�h��*�{�p,���/F�aMZ�4s5cŭ?�� �r���Y�,�P2��]㼴��9e�rd�8�<�2y��0�����J G��&�_��|R��M?� G����y+`eN��d}\K ����t�s1f���.��ܰ?�'�o}�"?&�?��� �_������t���K�4Ê����)g�o�� �1�� mY̱�d��m�N�(��� ΑJ��|8c5��ܿ��p��irs��$��.�!W���G/������_\lA��:϶0C�<r�����q���TdI�D[�p�C���@�HߡL��z3x�� Xqu��Ja�h�G�K@��^R4�����%����Po�G�����$e�,�ko���UG�������V�q]<������1f����A��o�����~���o$���~�Dž H� �je�^T���9�:m���q�Yv�� ;^����A��|?�54�أyWq�?_�5��5R���bc^t��'@N=���jLOV�� �:s�D,�"�#9JT�1�F�����?s���{����+�3)n41>ӓ֣�����ݹ�+�3E�l��g�I���s�7��2`��qd�y ��YY�5R�W7��teh�B�;ؤ�m I�,z��-��N��W��>����x�� '��<��ڌ�ǜ �P"֟ ��u����#>�L�\�(IM���>r7�k�w�~�d(���� wY.��d�P��Z���_�,��zT�������2��d��=S����u���cÛ8�_F�M?)Yy�' ,X��^�-4��w��hY��k���R�2#�&5 +c��d5�>�́ ����?$���i�G���:�6��ҷ]�Nu:\6=5=�E���0A����ҧt+��Nd�o�-����*� p.��$��ɥ���[�g��D���닸�o���1G�Y����vh�h]F����˛���#�%,�A������.����J)�F��^�{p��`:�%c9r!���()���U5�$�1���(�Bdž����"o��a�N��I]$�H�P�4�JQ��x� ڴ��R6�6���x��? �o�FEB���XiSƩ�ۢ{Z�� vV�UX���H��'�n~Jgua�Q�b��+|S�T�*FQW��eL'����#��X��c����_v }�P�$� ��w��(:�| U,3���{�ZkX�yͳ<�N��:j��V6�ݽ�uxCЕ���3�J��P}m�t�xƟT�BЏ.�R��� �[Y���/rH�b�pl*.��Z �%�d!�A�$�Q�Ė��!ER���%���A���Xkُ�S�[[zr١��6�;�=�t5�wE�N���(D�Y��p�B�g���Sܙ�w���F�#�"$'�*�&�1g$U����*bJ��a�@I(�j�hx#��������c5|5a�� 1E�E�(c��k���0 �h��rքˎ8����(x|�i��=*��*���i*��Qpw�}�Ş� DHVՋ���cV�a,g�O �D�`G�����m��]. B��!M�<�~�ᢀ�iI����::��X6�n�#,D��ۨU}�[I=?���G;�Mo�]I-L��B���p��]dr䟥9_��WG�Ӷ=�,V�B�ek���7��Zx�ކ�u��#�&�gȷ4J�jv+ �#.��_��}����`�SY$;� �/`ĵʶ%ܚtwk��P)��U���t��Ç�}ƥ�xo���k����=�=�'<� '?������Y��a`6�����(����$���E�{���1)�p��k3v1����W��6HF��9ĉ�'����<�T xs��O����n�s��}j��k$� �{x���V��K��� &�ՃQӥ��j���D6��ퟁ�ݳj��Z`ǝ�Z��o������M<bmc"mD}�>=��Saгƚr���W��=U��1���e�lV��:��� �^C�� G�L#5��&P���J��G�5Z[F�YdS<X��]����5V>��h���ޣvU"&��PM��G����퀠~j,>�@T"����X�Fnm1Iԣ��\���@���TT� }t�z�Km��J�*��~�W����2h��Ne��yFƪ^1c{F��HC��DE���]�u�^Mv\�J�oA����>����V���P�S�"A=�����k:��pue ��g� ;�f.���rb + ��?��?�1�1O���~�u�b R&�=����]������ �Y3��!I������/�(鮉�TS�Ԍ+��L� �a7] ��vgT:S2q8`��B�]����w�D��Y�Ś���8���k�O�u��T1W6��g�(�ed @�E\eD�X�*�/(���P���º0J��礫�-}N�!z.0���,*;D��C�8�$d���:�Yy+0�w����!�ʋ[]�� 5t�S��^}ީ~|�������l�+�W ��o���ڿѸ- 7<�.@���JaGt��H��h��3�W �ܑ"���.�D��ݳ�y���֔Ժ\CΠ")c���jt/%O̒��5һ�V"��bi7�bݖ r�<c�d�s��y�(GJ�F�f������?�T���&����[�:���`<�,�N�KBC.qnD�D0�����k2��ZF8^R2I���-������=�w��e�&�@���"崯��P��!s� W�� VI_U��w2qz ��lh����1�&�p�����H���j�D�uakA ���%h�*� �6 ̸���P�U��� � �<�)��lT^��B�I��t�N.�Ͷ|���TzY����m� /���́DL"{��3�̘�E�����ג�*��6�l��>19�t:\�{���8���d��=��vr7��=�d�2'e�'H�V��ݑ�Z�]\~�ց��;X��+�f�Y�̝_�o衰�.�����a� ����ob��t��_���:��d���7�~�Ry�D�{X0\:�()^9�X��b`|P0�'H��%�l�6jG�X��y�����Ql��)���vk�h}����`J10sx5��������_�KqA�I�8,C
Behavioral task
behavioral1
Sample
32e0909d383b98a9f3ce794dbfc37847_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
32e0909d383b98a9f3ce794dbfc37847_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
32e0909d383b98a9f3ce794dbfc37847_JaffaCakes118
-
Size
206KB
-
MD5
32e0909d383b98a9f3ce794dbfc37847
-
SHA1
59ff583f1f9112d06187424632787297ed8f8d28
-
SHA256
bf75d079cd26483be9816bf1be585a7df141749ef0db476eb145c07439c94749
-
SHA512
9e7be574cae8b184d944f4366607c90b889e9a77959f519402692a778d5b9063c9349e6cfddf7c1d25553493a30db0930960885d97f45a8c716baa4016d66d15
-
SSDEEP
6144:tTPuJ7/JkptjMjJNkF+5klUmk+PSX6/cCuSiGX3aX6Xn:tTVXjW3kgW1LaXuZYX6Xn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32e0909d383b98a9f3ce794dbfc37847_JaffaCakes118
Files
-
32e0909d383b98a9f3ce794dbfc37847_JaffaCakes118.exe windows:4 windows x86 arch:x86
60b080fca5d4fad1c0ce2258243b9e78
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
kernel32
FreeLibrary
lstrcatA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetProcAddress
lstrlenA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ