S?��jyu�î���'XCu�36�#��X~�[o��n��n>����u�=_ɛw#��� e�@�>Z*i��[�S^yf���\�,Ir.��o拥 mh@�!���F�����K`{GF�Ė�ޟg��i �gi`�� ��L�pG�39��:�D�P��LB>�KZt��3���K5�_�0��5���8V��fY ���-:7gJ�C��M������f �H�,{��ȹWs;ۙbq��i���$;3D�>��쾢�ݵߌ��7�gЧǑit[����a��'��CccV��S9���6ϥ��f&w���S���0���Y�N�����v�h��Q�I�$�{��>:���R>�?�!Qgn��OC�4y���I�c�^Owt~: �+>��<5�ʛ ���K�Xp8���&��[��ߵcq�7�7X����ȼ�Yy�H����ͅK1tֽ>y,\��rKTwB@u },�O ��z�Q��s�,� ~x,nz�7����o�p7�>����-�>��-���R�� s_����z+���"��%TIm�5Z4'n�@0)�b���6��K��)VI}�d�d?��=$�(�z���^h�M-4۶e�aR�����!�E�<�yL��D\h�b��] �QAEy�w�s�.O�i4�r�U-����{:8B>Z�/��u�e<)]g[�gt�9ӿ�,����۠�ƸF�m�p��Z��_��ȇ{����@����_yG�`;[j�]�S�恂�Wq 7����n�yM������`&��RqM�1Q|x� R&����:v�Jo��|2����%�Rɏ�V�zA���H��?S��-�9Q�L�$����z����s",Pp�R�/�-5i�h���`��F^.Ɍ�9�N����i��'��VI�J`!�*���\ث�L;�Ni�^oG�Z�;�]�A#�WS��\��b8���&��(�V$%V��0�����r�#\���:�Fd�9���-�|��1� F$���|E�-�d�4�ݑa��T����B�́��[����䬃�ՙaܧL-PW����tX�K�K�L��DF>h����գ�^��^T�� ������uL�I`J�4f�0Dc����T0:�P�ú� ��tgsm2x֞����u�v������[��.#�|�P�IU��>��}ȝ/D<�J���u���)�Ǩ�J�b�'�l6:�M��y�1<?}��C�h�W���d*�ü5�Z���>�0q�$V|��t�1F@M��B�l_�0-%�G�'w��AB,��-��[�B�I3@� mz��� Ob��Qqv?�`�s�`���(�{�I1�#�a���� �v��M�������-�+"hʺOo����F۬q���}N��_K T���������L�.���N��p��-R��`1��WL��y�Ե��zR��T������~8i�4����Vo٩9�ߏd˕��ޱ���ո�u��ovh ��/��M���5�r��OM��+�iG,���-����2죚̜O�ƾI(�����Z�b�Q���]��L��N�(�� _t�=3�U�$6&/�U�:;�k3���1�Y_�U`z;�[��g9���0=�����r�L��5�ko���s����������\g=��w���qk,r1���^tĔ��^`nޒO˳&h��jW�I��L���T���o��y�P� ��UNv�y�-m&�o���xT�FF�V@ף��qLxn���Ղ���*ۇ&^�X;E�n�t�����vm�L+@S�����-����Y�f�zM<�{��<|ު����n�vy�[�u�x$ں4Z����#���~�OX+�:(A�X�����`5��� )�ր�ѹ�A�ƲA x-��PiU����I0�{�L����naͺL������A�84��*��2wk��z�ar��9�L��?�<A[c�~�݉�sJ�*�^��^�܂z��(Ⱥ�1� F���'���,h���2���0�\����K.g�����̙0=����s�Мy��5���� dQ�S� ǯ��� ���jJ�7'hFyЙ��R����<����&����v~ˌy���ה����P�IϿjT'N������� g"�2�4(�|�c���EN; ��>��s�Dl=8��-E�d:��p��Ն���T�ʱ;�[l�B_N� ��1�ȷ�,LG�t���}&�P�V�i�?v���&�T]*������o\O�NP��<Yn�����/�5'Z˺��S��n�qA�8�kT�� 7/�?�Ƌ��������:����G�b�y�'�N%�[����4>0�Tj�'�d�2���q�0�� [�b�1�9�*U'�?QI�_p}T��L6�����.����5�]|��W��u?�K�*_$���{~��Wc9D���T]��^G��)����!�-W��cX(�p?��&�w��8��3�iZ��0�"��L����2.�I�k�ac��C�_�q�f�����o�3����5~.�&��I�Y�#I�;C���E P�Q���~cr��e���1�� ����O.O�Wtm$�T�k�W�g+�n��N�Rz��:SԐ��II�Z�����5��,з\�a��->��~�V�H�x%X��W�C����Z*��IO���*�z�Sbt���|�l!�J��Im�\�t���9�9~�s*� ��#�nSs1�s�bT ��F��6N�5�$�ٷ�A��J�(���=�8��/e���u�n7H��j!��ү�Г��7�'KֈQ�a���� �4�J3��Ao4���pp��u�.E7�]pP�E*��3&��\�R��'�K���3�N�,W�yT+�� �oX'�;Vnql��;�Պ^���[�?9x0��<O�������=�vڠ�˥���|�����qT��E!���`��M��n���C�@�KE� �����*Z���������"� S�o�t%�����-&]�*S8�1a�UI,�wHyDHv$'ҥ�;�0�������u�/6*6#Q[?������� �!���L��D�E,�>�Q��:O"rV��'�H�
Behavioral task
behavioral1
Sample
29d884944859ab8f90c0b3384620e26f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29d884944859ab8f90c0b3384620e26f_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
29d884944859ab8f90c0b3384620e26f_JaffaCakes118
-
Size
124KB
-
MD5
29d884944859ab8f90c0b3384620e26f
-
SHA1
53bb9655569281111102821ca0988986d3739386
-
SHA256
95d65dcfec9323ce123a0d773523ebdcc193f0132e35079b9381585721d59585
-
SHA512
68bd38213b71da7df658cf56e9a009bee9e9c94ecd5275d105b30fb691854d0f96b4b63bdee40f98415949b0f00feb98056551d49f104215a58ee58d592b515d
-
SSDEEP
3072:lqpbKmmZvo+MJ6raGrT+lzvQW8RDmtVcT+nvnvQ+jutBC:liemMQ+TrlrKXl7dvI+jutBC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29d884944859ab8f90c0b3384620e26f_JaffaCakes118
Files
-
29d884944859ab8f90c0b3384620e26f_JaffaCakes118.exe windows:4 windows x86 arch:x86
c84da386a07dd11a2cab562a5844f88e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateSemaphoreA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
??1type_info@@UAE@XZ
comctl32
InitCommonControlsEx
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ