GX�� ���&L�ƍ�X ����M����H�Q����:\��^"�N���T�]���ɢ0�������`q߃�*zC����+�����U����.���@:b�(��!�D��yM���=\d�?:n J�F�� �:XRQ�duA|p/N\�'�ѐ�v�ս��$� ��M`�o�[�,���EE'�7Ȭqʸ�!���'#��'-�X�`D'�ǝ��[ �LW��9m��\�甧�I�N?�KGT]y�M!9c�>3�1DЮ�Ge��֬GጺY|�����3��F�Z����G���a� \iЊ��к7��+�J� :xna<��whC�Sk�ڟ��{{D1��*�Ԕ�[Ed)%�2_������U�J��j{��Ŵk/�J����TQ(�EJ-��ʦ̳�ә+� ��R^�(�,��~�1Yh��8̃N�����jO͂ ��z&�e�r�廫 �w����U���^EBٓ���Cw���Gu"(��Qje�����)gTGU ���T�W6{p��? ��<Q�h<���3�~�C���e�n�`�{���H�0�?�K�܅��N4���_���[�8JM-�\p�D!�+㱄L�9��y��G��!��?���%���FyF�UB�T�!��N�{DAH�~/d�:������u���l�=�����M�J<��\�`���q1ef���t��iGZ��S�s~���Ȭ �R^�,A�|�_hL�sE���~,�( ���$� �u���B�ʡA�$XQ��"ݝK��oӒ�*�j}KlX^ɜ Eh,��w/��Y�Skc@��cQ�O�0����acr���[a"%���B�j���T�1|ӷi��md�>f5��xU��������no�Y�N�0�۞i/�)pܒ�����T" /���yT�\�\���� C| H�7�TE{��wבr�-c{�Z��)hx}}���*-����H$��O��B�umN���>�� P��aB��$�?.������,ꘑ�>+��v��&*�C�7���CQ�H�M�u2)~�������TI'��ݢ1Y��|��^�-X܉����}icQ͗G�4X�s{�LRu�� ��g������F���y��K�Ȁ2�H������u�Z4��'m�5�I6^r�SS\��l #�|>��Q��ĥ g��z�y{@�����t2��4Qy���Er�\�����9SH�+����s��)�z���]�XsNJ�Q������_��FəP��}�'�2��旨��[�(��c��Ü܄���� ��U�}����L�����#%�X��$��fly\g:bRE�v�N�6_Kc�es�g�Eֺ^0��,H�m�n�Q���0�#;���!k7�T�U�S��g���devmLT�I�༦3��`��c��=��hB�)�I8�u�%9�����J�:�<X%��U��F��6@ԴiC[�w�ЈE�-��<����+��g��'k[{g�N�Q�_�D+��3f�\rX@�%k�Ո������z��~���� J�/���r�����-�ϙ����~�ᨌP"�)��P��}`�I:��m���Mh�]�uf]�co��a��x�M��Cdgϑ<�r-������?�{���k۠ $u���P8�m �m�n��p� %Yo%����;H"�A��)@Z�d�a)�Z����N����~�r�RK��/K):hD�4.��,�e�W���(��-��o�wIs�,9��A��=8�3/�c�����V�a��� Zͥ��>�y7p�&���}���v�ְ��_6�դveL1HM"B��9~�p#���#P�fڛ@;H)3�[�Ǻn���J��9ٝ��ܴ��a�m���mR4���dvZ�Z��6�Il��X�2��=:ՈRM�>0ۇ����N|!c�(�[2��ݵ������ie���Ѵ�D���5���v�l,��HepJ`�0EE,����Į�.~�,�s��� .��z0�mH�Ϯ�g��ez..�Eg�.�U���|�a�)/��ԩ�� �w�N����ײׯD=�»nrqA�Q�,0E�����1 ��E� 8�싗���Z��"�OP`aǬ��^=-���^P��Q��G������O�Ux锂 �L]����0�gdS�@E�����!^��h�d@9�b K�7gb����u`�U���}�P{�R>�ݠ�>������d�`��:V0Tpq1>�1�٩�ץy�L�Ƭ�A_���h ��wܯw �����)�rW"n���q��dS�48��t���-�c?R� ����]]�m ���H�o��f�-��T���7�s��9�1�m��:�:nM���Y/����S���`(�"�eh���"@Kn��f�fn�� ӣ ���[��Q�u������U� ��(8�_s�kӃ����f����6> �;�A�]�`P��Gg�����g�+�fuV&K½y����A� �N�Q �G��>ʒ��PSr���M��+�/����yt@ѪA$�BE,�L��9r�}h�`U��E��Г���z��y<)���&\2����6q#��g*n~Sז�#�+{]|�ȋ�V�`�u���s:rm�&Q����7 ��x. ��=W�Z�Ƹ�����Z7��l�2��4�c��h����eϣ���K�o']�W��o�t�D�G�İ�� ��XY��Ș%��.`9TLA;/�h<���/�4D�9��Ĝ�$9�T N�n)�����q9�/����hq�!<<s��s"�����:�Q�k�����q���kX_�M�&Y7���:�������"�ϙx&��W�#W=�0��Hh�~��:��:R^F����Ѓk\���j�x�`�V��H������Z�bPA��L���x�'�'���4 #m�v?�m��_��_u>�%|ۻ���R���oe�<��<��7H6&���,jD=�Di���NN*�I��71��&��zT 6X��G^��RbW}{���7�x�� �{Z��H�S��6�S�����@[]��We�����b�Ϟ-�����;D�h�j]�M*�J,����f?Z��>�3�TK2��H�k�?Q��� c\�=
Behavioral task
behavioral1
Sample
3a729a015de2319e000eae8d37011b25_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a729a015de2319e000eae8d37011b25_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a729a015de2319e000eae8d37011b25_JaffaCakes118
-
Size
1018KB
-
MD5
3a729a015de2319e000eae8d37011b25
-
SHA1
3b45f3d012dd1c8a96e783c6b0a7c92d506848d7
-
SHA256
92bc653b4549441288f856601da28ba4c5f0380cca31d6b167a15af44e4c763e
-
SHA512
f12857b5ff05620734845668e4f96fdf98b293a917679df1721c0805f6808e12a322903a29c204cd97742923217afaf995ddd6da5e00d5e502d3d27fa83ccbff
-
SSDEEP
12288:797kKnzIF/oElaE8cxcFFEJ6TGd5qpIBkBEHsoy6BmUzQu5OI0g7hRHMlfM2:7hkVFwElpNqFEyGS0keTUcvOI0g8lfM2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a729a015de2319e000eae8d37011b25_JaffaCakes118
Files
-
3a729a015de2319e000eae8d37011b25_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 802KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 570KB - Virtual size: 602KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 464KB - Virtual size: 463KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE