�ʈߝ��A؇�S5a 1^P[�q�3~t�٤�� �95�#6^��U�F�ob@��U��O!0V~��ZUM�G����͵Q�����Bt4�o��]\B�AQy?E�u�dE��l�� o�u(� 0Fde������@5M�"��!Ӛb����Uԛv�hqqZ����1��H�7�Jjl����-��H�l��Ȋ`��d�M��:"0����[�ʰ�}8c�X��/o<�l[�u#�qVW��y mT'�w1�b��M�\�ML?�-�a`0 �V�I�m'�ĜF��v�l����J���O<Aal����@s4�_siOQe���ŭ�� �O�{���"�I���A�nU��RG�T���&+�sJByhC��$ѫV����ś�)`���3?����f�v$��Կ9�x���&ҩ!���Ȩ�Į�tv�_?-�įՍ[��{Ch�xݺ�s`���i֜�V��Z̻ c���v�*��x�TC�#�b��A^�+�L�u��UW��p0���Z䇞9L��%��[���ߐ����V�M��6b���v�gl��݅�#|�I������~�����q���z|�K�F*�� �;˷V��\c��*v�d�ՙ�#T�5ZoZ ��U�4(E��+��X�~�`)0|��������SO���B������ȕ鎩���0)0u����dR}�A8Ɨ"~�}��h����6��������#P0�E�n<k}L���^$q��N���D�0��\�����Ԝ���ӡ J�!�~;���C�;����E7�v+'~tr�Ja����&Μ�gCck Z��]��7X bM��7���0tNf��P�����N�����I��ET���ʕ�������r(*��_����FwL������<�����V��Nډ��4qP��4��a�7q��=p�`IOg<������D�O��WF���1KSpk�-�_�����S-�nV>Z��9�ۋ�1������ ^�J<�5��� ���N;�Rt���( �X$"�՚-�R��1e�D��$�Z�:F�ST95��m^7-��A��;��)���ݰ��� ԉ��l������Ң�to��8���Y�j������,k��T�|B������TSq#j_� +��O�W�0���j�e��/�����qk�R,ij˾J��{%��\7�j��q��JL!�9N�zr��z�?����hWr�A�_!���� ���8�����P�y)y�h�}��&���*!��TTU25z�T�)|����X�=�V�������ܶR����ݓ��'��l6�����W��0`-�����`�R"�z� /�NC��}C����TX���1e��ԕ���^r'Ή�<��Fl�2Bu0=w���$�DF�=���G�%�(�܍����*5t��sT�_�P�b>$�-q����W�UcqP�2�u+<�i�*=T;�E~���r�*y���m�����ɗ�H/KW����73(���@N��r��m&����}ڮ90u�� �E3��V��*@�r�I�����g [i��H�����I�#�DYG��n9�9�"�wU�����Aff�DX_s�sJ��˯�Ԡ%���������G�V"� pKؘ���%�X)��p��ͩ�旎�W��~�V���O�E���ᕻjZ!�A�h8z�BP�3��3��9LB��Oj���JG?x�����\`L$ ���D��H�'��D�)��~� �@�1����b� X�ݠ���[�(�gd�ggg%�0ߚRW��Ju�!x)Ԁ-[c�8�:�U����������ڀ!���c��+들i�)&�k�a/*���,�r�����4��ְ�ZF��F�]:O������C~y�߀t"]�xz�'�������C��O{sd��"�,�.:k�|���"���T��j��!����3��T��x>t�� T�)�2���lSn{�����&��9�7M X h�P�ͻ�o�wmI�i�M�����C��j=|�>����U���H���A:���k����������_c��r�T"�Vᣒ3��|Γ~����y�j �%�A��Yf�G��}L_�;����n���wr�5�����j�����b� �f��x?��4�@Ϥםm��&d�al�C�/��ZE��|$k&ߣ�5�Ǿ '�-� Mt�� ؙ(ģ���ӀRR��uډ_E�^���I��ا �o#�i���.������R��쁦�%�lۓ����Y�8��4? W�T`C����t��O(83c�@S%;~�.��V,hLY!���v/U�U� ��=�8)E�� !`�0��/l�5{6��3�ݚ6�� �APkAM��K�T��&�o$dR������.�c��S<��;1� �F3���8t~Ke�8�?���1ރ� ��)_xX�Q�q�_Z��g��#u�B����Y!Cy���ׁ�0ߪm�8�3���6a6���� �6�Iu�����k�m�H���S
Behavioral task
behavioral1
Sample
1983fc0fefde440c397a98908cc895cd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1983fc0fefde440c397a98908cc895cd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1983fc0fefde440c397a98908cc895cd_JaffaCakes118
-
Size
841KB
-
MD5
1983fc0fefde440c397a98908cc895cd
-
SHA1
ea7d5f88dc982b1be824564f9e087b07d9cba729
-
SHA256
47cd8433ee21ffa391e4ba3e7166232cfff8b3b92c681dec8658cbf02f3de7e8
-
SHA512
0dfa16c07dfbd9c01f5bf22842de495dc170015c79bb8e65b935627389168ecf42f1c25bfc97036289ab45163ddd675a3196cc048d0526b673e5f58271a73d9c
-
SSDEEP
24576:GSQDICYjyRfVw4CiD/ScU4FapEVC1UrbI7L:G5DIzOF6P+KcU4UgCCmL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1983fc0fefde440c397a98908cc895cd_JaffaCakes118
Files
-
1983fc0fefde440c397a98908cc895cd_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE