���&���;fQ]���[�h�XRX������2l�L�?�y�`;�q���������y�{��Z�Ie_T����\��K@������ʯ�O��`j��o�'��NM�v�m���=��Bpb���wlT�d3�������5�j��fY}�oB���d����H��;��W��ԣ6�Y��w�+@^U���#�m���>^-����)(k깧���竮T��buD?�M<F4�+�˹�Zwm�FU%����5�����mg��h��9�f!�1���ӘŒ�i =r���hpz�xԕ���D�:�3Nz}%��q������Օ�qR�3��5h���w�����&���c�Ί�s��B�{�f$�#��i�h��I�s?���YO�=���m��ym���g��v�zl���n�g��ݵ��#�>J��1>���)�������o��%I�"�Ϝsn�c�8%-��={F)�L��N�G�}�&뽫�.�)#��;ڪ��������2�P��A�u�j�����/���dIt��cگ�X䎀}�Q�e�*�c�7��V3���HŎC�^bhkm���� �����! �gK�R��t/<�6q���QŠ�Ӹ��W�����l!*�"�mݚҕ����b/���5������p�8p��zU��xh1��g�D v]�ax-���IR���Ơ�����ֆոU��h.?U'��<�紡B�r�4����P� ��G�(Д�4��52k�� �gs�7��q�قw��d��6k�> �D�[��$��y%lW���b�X�wC��<c�����m��C+7��6�{���� �B|4A�7�c�6�-�v<ĚQ���3��a2���d��p�ܯ͖,+��T�LÀ�g�T������V���q�8C+�}��bsg�'n�u�I�t��3|�v�;�#��wQ $�`'}�� �3%���6g��B�6��(Z,�9����NM")ɼ%��.�n/z��w7GQ���V�}��X�;�������)fSP���XJ����~pZ���rjO�~������r�rH�`����q�{P��F�u����o�O$=�#2�Ac��O.�[�x��ڀ6����Y��$�`�Q���3���M$w�]Y��s���l�~){�+>�1˰{N=�Y Ec��L��o� ,lU� �^{��}[��>��\�ܲ��3H�V�@ck��z|B�%�mt�?��e�* �� ֬!=+0~�EQ�����LPr�:X��e�=� �{�z\����\���0�|S�V)'��YIg�q����Pl����4ζi�B�$E?'G\s��z���r�V�m�*5 SH*�?��48�~t���/���>�{�.݈T���W�NVI�Q}uj+5�uf����L�&e�UJ{.i�R�>i&�Wÿ� 5���n%�c���P��rm�&����ĜX+_�yAz���9�If��xW�>G���6d��h�S��w�X�-�?���uQ��=�E� �����[b�V���cϠ��sV�o��H����+>����*���p������l8��@�R>#�$S H�.�j�i�7$�L�p��_+V�jbE���A[�?�����]��:��Ώ�c��9��\;�^"�(�[^4`$���}j� Q�M]Se!�|M*6v���Y�bd��ۘ`0���B������3��I��{��6�,y c6U}���7��SW2�U�,Zu�1����d4�5�{�Qb%��� pR+�!U�z�X&l�d�G�31�P]�2��<Q���iX��Ե14f�e):#����t�x��"����I'��3��������Gv.l��$H�[�l����i�=t�Szr�� !i��/�kWC�h�-biR�_��[*�4�������������16d�j�4X�7.�iB�!%��bگ���,�@��� ��Rʡ�������JN֗9m��/*�jV���'@��^A��kJ��Ƌ|"H��-МM����_��*$�Dwl������4ם?�"t��뀖��FY��7j.�5�9 ۄ=]�Zhp>����}�(A�͍�w3�n8�g�%I'P����U+V��������q | �tH�\<��{��+t��z=� L*�����Ж�7m8�π!u�f6���E�Z]��adQ��,~|¤�OK��xFF9��VR̆k±������y<�ۀb���"�XB����^����Ll�WE�' *��1�B���#|�d��CE��!ޓɨf��U]��dB��8s�_l(�_Ƙ�xS��w2F:�ʊ�i�P`�t�{�И��̧ٝ������)��Wu/������`#�EPZ�Lo�P$�����s-q@E�~)J��a�b��0��Ns�J}���A�&t����wcQJ���6�I���s �#����e�/��<�ӝp�`��Ŧb�6�`�y��&ԺR \�'S�6��([L�lfF���B�V���-$�ٺ%��]�J�<�^�0$��F��͟�Pv���eV{v<٘��T̳L {ܷ.��fЄ��tŒ�a���P =?���U�_]�](�O! Lmэ���1Ĵ��\;���VȨ� �R�}��"�����Z� W�2v�����훒o�@�L�BXmW+Xx�̈�(�r<]\����������\�/�ֻM���G�&���XZ��}�������c�� ��Tz��6�#�F��;{9��ߙ �қ��,����6 '(�|y���F=Whd;��M�j���K�j�N?9l���dފ�8"��) |�e�l����xy&���>��W��'�п�{m�߹�C-?����><?`::�1���-۾vz��X'�JJJ�����;��G�|�4�N2Xg�c���Ҩ�~����-��JS�����]�aH9;�Y����Q!�${���7�B�~ ��C�\�G>BK��&��D���?,��% �1�"��=/�������Gk�inN�Q�l4W�{Bee�� *����� x��Yn��ꆰ�f���b�\�;�HQA����/S8��v)�*L�U��.D�9������f���p�,��BdI[K�����
Behavioral task
behavioral1
Sample
2bf6a9eec09ddb7203da871ca3548cdd_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2bf6a9eec09ddb7203da871ca3548cdd_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2bf6a9eec09ddb7203da871ca3548cdd_JaffaCakes118
-
Size
205KB
-
MD5
2bf6a9eec09ddb7203da871ca3548cdd
-
SHA1
d4c9caff658eb2c173c9b76e33bfca1b91c26ee5
-
SHA256
58e7e957c4c08db91efd3357aa24d5a66e0273b6750bc45654289a59ff66134c
-
SHA512
4cf6df74ebd910b02d5f5a90e1945a8e28e551bca9f3896f0893e2b18857943b43da1e8a559a51e2a43e05c5dbdf1c1d6a861a610cf848541259b6a96c3d1d5b
-
SSDEEP
6144:dvr1lAQV0bsQCQTnOUWtQ+JKJXrZbZ+G28R:dvrwW0ADgRWmSUbq8R
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2bf6a9eec09ddb7203da871ca3548cdd_JaffaCakes118
Files
-
2bf6a9eec09ddb7203da871ca3548cdd_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 200KB - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ