���[�1^��d��5Ǟ����Q�H�Ը�θ��]t4Z"� L��W>���x�!e]���S��&����D��#�;O>�Ȝ�<�~8��x���>c���^��&��%hi�ey@�j�Q�s$�� 5bs,�u�8�Hz�����G(�@���*ٖi����JO3�������G I��������gM�DHw���KXju0��ⵖ@�h"VV��hD�]���g��Cz���$����t��_�u�{�v�(�3K.�>.����R��;����P��qoa�ckdAC2k�I�Ѝ���sy��8�Q_�"��[��b�B>���ިqU���rXW���`3�ӧB_s݆��/���0� �,�^�����U4w,s?'@P��V�K�b��ׯ��B�7py��X[���)Z���|j�@Q�peTTgZr�7���i�+�8����`z��-�u�6�� zA��9"���A3A������S �9ė e��<�;�Y��B�s�,�x���b��rfӠ\����&�t���BჵZGG� �s�s��R�h�Ȣ��%�j����h�p�b( �������Yk�� �h>���|fG�������K�sȉ�kFH ∯�E�m�`E�K��K)���*5�s7D���M|�oAݿÜ��f��E�ׅ D �Yyr8Р�k�1z���'i�)�!�l���N揀^`NX3��r�1s^�W�����K$Q����,JP�1udI�\��#z���*?�Z�G�����Lex�Eﹲ�|� �Um�K��Hd��9��Ɍ}�@��{Ff& zRl}HڭmrX���g�L@]�_;w!�����Ю�`���*���E�S` X����<c����m�2�J�Y�?_B<�o�S���ľ�,�WEEK"b!�<���(��Tx�Ͷ��1A&���v�9/F�c[�h�!��aE$��x����g������Ʒ���Pn;f�Ƕ>�m�x�@�8����4$��8o<B����c.;Ұ��t�����uɑ� ~@\�!��r���>�s���{u���Sz�խf"����_/��9uJVy����?]s��v���1��v��l�wA;���e�&M�[8���Vo����4��F�]S�R3�����32<Kԁ����5����4�^��vu<-����E��za$������GAHBdu���0"1�ٍ]8GM�q7M��5�̞!���@ �-~+��p�*B4���P@AU��m�+�b���N�k�g;��l}l����r@���DM0_W�w����ˢ��L�s��*��XJ16ƂU(��8m���0Kjw�/Sh�4G-m;E��7��+�Z��I�c�;���O+�}VM�4_��6`m�v'�����.��۪j������"�5gTKhZ���:�����Ņ�����Y�@1.��b�xY2��l�@�@ό������{�[�D3�bY�aɬ]-�b��j�51��g�+3��Nu2�6��a-O�����Sr�9��1Jc,!D����AL��ۣP�@wW�b��/*����B���k�����r��+x�(>|iг��DC��#�pl�~��>L�<!2E+����~} ��{UW�/��l#��#��Uɖ�պ)L?3�+��vN�3���kf�����?�Y��x�l�2�%�^��JD�g�`e��A���F����&zd��:n�����ni[�w��*q���k_S�A��8��%�ۓ.��$�SJ�����o���Z��E���������Օy�d^�w$���E���~#jo�rO��v/�lQi����Z�ɗ���yB��� 4�B+9 xٳnA����7+�',�gM6�<�Y��1 z��Cz]ԃ��vM��/����a����/�~ �&�3MP\�Q|z�"l��B^n@*ue�`�8R�Q�>�"r��Y;��sT���U�ƅ��I{;ֲ���1]�]ӵѱ��|��J���*�b���F�J���\�}l)�����)$)�nVi����=Xq�J"<�������Y-�rYhWxi9���X�ʸ�記��bo��U{���?@p�4wl��X�tbf �2L8��[��Dh���(َ�#�m�N��b��-e�h7��d�P�F�pѓFՁ�K�N�\�#�UV�}��o;�Eg��!��3ִ2��*��[Ҽ\�R�0I&���T��Ҧ�X�r�e0�-s!4p��vDeʬ�o�\Ԕ��9���j�-G�t��/̥�azS���C3�\l>67�G�6oQ�9E�=��(���]\[뀎��dF(��Q�)�u�q5��t_1���%���7�oղ�N^>��a�o7�O�.�S�æ�W��Ԧ����+�����f@R�� ��ҽ�����E��"��~)��Lgg�y�-TMs��2���5Xk��ȣف�;ӿO9�w�L�^�|!s���7�y�$^l>`�'yQ������/��xA?7t�2�%җD[�G6×�`�[������+�˪� �����R�����6�1 2G)���:=�;�Y|���8O��x�Hǭ�fZ9�Kfн�m�m���4��tLR�l�}���ߙBc��b�ꦣ��2�_W��,K � ���,3��}�V�_���TLKM~�ڸK�s���[�� ��$��V���1��F8�f�� 7T��{m�����uz9J�`E���/�3�O�����?֘�'������Z�?����H=@�\d���!��H�۠�$�p)��-ti�sj�E\y7�� Ϙ�ȣ ���@�h`���»"��Wܱ����8�����~O���P�H���][)f��`�fFDj���8`����i��� ����p�@���*�46�@R2h"����n%o_^�N�����]̡$(Oa�%S�*:�D�A���U�gۑ.�QB�B{�]��:��O�<�#Z��j�̿��27(���+��@�����f<N��'�Hdy�Yu���gzk�cUaW�r�\�G'�5��9`D6EQ�D�B���)�����5�x*�d(���������_�u�W����8�!�p�b��8f�<ʬXR���a�=ns�V���Oq���q��T9�3B5�G
Behavioral task
behavioral1
Sample
38a04956eedfa68fae561d5b14625356_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
38a04956eedfa68fae561d5b14625356_JaffaCakes118
-
Size
256KB
-
MD5
38a04956eedfa68fae561d5b14625356
-
SHA1
c23daf94a0f2626e4d15c47fb2bd4c4c2d553aa4
-
SHA256
14034ee139e07f34d551019ce959a3657c7fece3e68810426791c92490369912
-
SHA512
0751d1c890fb2edcbdbf0da9fee40d2f2a8f90ade147a98f9493aba315f6e58e76ad343978109c48c5371994ce142406a5a5d1218531af10c41881b34e89e4df
-
SSDEEP
6144:NWxr0vMUfrjl6mz5D35+gFNSSY8oyQj80/O:/kUffl/zB3sD8obo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38a04956eedfa68fae561d5b14625356_JaffaCakes118
Files
-
38a04956eedfa68fae561d5b14625356_JaffaCakes118.exe windows:4 windows x86 arch:x86
4efaad94b25e2ded5d02acf442c9650a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetPrivateProfileSectionA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
shell32
ShellExecuteA
mfc42
ord4277
msvcrt
__getmainargs
urlmon
URLDownloadToFileA
msvcp60
??0_Winit@std@@QAE@XZ
wininet
FindFirstUrlCacheEntryA
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 124KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ