��hYL�C�_��K�*��sx!�s@��Qϑ�UI ���ʇB�'u��b��*�����V�2=��K�U��q��Tz��*&#������@}Lbm�߀�����~��R����A��B��ψ;��<$i�E�T �i�4���ޝJ���Ěk $�H�{�~�d���x"��vF� 5��R&�lvv�}�3sm_g梖 ��62���I۩t�w��$�/g��5/= � dǀ���F�m��;�� ��{���>��nv�x�cO2��Y�y=�/j��֏&�pfA�V��/��f�p=��ӂ�+s:t��M�+���a�&l�$S/�>н3If�4���Y�\�g� �m>�m��rޱȵY���c����2�9Z�o^#'` ��d����t�6��D�=�?^Ɓ��R��_]K��z��O�sS:�c��<@I��ծ��Id�!p����0�p�����1�9��Yj��x�����L�����s��Aͧ7�T�L�@�l�����Db�����,�:C��u��Ƒ"�{��Щo�h����k�UrT�X�"ܑ��>��T�UF*�T�<I���هΩ�h�y��a�y>s0-�`-}=��x�I�� �:�˰Ȍb��� p�UB�̩i�T[:)��=Q��N��G�X��mh*�cvnL��&���j ���oA�v6����W���7��ΞN������^��JTY�Tk�ӎ�������.@�T���a�S�s�1�- 9�[���&�����/������tR�����-�������=�K2��I4��l)Q���+:E�V�1~j0%̕B���e�G9ӡoI:]_u�Ƴ�ee���d n�Q���L7F�2�0��R�7s��=���<ų�g�sg��~��*c�N{��������w��w�DְF��L_!p�)�]��@r��]��ׁ�� X�_��k$;]`?ٴ=|�C��L���@�-�����Ic�ʀ�1]Ɇ�b)L 5=�B��'��x�8����1�b����(�6��b>������� ��u��� �)��%��Cx�����E�h�g�����D�,���� ���[*d��d��J�s���& Y�����`9m��I��aw��+C"7Nw������T�a�>ȭ Zdi���0�o�<�Q���aZڽoi���Sͫ�=���s�w���9���\)��� ��Qs�O�z�B�\�!�d�x��JHb���X��yV����t��h�Ţf6����lt7몎B���K ��-3�&L?�кs�s*������'���53гp!T�jG��IB�a��C���.�[�- ��K/�jU�U'ܹ��v��C��"<s��y �*r~���טS2A� z15*�q�AJ��B+�Z��E(j�T�{i�����ѵ#C�_�p��e�ܫ휖-c������7�[��� ���=(����U�eqm���a�+�Xx�7h��N��k� ��ܳ�ƕ{AK��*�1Wv��m���' �綐\���c�]�2>wu�H�lθp�5ۙ{}�kg��@C�������"Ɲ_��˚�5 � 20�������a�r~&�И솔d�U�V=��׆�ǥ܅%bq��z`�'�`�e��վ�$��͆hѠ�R(����!8:��YFK*gG�TH�wn_����q�g��u[:N$4n�mXI�5�1Ay�P\�|n���no����q�� ��x��zS센� �B^>�0�/7c�}��k:Wv���D�Xĺo�'�*Z���� ~q��Wףd���_v| y�A�j5��X���R����M[!�* �d�FbmN�w<��u *U���H��"��DDG��.U�9 aG�m1�@]S�;��0։����NCh��$� l�����X��@}�.���m���Gõ��-�$���!�Q��-���ygFZX��A �-�[���/c� ����Y\�Z�Z-���d��q�ʹA/�%s[3F�r� ��;bv}@�]�bS��`�Z�/.T����Jܗ��1S3�����P�ģߓ�h���i��pN�O�b|���x �E�Iֿ�@c�7��}<J8�X�W���qT�Mhn K�@!7D7�t�>���D��n1m���e��J�|�3�ZZ�09�� �<]���{��n����@EꝈ_���0�O3������8����uP����f�3��6:ķf��ee�UJ ;QQ;��-/�����!�OމL�d�(��O���˓1���p �#UP4�doAY���hG_B����0F����n8���\jC�U����ҽ�� ��z��};*��^w| Ū^T'��ģ�$Q�����G��G��q�-��E�oS���}���F�G��iojL"�j;�*?-si���L:W��k@D�O�;,`V⥬�Qk;����t��AaW+�_���� ����B���� ����� *���p��%G;�2�>�>B�]�Ów��<y D���d����?65�O�F�jc�/ku���,��CJпi`"2���3����ЊN>��Ԭ����(-r�a��E�C`,��$�0��4������� ��դ*'ߊ�[^x�g��rڞ�� �y`��x|n^�}OF-�E���b��������zO �5��mw���y��s��3~��}�}5�Bt�*�6�JH���l!�\������'�;������E��:���C�0ⰱ80�N�"o��Yl)�;I��di����D���K��7�t��0��oB�W��� �)wZ/M�ǘ����f�;��?:{��L����Act`�ʁ�Q��`K�n4�"��r0�!7� �:� �ɂ��`�nr%)�M�mcM0�snP�5E�Cuɷ���}��� �)3�A>�s��Y.s�r���[@���Fxc�e?���+K�(�_���9�g��!O(�)=��F��ȸ���uȫ�~����9Jc��u�bs�Bwգ GZ(wm[I�HjW4���#�2S�v�����p�g��Ay,:{DRz�ͦ͏��z���w4g'�2DN b��Rc���u�څ�o�6pa}��Ƕ�/r�ͤ���; ���?�$)#��09���4{
Behavioral task
behavioral1
Sample
21a20fd64bbcb17376b8fa4e09ae2075_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
21a20fd64bbcb17376b8fa4e09ae2075_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
21a20fd64bbcb17376b8fa4e09ae2075_JaffaCakes118
-
Size
2.2MB
-
MD5
21a20fd64bbcb17376b8fa4e09ae2075
-
SHA1
db5612c695068e61edb9aa46f99256ab34356a55
-
SHA256
3aad5a9f4b07cc9c0c2c972388a185513a3b400fcad10af23c939a2ff83b660f
-
SHA512
fb8108dc4c362adce36799002de07aeea86656b98cab695adc0094775d2b2f6d045eef020b3c990899afe92c5931115df4c1d7aa7d9d0c8059a466479a1610ab
-
SSDEEP
49152:VxZ4riMrkJxugsON1FCg5BFXCemaHQQp5nieJGTp:rMrkJxu3OtnXCemawyNJGT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21a20fd64bbcb17376b8fa4e09ae2075_JaffaCakes118
Files
-
21a20fd64bbcb17376b8fa4e09ae2075_JaffaCakes118.exe windows:4 windows x86 arch:x86
846ff99b09dfdd42ca19c58e21b4350f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ