S=��ك�½�!!�!�5���em����⏦�{�����ǯ�������g����?����0ҊIG67f�slӖ�/撯.F��m"Sa��O��A#���,�|�Un}b��E�M�hCkQ���j(p4#O��ˎ��({��-9i7V���u��Θ�>~����4%��݆*^���U���w2~�Q���"�K/A�@l� �Hr��i�-��1����U=&���G��!m���i�YED���o�5P���?k��0x`ȕ��f]��r��̜iuft��J��'��$xJI�`1l��`x�ԀH�^;����2��A<,Lq��a�)�/��������änj���4�4�2� �S��&o����n�8�@IZo��T��2����Ӛ���z�0l��5�?'�\D�P�p�@����:;�-��.��K�R8x�B��v �O>���AF�>���P �}��O!� Rg�7��"N��b� s�9��$V� k �"�b@FQ$�~��t�ᒐN%�����'�U�h2�.�^�U � C��&�U �k7u~��!|��7L�r�$C��Ȯ���������{��c�fu�7v\��!b�2cѰ*�n�\�n����[m����7���o��ɚ�Q�QK�|�w�5(����|����������YJ$Em������U<It!�{P��:�k�p�<z�T�B��{LM�6��>�#��.��1\����짭��7d�>�9�Ϋ%��%�q�z�8�sS&a�v����j�a;F�'Ƨ�� �x$$��&M���,R��[�3�ʗMa���V�P4~�۵�0�����v"��t�![�1�l�u�"�bm�JdkF���}������^���?���/�� �p��/�ɥ���8��� ����4�%*�-�:��}�9VyF{����S,��5��W5g�M�j�� C�����;��3b�a���_��!��������&��Ȱi�A�Sօb7n�"S�'��-���*�d�+V���)K��fa���2O��u��{w�xP�vpǍ��p�gh�>�g��.�Tnw�Y@N�����2��\L���p�� �Hvn"k���{������'����[o�Ѵ;���B��oc@ۖ��q�H��\����k���,4��m���NH��"�T���l�@ۚiyza"�ɚ���K���J�G��^���%���a�>�u$ԁX�/ĥ��]��*��ɇ����O����dsO��]+шݖ�CG�+\�8u~�e�_�����6�6�����AMƶ� JQ-+Ze;$N�??+����S�b��a�-�i�6�=�`}�=����"½�ٛ���uv�^�G�50xN�����rIa�:�?Yb[[b5��W�qM0���۵!�!d�����\���(���EЕ&g&�>���XR�L^Sϗ��~:O`u�a7��|S�ij��|F����D��9"D�����M�Tfms.��B|������gzK_�4@�Q���n �����U�^/+�.��:�n$3'(�+<�:b��`B�L.�6���~�D���� !����Q��5�ȑ8K�� 7*��) `�@N��4,<�w�Bg�р��~$���s ;��0�m�f�<y�����D��N�MUw��-��㺸뒵���$�ϭ_��z�v |�ZVk0�����$�1������Ш���ha�t�]���?91��/:t�%����c¡��g'��z�����Ⱥ~��-ڦ_�H�zi���j蝥ۓ4��/���e�����6�e۱A!���r�@0@.��U�L�d�x�-�5�y����:u���XG���˪2G([=��T�ع�t]�R �� ns���T��;�IvWwu ���R �H�.(������᨟C��*�[1t��z��L���8}�������d4$z|&���N�ߏ�)xvx���J�ݽm��mt�P���D2ʄ��e|�v�JŸ�B&��(���]ߒw�b`À��g�852��K�K�+��>kkE�n%���$�&��c������P���Q�j��^xR���#��NcOw8n�Ӱ&�^sj%GP�p ,8����E�6�g��p�V����YTıDB�$�$y��$�N�>l`����(O1�굔���zBX`Ы��퓛��d�����~YE����~ Z��S/1�آ�xO����NBk���m�whgj��![�=4Ft�`ű�����z��nK|=��O�o�y,�bc*�V�����ϕ�w��!�����4�%�0)2�X� X�������������l'w���7k��L*Z+ �ʿC0m�c�����/��MT'oY�Óp �Mi64*����ql��P��/�3�{}mP!nD�s��Q�R�7��Pr�?xVfT�*a*롱��ӻ���s��� ����!B�m�R��Q�xQ���8%�<�]�i������Z�H���iFS9��.�{p�6襊�]?�"F��xhd$�q��&�����W4�̼�hl�t�������'+��''j��6Q�U�,5:�ρ�s��b.b��G�d*f� uL���<e�QJ6{�d�F��R�u`��~ǧ;��-��;ns�oa�� ����t������G� �/? ��V@/�#ݜ�߷�}o���sbr�*�[�ߓ(���Dn��<�fB����zB �|�Am�����;��g��-\|�6K.א�Ɏ�D����8Ң5'�^�ELC�T= �=��L�c�|�lު���D��]���4R�K��e��o��~�o��R�I�PGK.Q"���햛���n����75�IB[�Y�� V�ߑj&y:l��s�Y������ི ��"W[P ��ƶ8��'����W��Xt�^�$�(�yC;�o4�d�J8Y�[x���t��w��Y���Ў���R�;Z2Ԙ��q߫���Pv q�Tr.��t�}G��r��`����B c�M\���e��(�2�-?E���{R��3�1��g| �W����}�u:��Tu� �Ԝ�v����Vy���l4+��}�zYo����T��U8���Oe��~tD�KoA�FnH��bL����v����PPW"V��目ǜ��a@]�1`�
Behavioral task
behavioral1
Sample
3ba6c68873bd627ffe2125509276bdb3_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ba6c68873bd627ffe2125509276bdb3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3ba6c68873bd627ffe2125509276bdb3_JaffaCakes118
-
Size
184KB
-
MD5
3ba6c68873bd627ffe2125509276bdb3
-
SHA1
242ca6bed84312ed561542b42c56a759932b147e
-
SHA256
d4caf3916507a0f6f5d5e96f0a25223ddb6b45c87243ac21c93341c93373194c
-
SHA512
1cc97c150cb0d55f429df8273e1f6b1ae5b126730c4ba8abd2cf2bfb356a00f86394ddbd1bb5d924d4f20bccc017dd9ed17fbf38ad4f2f28bc98cbe48d0c5bbd
-
SSDEEP
3072:Ghl+pg5Agq5WkvqO2DOVfKxdnymoCIyqcH7KTO9iWreNGEPhOphjpTZ7a:GhMqickqJOVfKxKC2zC93KN1PhOjjpl
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ba6c68873bd627ffe2125509276bdb3_JaffaCakes118
Files
-
3ba6c68873bd627ffe2125509276bdb3_JaffaCakes118.exe windows:4 windows x86 arch:x86
b5a6a25ad48910612c3a815d19d761e9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 24B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 132B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ