��lcq|p�VbQ�o'l������7��٦w�/�B)�72nb��:o�O\ �����T�4&�}[dnѨ���'쬊iF�i��s���R�h�g(E��8��>e���d�~r��Z�,W�S;%�(kC5�(o��W��<��X���vL,���O�p��|��y' ܅�x=���G�����|���g�D�Ro��qH��� �'��h�'�5<�J��\��B��4D��t��6�m��$�G�t���v~s��s��Ax�umhԫ���K��t���hL[�`?�XK�8������u�U]��`I:��6&�Q������z:�Ԛ�DO�El�����r���$&fe}*�ͽ�'�j=C��vޙo�z�0�m�1�%_Ȓ��5g��0�! �{��@0Ėd�0�g��1�羰ƞ��Ϳ�����J,�� ��*��/kK)��+�k���Vڱw���+ߧ�TӞ�U84x�2�=����'�k� ��nt;k��uLd�KT��@r�M�g��7�רt@w����T��!-�Ӽ���3P8v���*�t!>(Y� U�ǘ{'��\,�mO���(�gO�������V�I@C����M��-IP�uo;�������~���L���U������u� ֯��l.l����M{p/4V(T*�fYȨ<�TUWYv$����;�YG��Ё�FV۠�ؘ-���!��q���6e�f=)�J�Y��J�� ��w�鯃���Zr�Ϭ���Z�C�ue�1�+ y��\��D4&�;>z&�E�S�BcZ���]�,3]g�N��O �=O`�˹*��-$n��a8 �&c84�a�ه۬=��N8'�d�~�;����LXu�#�=��JS��1����ד��|���H�J�H�:�O�n�2��eKy�>�ԭ�(!|�D �@�h������H a�IbFY���'���(E�Z0���mX��K����qC�:�2V$#(<���h����h�:������ �T��H��g)��(�g=���0�����r�ψDl���������`�d̄!�� p̩!<��$�Vҝ:U��_vU1/�a����{��ne����C��Ib�]�� 8������ؙٗ���2%&�Vug�R �+�R���Qq n�����^`������Нe �-a�43�����f:T�_�4�U�pI�Fo_)�<Pm3W�������;2*��$��tX &&��n(މ@m$���F�B���m�"��3n㎱/��[|ԡ��R�d赇� kD��� 5|C��q)��?H�5���ޝ9��)[�[N����q�|G$5��U(��]���n��A�ы������4!����Yn�<s ��ԭ�J��*F�R��R�$e��F��y 7��$te����WQ6)Ed"k�b�9^���k�HfW��k��<]ʷE��(y�\�c�N �q9n��JΞh6�)"PZ���BD����ۄ��'w��M"f��P?@��[rI;��(��/���n��V������M;D�e���S��`�ɷU�KI�RJ��ީ��/�?}}>�U������n�R�%���1\�=2��#�4��\�����H�-�a�۸���FS`���W�dNP%��RX~�˦��}�P=��ģ�J�$����r @I6�~8�Q�ҹ����zv�lh����8��G����I\�����v�?@�x6����bG�r;�L��:k���{��O� :e��N���=��&O_��a�JH��'b�QgƋS���N}pၦ_�^���L�*h��D/�zl�O�ó�E����$�*]K��R?���J� �Ԭ�B;�Y�������m�Yj>�+�c�̓�ZP�B#���Du���ԉO䐽�։�����l~��l0(�v���rAR�ɚV�'�ӵ_PPMY(W��=��i��Uw�t� �(�[�_�}!�cŴ�����7�,���2�2�*��*E���)���������p���E���̼�"l���t�a���+p���3z�Gw������>��5HEzz����(�:4�*�:�]:L��M�&�S��jq�^�TvdA���NBx��2��x<�_�7{C>�(�P��� ���+�����1��@� �,�NnKOٯQ��# T<�6�7"��{�D��w��h�u�c#����J#�u��ok�� u?4���c�{{ �U�5���l���s㊴U�V���K*�L��?�����|�@��/܈ �D�/��z6g�Lh�Xu�u�J�l7mݶY����@F |bq���6mM�BV..�9��/�� ��jNQg)2���(d!�y�;I�(aU��c"� @�|V�eS�Rգ�&y]0�Aե��TT��b+�t�[���V.!��pӣfzH""�o���A?X}U`���~%J* 6�����߅v�mEV��9[������R�����FOn�UKI�*=�Z)�R��ڋ�2c l�BM��JWk^8�θR s�����\�������@�� ^��Z�Zg�m��Jb1��xÂ^p��G�v��`$J��M"�����\�Ic[q9�2���+d������ڲ��D|�Ȭ��N�?+)/(�5I�����������ܱO�*\+��{ūܲJߵ�,�.���P�������~�Q �Ơ4H#(E��Ћ .�� ��Sk�;����WcC�+쓊��~�n��q�t2��z��.h�q�����7�{�^P_��� ��q*ϘS��"]���^�|a �7DU�N��śE$a��o�4��̀DbP6�]�� )���g��ą ����Au�����O�^.����#��A2Fq���U���7���.�19Ǯ�*�!���v\;CўW��"���W6������5�"o$�s��TV��ջq:L锡�MC��^�;��ߧf[���φ�U���1B!G-�$�41��t��l�e���h�`�����=�9"�җ�n���ng�e ����"����l0�DŽ���[Ny���!�/ِ����f�,��w�1�Nښ뫓$���
Behavioral task
behavioral1
Sample
35d1294f139a2e4ace580aadeb306866_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
35d1294f139a2e4ace580aadeb306866_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
35d1294f139a2e4ace580aadeb306866_JaffaCakes118
-
Size
244KB
-
MD5
35d1294f139a2e4ace580aadeb306866
-
SHA1
c0b134434e15e58a282f5e0976c7e805d8d82bd3
-
SHA256
99890e692b5ed5006acbbcc9fb247e7b2a3323dbfa66a5fe47a924c72ce4ea15
-
SHA512
b936394515b71db6b785bba09da7ef1e9ae737b62ec548235aa5affa65a8ff5d7fdbf19020686b91fb0136720e7a52614314bd32020fb8177ada44af9b6c2430
-
SSDEEP
6144:f0BABNULGLLEQvKbfYc9zHf5CD1iL0CkAq:8+BqG3vKbfYezHf5ChiRkA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 35d1294f139a2e4ace580aadeb306866_JaffaCakes118
Files
-
35d1294f139a2e4ace580aadeb306866_JaffaCakes118.exe windows:4 windows x86 arch:x86
4d9d59a924d412f2547aece8d692e994
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateToolhelp32Snapshot
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowTextA
shell32
ShellExecuteA
wininet
InternetReadFile
Exports
Exports
Sections
.text Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 232KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE