;Ӥ���s������e ���U��vE�[]��Ό7J�.������ƻTM��Ksr ��__���xm;Y�S�Q�L�vy�E���ʫ$lչt��5D�w �f�������"߮W�TJThT�oP��Rn5��)�x:hP�����l� �I����4�q����;�b@d_|@1t��m���=ӡ���n�i������Al{�5��)o��z�x1���No+m����h5S�a��y��>��e6�z*C�K��,�LP��]gɡ3�P�Y!��*�` �HZ�Չg"�1�^��A�ۼ)raCS��n(�- Q,U%eQg�eYub�7���Z�<�/��s�믆���-zp9�Y�j�E���IU���K�zckӫ٦ɱ~5��m����J�o�K����~^�{��Fhb��G3��6�9ΐ� ��T-s�:��ñAG��!ƈ��m������˙<z/K�!����ѬL2 j�kQ �h�+$ Po{��Sw����|ܹd*����N�����/�ϣH�t�P?�j�Q�}�^����hD�}D�&�����?.P�P�MY12��9q���7�0��p�?������D���1c�=�3;-h/��Y)]�9�3��;���*���u�LfQ{��=��Z��8X����AP1 ��J��w����:�Az<�rm�ΛKMm��ʺq��ͧ��5�}�;}1+���#��Q'@��Q.Q�"��4�J�1��W��|Կ���x�q�q�w:�xyy���[g�E�Ҋ��7 £`���>�U˱�S$@e�L1ߓ�)Q�&�Y2�69w�֬�� �9�ƺ>0�BP�9��ŹǻzD�-��)9�Ԭ���Xx��Z��u "�L]k*^&�v��DX�����M5YT���t���9W]l-���>~�5qc�z&iq�Px�����_����� �aJH~����>��������z����.I��=㑽�#�lR��2��Ⱥ�@�_��S�Ф���4�X�Q�*Ϡ��ޖG|�e�|�2%ן����"�0�R+���/{�����\�� ��f������!2��Y�J��w)��|f���dz $g�k<j�U�KS|�2=����x=��~� �� �C ��E�?�狷��di���a��w�^��0��u7��d���[��+�#�̇X���}�W���)�[�ZW1=����ᆱ���F%�P�� �t� B�0���Mp+2�#.��H.�BV:ԘU�c-�9��u�C���A�[�4F�����No�P)ϓ���_�,_�=�Ζ](���X�I���E�y��Lm�F�RӐ�2fr����(s���I�]0T�7�.���G�20c���a���DM��=���+�3w�;���tT�3�@��A��%� ��c���&�����z{�\��,�� !RN������h� �(��W6��%�n���Ȏ;��'Í������&�R�� �x9�Z+����IՔӣ��Nuv���[���ZC ����a�" T�����>זҝ$`����Gu�۽� �F��¯������T�GI�Q�zs�������0���� hto;�V��6����%�����Wl���ކ2��d\�3B_����C'�)x{�W�-$�d�\kG��\ =��e!mOJ�& Ib�|��"�;�4D��4�T��P��9b�n�A��M� �(s̯<{�KQ3�60K>V���b�p� 2��O�\��}>p�v�q��w��!�����$�������BM��_��P��;�wj3�2�zEM5���m��px�=�_3�1����Wv�Q.����x��~w 8���]3J��9��J� a+c�\���6?�I�����i�+'�ӭ�xj��^��T �N�]ө��?W9&��Ȉ�/rL��y���q�]j�ꏧ=�,�Lثto����l)�^q�����V�� ���c3�t�1Oo�B8����G"�+��_������| ����(�)����|��]���|���z" ��좜���<[k�6.����Cx�����lm����'Q��-tL�FoKb�M߷�7,�! �9���� 3��<�Hx�z�Z��8j*7�;�yop�C�b��~@��۱ybI�ݩ�W@j�����"� *}����t�=���q^z��G}{AL�B�59�Tբ8Q/�=!�H���Թ�U�̖$������k��:��֫����wzٟA����� ��H�|�2W����.�����-'k�Խ�wP\�v�����8�~!������o��J��8��lQ�S�I�O��'�re���Y�)T��a�,�rVk7�\��I��?gg�dz���]/AH��l�O��a�Ƕo�#@{�O�^E��>�^�#�J�Ȅ$��*Ԁc��� �x�+B�~t�z��9:���^�Dřw �{5+2�|�H�T���(Pe��ن�0�Ԫ)�ِ �|�d��]�l��O��!�~%��-`؝#tzA�� Wnb��`R�y�� �K��8�^Nc�m��MV��Q��w�j$V��#�z$ra.� m"v��P\I;ȉ�x�`�����&���V"Iu���g l[A�Qb -�-� ;�����Pg!���R�ۺ��V��ٜ��e�$�����Z��ä�Wr�, �P@0:I���;@���ޑ�F����g��_ �4I/��� 㖙��h�t ��!����l�b��@�R�QN����;�D4Һ� +c���������e�%I��K�b��U?����&����|#!QR�^X�m��,�y�8���`gf��������뚣>�>^+��^m��vT7����O�����`zo%�uν� �EV�p��ޥ��{��� ��K���H�<���0KqW���N˰���Q9��+�����L_`h8������c\�gy��:C +I����d9�!��^NPD�)���4ݡz����G�i~+���)"u���� �茫�`�Y��q�������I*J\'jWwD���8��[ׇ�Ĵ�Ҫr˄�֝U�OH�fMv6���ԁ�U7��~I:�o.OX5L�_?҈'�9�PLnA��3�
Behavioral task
behavioral1
Sample
1a7d977fb84ace9dbd038f86521f43b3_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1a7d977fb84ace9dbd038f86521f43b3_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1a7d977fb84ace9dbd038f86521f43b3_JaffaCakes118
-
Size
130KB
-
MD5
1a7d977fb84ace9dbd038f86521f43b3
-
SHA1
1f753521eb5dcfbe594b2f612e6434d4005ecb1d
-
SHA256
9942d2be0ff8466abc6a176d8aaab05137e99c8561b2aa09e87e66bfa5ac7845
-
SHA512
a4bd20f424300d0eca2370633364ba57bea0bf84ccf59c48d4cc707b75b489a98f8214592e6ce0cbaf57b562b5bbe3c31a075f89ce8e251298e60d8d651d1165
-
SSDEEP
3072:l86bSd61CFnepGa5AHF+MdRONNuBkkk6ihtv+fKM6E/:prCFnepIHdUuBkkkVtv+fKM6i
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a7d977fb84ace9dbd038f86521f43b3_JaffaCakes118
Files
-
1a7d977fb84ace9dbd038f86521f43b3_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 232KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ