��{�O�߱c`�3<�+ơ�� ��!��w��?�1�ǚ1�� ����R��ԉ����ɜ��D�;�Fx��Y�J�����|JY1}���ey#�^`��X� �u�5���1Q�]���ɳ%$��b�*��/�����;�zC�M/uH��>����K�>+����Aw�<�����~{�By�9W���D'�p����.a�бF&X�. S}�#�?v�|$��^�Ž%o�����0U�m�L� �%0� ��dٚ��U�Y�O��r�z�*p�cB����*���J��N��CF�R^����@y���yR%�l:T��{+��Z)Q%'�o+�#�f��w-glj\� �A�V\�O�Q�PsG�zQd�Fl��!�ҳ�QO�n� �g,̦��3�D2B�˪4�l.�QH%��^ �\7����&��hb��AMJ���\�A�L�� )�/���{��Y(e�'r�vOapv�m�����B��ZTw���/1� �X�lm��R=��#<�݀gq:����[��:��G_E��2���圼ZU�*1.���%��7O�;`<����I�:c���A1��$3� ����]v.[?Өed�90A��4Đg��d��Q�E�wu��ܷ�"&�ZI��ݺ�3.�A�PG�s۱c�^[{�$�o�J����:_d��@=��{�?���+-Y�"d���}Mv���+�H�j���1;�K *S���������3Dy�X�b��nrx���_�]r=��:�(;��7ln��7��u.�Ad����u�o x��J[{�״w{`�,� 8�1Y/$�@&i擠��A3^b�_9�����g�Ws5�e�F�Bh��iM�16|}[�*�AM��w"��®��i�j7囒z~��HN�H��4�ek���d�շ��L�݃3 ������B�Va(���j}Z�;�)+guԎsCxt8��E��i�Gz�i���W�[�N�le�Υ����x:�Փ_7��2^�`X+��$�(&�O����w�==���su2ޅW��U6__aY/.d3�!�J�j=������66���XL��,'���xL����2+e#RÈ�k��=�@Zx�&�#��itR5���}�2P�y���"rX���Q�݁�N�caI7NJ�A;�� ���ڵ�"pP%���uh/gT��E���;��y�hM�G5�)X{M��;�l����W7?z%�7 ��q � VbZ&��<������w�K���n�Xszu���t�yG��|/�'����U�"�� �Z�ӵ��j4;�ibp�=��`l,���?�Jڳ��P��@��@�7�TS©��|V o�T��9�'�>T��X��4M�D��[s}Fm�P%�^8 Ч�D�yO(*�{r�Ԭ��A2�8;���3J�~P�8���o��jZX%~r ������P��O���Pvm��� ���dCz�;b^㢫_h�=�����.��I�J#�E#�Zc4=�6�3�GC�ڛ�$j0&GvJ`����R�X�\��+kk�[�M�IߌΪ�+���g���k��E�D䕆�4��U��1`�0E2Z�)�gy�Q0��}�i�fn�h�w�K��{��g+�K�!|s��<��Di}�k�˶kӔ���9����]���0:M*���~tb��3@��Ft��S���L[UU$�=��sQ{T�i�F����:����M'�m6��Q��`��Ij�C�����N-p��;; 7rC�� ���d2h2b>N3�}���e�f!��1nh�x#AZKoM��P(^h����X�*K{?�W�aצ8 ��LO�^���K��t�8I��,i�Bf�cL��B�Yk[�ޠ���X�ڈ�N�_���B�����\���\/��(G��$eD��]�吙J�A`b_� g��;�(������L��Ms@$,U���-�O���P2���6�I��s��� �֖�9o%�sxν#*o����L�1B�M�n�_(UUrYF����L�^���Wܱ~�P�q/S"h>��z?��B�����ʤ��|w� ���Y�י�7��q�T4��r�!��~����6B�`5B�K;���m�ҭ G�9cd�� ���|AȞ��e6����p���^�E܈�� klj{�����S��ܜ�Zu���W��i6��U�D�A�Iq����N�I�Dp�ӏ�6R��w�u���o5�Ӕ���kO7=,��ET������2}����"w�Ñ��]%��X�>�)[[�X�Dp�su�Z�g�v��}�|�=S�q���=����0�&v��Q������&��ʯ���"�S��32�HK� Q�p� ؾ�e58�[-]gq!�uW�ʼ��H?���RȝC�/A�����2�K��Y�CX��OEU��o���W�sb�?H�{5��U�����(������nG��En���l���!S�������Г"�kԀ�ɪ��8Q��R�'f{��y�����˦)�;�W������^�C}���l|� ��x�RQ�+��H��ji͓<�p��j֙��Q!�,U��E:;��joֻhG�pi�-��cVz����፟���utW�T�S�����l���6���j�j�V������o|p4&s��_�3�������8�����*b�YrD�݃.̈́(�S�,z&ș�ȿYG+��Ķ����7��;I��+ܲ�3Ie����Hj�x�&0US���r�*:6�벨��utLF�}��C�( �ٗy%)#���R�v� DzMյ)ۓ��+�M��(s��p�Q�t]� �}p;p�mÌ��D�����2!m�⛒���Өٲ����8|b�h(���*��M��1\� H4��)���,���K�:��3���3[�z����S�������[p=p��@�\������J4"v����r`>����^� U˯$VY殟g4��<� �{����҅�ˈl=֬�%��\��`CD;���Ĕ��]H�ݜ}@Q�5�~T�������Y-i p_Uvu�G��ȱ�Z�g��]W���*�4 �����#�2�v�|#�t�H!Az���H�7��?9t'�ɇ��zD�=M̴����+
Behavioral task
behavioral1
Sample
2868234edc148dcd29fb9b3a0a9ba9e2_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2868234edc148dcd29fb9b3a0a9ba9e2_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2868234edc148dcd29fb9b3a0a9ba9e2_JaffaCakes118
-
Size
96KB
-
MD5
2868234edc148dcd29fb9b3a0a9ba9e2
-
SHA1
8be5081299a3bba46a5f12f086a3dc7ab8f091d5
-
SHA256
50f05937a1480b21b0878c8b65a817d1afcafca6469da895ad2ccfa16a1432db
-
SHA512
75d4d74f2d3519c9f9f1c43b6859ae8502d1ec670d4ac968f6fe256229a659641f80935becb0706d7a72677f6ec951acd5efcc6e7adc984772512d008e80c4cf
-
SSDEEP
1536:zTbFP7Zk8m7Ma/qVhvfY6XxddOKR9F+r9f3q6d15xlg68Q:bFDS8m7MaCrHbXdQr15Dc68Q
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2868234edc148dcd29fb9b3a0a9ba9e2_JaffaCakes118
Files
-
2868234edc148dcd29fb9b3a0a9ba9e2_JaffaCakes118.exe windows:4 windows x86 arch:x86
d90081c76eba719cb6f5876f717c0f94
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_Release
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE