�6�$����m���>EJj����.S8�%������(���2%Kv�AJ�x٨�l����%�刺>Z��!�o��-*SI.��"�C���B��|K�f��(H�V�y-%�.����a2���C��?����^����&���}5H�<�W�����b�S�iQ<�Tw����V�������Ջ�H���)�����A���u&�%{-:u��zA��Nx�� |��´.-�#��S��A��8�2��U�j0х�������T����+�q�_oq7:;���97�zB�?��I���`��.���qs��[���E�V���3�?���� Ui��v�NLj$Hm���N�k����Nu�'H�U�ݱ��Vx���@!9 �5�kP���:U�#nt�>����&��Bs�j���wGd�4=!��*~pt�]q6�����@X�Ҥ���b�zz"��Q1C�N:Z]�����}p�6�g즆�Ԧ��NJ��z}���1�, �"��#>xь��y+��G�E��L��nUlw6�6�oEc/�1�y2/�����-^�����̧e�C�A�c��2��Ut~�wǯ:�\O<�x(��i�峾�1���TX����lQ���Aa,n0�]�c�Y[K�5�����,#������яҞ�bB��D��(�����%���a�Q�ŵ��J`i�c8���(+��������Q-���y%r���?��Ps�~/�r�UR��g������ 9o�18���� C����<Y���)�t��̨�^6��ܦ�$"Q���N~A�庶sY��~���w���L|�̾9���&���P�x9f�_L�/qr6�qz��`��yRl����������+�u�m�Uk��ie{��������jB���d�R�3��YoRVzKX�o$I������qw�m8!v�/!�(�|���")����詛�NM�J��։�����Y�z��:�ya�;� �) 9j������A�.�<7[����Yl�����T�ݘ��c�e��W���l�^���#�P��l�Jd���3�!LJ�#=�ԙ�0��ϋL!���\�%��A��P��_���m�-&?��LF"�������ą���i�:+yx�"��U�~o&�� >hpU�YM����1]�kK����u�W��ԣș6%&y� )�I�=��ѩo �# �+��!���J��tŃC+H�>z�y+�ř���VxLo���$eV:#�ҁ�s ����2<�m �*'O���$pg>D���R6]Ê%Y��3���Gx�rn&� E� 58,�������}F�����賢&aVx?�}��&<S>�9��^�o �Z��N�d@oKg�,ܰ��[�p~�>P�G�������Xv�/ �EF�y$�B8#8����� ���Q�)�`�g��6QcOg�u�$B�v�EXp��;e��ף��X����rM *���l��;��Ǫ�:��4Q�ڑm�ס'�؈wҥCQ��c��E(( <�054@Is�K��E`rqe��ص����-:˝ ����k�+sy~�@�Q�&��ʺ�C �+'�r���'@f�@K����]%�PRI+���4)uK#�J���&}g��������{e��G����fT#j�O�Dc�x��ϑ�Pռ%�>��AK^i?d�B?NϟI*3���}��/�)gb�n'<낒oL�oPr��Rz���h��.#:�Vu =���|����d����&�J�L�C���o��w�L�&��k����Q6^V"�o"E͂�I��� RF��ؓz�v���<���vk����������U{XZ~�!��H����w���TM5��!����1dgR��Iþ�R������xèn;QE57LLe�'~^<bL���2�l3�YV��U7���'���t֊o�^WĽI!��7�>��b7�6������]�pࡂCY��輢1"�X�4:)a�Sn� b��*R9&s��,��}������'�~W�;��?������ps���)~�<����� .|��"̈~� �E���}������ط�^���D%��R�q�6Ϝ�L�{��ŏ�"�d��M�;����1�~{�Orˆ��>|����3ۊ��k� �cݚ �&FV�vs�7�N3�F�Y�U���a`<�-8�s#�5ȣy�$��`�-CK�9�bS1u��Qбq��6N�$(ՐțtgT�j��3�g?��9RE��[�h���u���zc�#�a��� �e'�ET�A��u�s̵��\�.��ipKX��f�1NyE����Po�i��gP��y��|��yJ8U8r/���w�ϱ��Hƿ%<���+��=�V���f���ݙu}heM���������Y��D��TLx!A�tM��(+qҁ�t��q��9�\���1�%�˅]/����(��}��}`��X� ����B>�F$���svi�̚���w�I��'V�D�[[���f��@��*'��8��.Aֹ�����+�2�j�~�C�q�.�%�y�K��H@jT�����Wȩ���Hi �YW[$�Jd6�yF_������HJ��\<=qJ��A�������kB������&�^1�\�m8���$P�U2l"�����Ҷʔ� M�h�ϫ艒ˎ�v}$���U���������������R]��8��$*�z z*l=h3� ���������V~��b]��9~=P�[mT!��aCt����E��(�)gW�� I��;���Y��&��������M��o��t�� p�Y?,&BL����T���Ϣ*$?6�!����m��Q��LⲵJݞ(��k\�'����z$k츙R�p�����ٯܿs�ݾ-���(� ���0k�Zd '$�rn�������0�~���Ohs�ޝpDC��p����h֟j^G��Ň���'�:���{e8��z��'�k�q>��h<�]bſ�� ���n��p����-��p>%���v��e`��C��W+���p�Aܹ#� ���(���w�Ά�A7��YNݗC\���B �����+�RwwU˙I%-� �����-?���MG
Behavioral task
behavioral1
Sample
36a7085fbcc99179a05a07f9e884d2ce_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
36a7085fbcc99179a05a07f9e884d2ce_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
36a7085fbcc99179a05a07f9e884d2ce_JaffaCakes118
-
Size
196KB
-
MD5
36a7085fbcc99179a05a07f9e884d2ce
-
SHA1
f4471d700c480628e208f9a7121763441f359405
-
SHA256
9fcaea1c851bef31c95d51b6495d153dd06abcd3e7bb77f8cc6f9ea36a2e4057
-
SHA512
5ad99a68cdd89bcd9f35d9b85dcfadc5a3fc788b3494a0a14fc6a77960519a5cc0b519aabffbaf053ee29d682b63f182bbf9ec63f431ee88ee67c0dde43713dc
-
SSDEEP
3072:q7BQBvIpNCo1ijoVJ9cDnNmvmqgw3b4VpTzXY4LtYUtHxzbPMadZ888zcJuD:q7LNC2yZTWCZ9ZLRHPfL8au
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36a7085fbcc99179a05a07f9e884d2ce_JaffaCakes118
Files
-
36a7085fbcc99179a05a07f9e884d2ce_JaffaCakes118.exe windows:4 windows x86 arch:x86
940da308b9480924f3179147f506f213
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fdivr_m32
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE