^�M�5���?p/k�c���Q����?.HX�bv����J�m@��Kf:�����OG�:���6���'��B"�[�j�)jRI��+�RO9�ڪõ)4�k��W2s!���eB7�W���� ����J߅��25�dҺ�RP��T=t1#:H����`9��KX�ck6&�t�����y��h�m�����2Tt$��ӧ�����S���+����hԓp'���Q��:s��`"ƚ�ݕ�9[�nU��S��)��=y �hA.�^d�U4W*P������V6���`@ʨE�����%�1$��m��|�m�lʀ�<�@O��]F�)�nl����82~A��# %֢���d�����Dܡ�9h�QSЍ���T����CP2�/ ���g�r�0H8xg]_-��aV�yy,�?5��4]�����<a��ќB:�=7����i��mnwzs �)Hb�a,e���'�~�� �OH��Eli��Qlz��H4�\v# �z���������l��H��'���<�����L���&OJ����8樉F���f�Mõi(`����.�4�pi�K(��X����r����OP����k�z��M������@A( �ȶ�����.3�Nz����ͣ$�eȁ�� �E��.]�gr��}"_5o�> ���3�ʘ�݁/NB�%\C�����&��MΦ~�w^v���ZKԇ�`��(Kr6ä��P�}Dղ��>�ID#��Ň�_e����7C#����?f�H�D��0o��Lw��gξ�q��2���uoz\�V�����Yz~�x�WAhʄT�.EV# �R�-�r�i������|��8/�z�_H-�b��� ��rds<�)����V{ȿ�S.'\�����h'���}�,T�r;T���~4A�����1�8��H�=6e���5,F�u:gI�H���K���]x9t����C��\�T4��r 9|`�8T8Uj�j)�?c�X��)��;�@X���g;c���&�Է�J��f��U�C����M͔�%���J�p�DY�w!�W!�]P>�T�8Vc�0��G��#@-�����X�&�����3���Ag_�os��?�������r9�#x��o�qdq��ʏM�\���H�qC��������_��W���ioxة�vl�n��r�a�e��vm�������^@�I=�D�ibf��e� ��u���Ag(�E#pį�?�t�ܙ�=94^i����]�����'`���YFyxe� � JC�˯�9���� �֒�l~_n�(��ϭܞ������~v��������Tb��g�&c�� ��ցa�`���j ���8���^]W=L�9���uf770���n�([�-&p]��W�8�cK��G��5c �*w2�P�WK�ޭ�B;��Tȫ�aF�u��5�Ϯ^��(/��Pr�p��o�2 j�����-VGå��m�Z��8�HE���18*�M 5Rp�֩�C��L�|u2`�[6�4�&�S�B/�N������*&?�m0�ng �֯�7�}@v+n�z��(���Z�U�% ~�*���do� �FsԚ�x�Ѹ\'���[�##&-�DW'S��n�6 ����E����vb��?E�<����>�z��0��b+�$EM�ĻDž��z��#�u��������.f�v�!��V��pϔ�t3iH���3s �kd-q��{�M�L�j�N�}6l�)�*��ED�aܢ�%Y�4cu7{�:���<h�?��2��~��� ��ԈV!�t92��틌��O[��:p8F*����Ԗ�-���+9��1Z��x´���>�J\5�FX���H�^M���5�d�w,b���Mr�=:����?ڿ"0�tP��y�m27L�:���U�7�q�ٽ�V���I�3w���/�ʋ`�җܢ�ZJ��%��mM�����.��Ϝ�{��2u8�q�`C�:f���!U�)�����F@�5ۃkO����'5���MB�Y�Ab��_�q�h���N�����)Xy��U=�YEX/���¶ ;�*(��������p�4�|�p�,HZ� K� �ܧ��#�x��5�?�㑉�275�L6�⸩�f=W��šM�T�MbB������U���#xFЖ������A����`��;'��hVf`w<�ᢦbS��|�m���Li){���k�ᵥ��iH3�v�����u������MuE�XZ @�=�w P.?qx\����;_�"S����ez��@E�#���X�[�ô�1����ȟ���oN���� ��{�/ЊP�u�9����3֚����{-�����F�y&�>� ��~TJ�5�$T ~-�>�6�X�.\�&�H�< �G�w�U�l���(|ܷ�o'x�xVy5�~�ߌ���h?��Fu�Q�鎤/�f�Ln{��'rq}W��Lxc��{�����P����U���W�Կ 5���4P$�_خRp�)��G�U� ���o�f�R�nK�p�6��M��X-�s��.*^G���ʠ���(W�bQ�mA]�6c��2�|��.(Q�;OI�m���y�Fr�g�u�S�>��Y���?�⮪c�����UךϿ��<T85,�i�W�)$�7����fq�"�!�U� ��G��Wum�;^4^b��g��o��ٜ���9��-þ!�cDž��K�;ޫ��'K�:Mn��t��;k�:��Ո����$8�n�������yQ�C7Jh� ��&���'H ���wsDJ5pı�X-*ϕi*�2Y�0�8��[�͌��� YSP|5���ӵ�iOL`��s��-t��~�q�dr�����z��y �E�q,mVg�@?����z�������x���I��V'��T�`�~xd��Q,)�}p�z��w��X'��Q\�=؞B��D$ğw�O���v��?R�4�' �Eo��+�,��`���'2l2Qˡ��V�.��j�`�O��h��s������z�wX�ʒ>e?�� �����82T4rh�{�4/��!!S���97�P��� �@�N�O<!wL��Uw�x
Behavioral task
behavioral1
Sample
313df46a80168b8790dc0634929e960a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
313df46a80168b8790dc0634929e960a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
313df46a80168b8790dc0634929e960a_JaffaCakes118
-
Size
212KB
-
MD5
313df46a80168b8790dc0634929e960a
-
SHA1
78e79f4d4b5652b48a60dbbec92c9350adb34c22
-
SHA256
eef22bc055a9eeef963bc9694897279a2e084129fdb91f18d44f4dac605d15bc
-
SHA512
12cb2249a10a03e5635b9b0e8786b13b2ba541a0b071676b6c09d80fad6a7e4105e6a930c7888705eda2e4ee4d944ca4bb0adb5895a5b790dd4c6ad32281c357
-
SSDEEP
6144:vpLqYFbn92Uyi0hR7zstMsBzH/IVo2OB3kNgrHj:vDF92qAR4/Bjj2RgrD
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 313df46a80168b8790dc0634929e960a_JaffaCakes118
Files
-
313df46a80168b8790dc0634929e960a_JaffaCakes118.exe windows:4 windows x86 arch:x86
1b1ca09774dbc5d4894057aaf7124fcc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2055
msvcrt
__p__commode
kernel32
VirtualAllocEx
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMenu
shell32
ShellExecuteA
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 200KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE