��fC��~��#���uZk`�rw:���W�J{ɠ�]��gY�as��7T�>�2�H�}��iUddՌ�c�U5�(V�p&��]��}���h�(o`p��u+�m �&��;5B-p�_��h�����K�&�����ix ���#�wfS�,�x�������Q�JhQ�l������csl��g�jܫ��!�#��,����e�y/Ĭ��D�Y�j�d�ϐ���ylx��v�2�$h�C���ǶEh �J_k�KY*7��#�a��?�f����O�9W�ӿ���V6tg�+��eE4�A��Ț��TĈ��}h�gs�:��b�ۀ(U��݊�"� ��C=כk� l�:���Rn��� (�Y:.)[�3yKa��!�p�h&�֓䍾���j� �Ď�|�s��R�b��4��Sr������p�R�>,0�+0)k~�e�u���=[��P���{h��3�&��=�=;YX��^%u94�w �1+aP���IS9c0,���U���֫�W)4��v�X�% �MW4��r�?� �᱃��y����7P���2��Hӟ%8& /e�YO:ϑ�Y[o�˯�O���Rnd�M��@?�:��������D�П���h����gш�U��K�<U���G�%�K9�;�J$��bO�3�s�̀Lc1�s��C�;��h=�w�|F�sG ���srl�NS�9�ç���wJ� �@g��E��A6*�\�-F��4���/��x�[�6�qa3�����e��� !ԵѣM�� �3r2� �~�ߤ<2�[T��BV�+�7������Y��*@0k��A�~�h����lB�Px�OJ�ݜӍ暇@��c�'e$���TY�yq@1�\75����*;�d��aئ<2���X,ƠQ�ks�:��S�YۄŊr|�N0K��`%c�@ň�\���[fZ�0�~����X��bđ��OPR�d�X����\>�g���q����5:H�p�k�=�M����ŨR���!�r7N�T*S$��^�c�t9���2�V��l`�jb �!e`0��B�Qe�!C�`c$��\p8�_�o^�m�yԢ��e� �\t��9{��`7ӚI�N��t�5+*=��@!:�CwG鄦*�_����j�*uN�����=E�y4n����VBPp�I\*�dYwK�d��;�4a 7^_߱5���R�*�%������[B������V���1*�%&|���j,���v�)%~��c�r�W�D�"2��d1W[����l������B>�7�]��O�ݛ����'��F���\Va. ���l�����է��Q�E ��u��Χ�J_�&6n��b(_Tƻ��m�s������X�SE�'!n�� �짯��,��$X�����gZK��44�������ɣ��u��;ŗP��gU��I�2��eÜ9Q��b7�b��?����BƗiii�v5�z��Efnj�U[슋��r_�L���~ �hΆ�H��G���0����}g� �j9�Y(,�11���8�ڠL�YoO��U����?u�9W�c 5b>C"fK�$���V���H�y6��c����A����o�����7�Jp��Zޝ�k�O4������_!�9���wI�T�(vj���c��,��?��������\��_?@���z˧�v��x�� <�,��F\��Dr�1. Y��!�{2����W�Y(1�*l�-�,B��ї�������o�����(9�-ע��@�KH�Qx���qX��Եv�{����O�L�A�FΏ/hغ��U�d���ą�w㯐�$9���W!Ja��X��*������>^70Dry+�"5V�J�X����[9\���5h��VG˙=�\����\A�7D.���F�z���h��`��Y�Rhq{J2B�5d�=���H���Db�5�<��9�`��)��<�H�i#�|�l�e��AT/Jc�j�o�rO!0�!F�jЧ���H�&)Y��yC�'�|P���ä�6c�27�����\�c�L��=0ʦ���m?c��*Z� V�J�1Nwc�P���^�HƂ�� 2�������r���-ZG�AݑA�М�w���7;cCi���$7p�jR���. ��U?;E)G[�b#����2���C��fT������q@�����'�M�\�D���[ )J�q��~դM�~����nJ��"#q��e�������q=t����F`�@[roI$#~��g�SV�b��nƇ������q6Ȯ�M�K��6f/Z�ߍ�?��IU�5O��Q����˧�y��Nͱ����1�����H��^MF��h�@����祵~$����˗-�s[߳sp�_Q$at ��!3�x%��S�'���XH�b�x���ϱ�����ۇ�9$���8�.@{j&ԄQ�yh��1SqY)�)y��SP4�䄖�)ɻoe�*#�4\��=<+�@��]$��J�&�w"U�� �Imo!P���\ ��z+=˴��� -��ċU�5fzmW�=2F�a�`e�,�g,�n��? ���~-�;�yk��%�).�8c����˵�z6``9�ɒI���6Z�㉪S�! �SY7�j̥���)b1�b�9��R5�(����?���A���PL&����w��[@m-���Cs[�:>�^�dQK����XI=�깫.Gj�L���6!��J?�}�۸P�xn��zP��W�hԴ�!և��X���D��e'��w�N#M�lLX�9%K�#�g���w�WB3�L�0�ՖH. ���H`��_T_sL5>�;�]�N�;�}��ht�)�D��ۈS�e9?m�m�:[c,��F&�tW�@Y(�k�l�l��1�����! ��M��z���6yB*�(��>�Uz̫&����z��ꁱǐ����gq�" �8���+�!*�������Z D���5��s}�>y�4X���q�:4G�i���$�u�W�I��bD���o�:(�0�wAI���<�(�n:��B���k^�J�m>#��w7i+��|����L������x"/#h��#�
Behavioral task
behavioral1
Sample
361a9ef4ceedb33f9cefbd4cdaaf63fe_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
361a9ef4ceedb33f9cefbd4cdaaf63fe_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
361a9ef4ceedb33f9cefbd4cdaaf63fe_JaffaCakes118
-
Size
724KB
-
MD5
361a9ef4ceedb33f9cefbd4cdaaf63fe
-
SHA1
ffe9678ba7fa1d816d09f17eb2109b21dc57c2b1
-
SHA256
dc7197c63552033b2344cf72a2906f81e60f6eb7cb0294d468ed11f4d35c3c8d
-
SHA512
0be1e24100aadc155ddc5532a8ecd23eafefc66a5da18f1cdaea08f23e94f04d9da401f73abc85d765c0730797a0b933290b82dcccb2556a2dcea2211acc623f
-
SSDEEP
12288:mVezmjlc5xstx79YMsDsEijzju0QFugvCtyNhRK9BCkvv6+guwGNnqoeRlVg:mcmRc5af9YMsDsxQFugvC2YXv6+guwGb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 361a9ef4ceedb33f9cefbd4cdaaf63fe_JaffaCakes118
Files
-
361a9ef4ceedb33f9cefbd4cdaaf63fe_JaffaCakes118.exe windows:4 windows x86 arch:x86
f99d5de6124499ea7c09ce49851f1aaa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord607
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 712KB - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE