�/�|��g�ϮIa�Ա��A��Ҡb�"����<�I� �Pο� �B�6�r��F�Yun�~,^Fg.z���:lC���c���Nն8ʦt��}q~�?�C��'����{6�t>B���_ �Z�)�hA(������m�M̨"h<�oE�=�gGj��������Uoo�7��G��}��H�#0 ��GC�2�{)�m���sm��q���3c�N�V�|�6~ '�tXf��t'��`S��f� � �v@�tF��k��O�����f��(&@�,6h�T˺�J#l�����l(d5VV���J��x,�M1ТH-tw>�wX�;�0����eo�ܿ�>�]��}<���[��R���#��euӼQ��,�L��^�{��~���� s��س~Zf��ʁ�.f��$��p�������Z=Ք��w��q�|�Ʒ��jl�_���� �����CL�0��%;���Kh�� ���7��k ������ Kp6���sV����y�W���B_��4saJgg֜��]�X��%GZ�O *$�����[�OU(q���;�������na'�Ɔ�=�E����鸗��P���MK:[A������#ã������& ;�n?v)Ȋܐ�/R��=�����?^�,�lAZd �0�r}��ۜ�&�;��Հ:&�̕ۉ=��# �fcR���� �� �� �?����X����{��R� �R*qy1.�L���Y6��)��k�������9L��ME7Sd��2����^#6���T�Z��g�{���uƳK¼��t\)�/,�P��Ǽa2�Dw )�]��J~)����(�@pk�|$J���-���V= 0��kF,(Jw�<>g��/)��2���^����D+�D���Q�Bs���\ �'ыGJy�[���n�r���b>E�����/�������!��LNdd)�o�c� Jr���QW#��d5���i����_1M��n&X�D�@��֪���xX���>�+S��,0��;��j��UH�� �bKƘ�1�V6���h�C�����]��Q�����a0������qHUݙ�<T�\�ZMň��` ����kU�mSN?~�J!����0�j��YkTqL� �$=�zQ����o�j��V�.�O�e=̀A�jʤ��;���z�47 �r5/o<��E�F�|#B�0]�yE����f���4��Gg�vȣ��2����=pXķ���`K��+�15����?��2�bّ� Y��@�ݧƪ��Zi�7q�'nj˹fo�>F��+1�[�20ȭ��(vB�N7�k۸�FBH�"�1����ː��'~�M����(�!�\g���G�'|O`����'�2j��T����/hS�ך��|;� ���=t�*m2]��\*;2���މk^g)ڲ�\�+U�9��(خlK��1��͝��t�{���x��{����k-~j}��G4�![��d��[�"[I���@�|��$���㈫Y����� z�f�ϏR�h�$�}�B�O� �Ի^�?cn�*�^>AT%��Z�\�B�Yހ1����A�E+= R��ŝaoV��[���%&�cp��9��<6��n��-�q��Wʄ��u�cM��-��� U��wou�&R!�D�n>���P��gX�r4�VR�����g92��� ���*#i�M�]��ٸ !訤4@b����CEt0���1|��&`⢄6���C)�k����s�`A���� (nnm�/���]�(ʅ�������f�誵�Z�P�;4,jR�&)��S?Z�t�)!���h g�'Dp����Ơ+��ݲ���]Gg�Ώ�6_���2��c�K�-���v[#��hG�f��L\��!,���~�&�9����^B�~���P���PB��߽���a��\4E���������ͷS��FG�^q���JMvic�>��V9�vnt��ޱ�W��=w���|^X��'�Ɩs1�G:�Evq�ɹ�n�g�k�x���ۦ���+24���}x3_瘆�H\�g�Hw�AyG����Pl��� ǜ�a��/�}]@CU��7���"`���ex�t�c类v���K������ �aS���/�ыŶԀ� �}g8���`I�)$2�yk��z��S�iգ�������I�Z���걉�B?3���$ &1ۋ����j����6Gn|�QW��_7 �L��A�6.x�y����/������������ Yo,�&{���kj���ې_�ᶝ��b��������zv�L�̂*�-d{ET�|�n�`��,Uy�1�բ/�bA��� ���1��y��U �����t%�<�Z�)�"S߉t�_�����.{x n����؈6�8� ����<=�C�R>�S��+�E�[:k�̧5[��M6wB�PrG�4c��6r ���(dz\[҄�$T�)���ʻ8IA)�$?�B�I��~S�yl4�`��`��z���\|Rz��R�y���2����k��6���#W~�rLi���U6��g@����vq:�߷f�a1�!u��P�?��Ƿ�}"���l��e�MOy:U��jw&3d�q��(���� ��]��P�J�_i���^�l�|[ O�/R�Y� ( 0�es_ �w3����=�5y(ǿJ������^�.�zQ�Gk�9�%T�Q��$vF�;���a%� �4��|Q�]����r��詌����� ���;��v���W�d�� �L�8�����XSX�����_�Ƿvio��(�w��T%����eH߯N�{j��S4�w'��R v>p�cvHh3��T�w�:X��;Ҝ{~ ��<�Qb`e����W��I'�����/��i��WK��UC�;+1Lo%���4�0K��~m���N���XE Sǡ.�>�R�<�7?u���%FM�r^/52��i��PN%8Q�-�5F�S�2����c��4��5Xp�vah�ʛg�q�����&.�]5�՚�QYi��ܰ׆�GB9��?��m��U�~��Y�������ϋR!Ȉ#�C!J���A��{#p��z�f��ֽY���
Behavioral task
behavioral1
Sample
26561a0969e2eb5320a8407dffce5366_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
26561a0969e2eb5320a8407dffce5366_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
26561a0969e2eb5320a8407dffce5366_JaffaCakes118
-
Size
708KB
-
MD5
26561a0969e2eb5320a8407dffce5366
-
SHA1
d78d0072e1e120e3c0b0fa7d437645a13c990c41
-
SHA256
aa88537e5517d000ecd70b44e9c408382fb841a754ac3a39999df25e732990e3
-
SHA512
7d867259bcf6f9920311a1a925957fb59fa29ace72590bdb441d3db238cdebcea571600d7a09a48865429efab451a48b91e61fa2a35ea9c1acf80af5c032aa1c
-
SSDEEP
12288:FUvlVbBz2o9GNyshV79tc4rR9WkkvacUGXf9WyN6GciCV8emVqelgr7AQnzpVRYk:FUvlVbBz2EGp/TR90LfQsRc38tkelupt
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26561a0969e2eb5320a8407dffce5366_JaffaCakes118
Files
-
26561a0969e2eb5320a8407dffce5366_JaffaCakes118.exe windows:4 windows x86 arch:x86
376dddc8e33c4e50ce968f2506829425
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord711
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 658KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 696KB - Virtual size: 695KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE