�\(T+`rkvçj*�H��(�\@��g�↯Cc ׁ��p�|��W�J>j3Beh�:Vn�5����2�H �����n����|�>�ά=��-SU�>1q~��'�Y��K���܍�b?��|�4�E�0�o�>Dw��a�X�6߲��:}N��y6Օ>-�Z��v4XD�-��8��sՁT�}2b'���4��d�t. �K����-�P@؊��w#�P��<�q>8B����I����A���?�b�Y���*��,7���3�7�������ܮ,����pϿz�g�18O�S.��������{�7Nv`uz�Aɺ!��������47F�ѳ�x�`��:��GJz�An �6ƅĚ��:�������ږ>Q��6D Y�~�N�T�w�A�u �D�[�p����J:u=�� �Wԓ���W���x �.v��?X`B��eIV-0K�1��gu�C�UfJ8�:��{���ȡ칞���e/9IwR���#P~F�Djit�p [�#k�w�*���Q����0��lY�zʔ�7�yx�6�k �%��)��* S��.�����^�� 1]B�[��B(��/#�7L`������,O:��Ô�%��{ڴ�hW2�{Du��k����7�&E[�{�{S��o���o������mP��l���`�r0Y����O����T�/2A��W+�>����h(��UK$�c�8Q4=o�+Z��d�zV�!���Qd2�z!�`y�^��� =}�P���"�I�_bd��sLWM�^nW@�E��p�g2���"ǥI��"�'�Rҷ�4��~����/^�,��!w�%�B�M�B$ͅ��L��>Z9���%��<J��in�.��N �Щ3@��ښ�!`e�<����$>}���������D�P�F���r�0h��i���~i�ܪ:�/%kM�I +#��z��Rx���(2�bb���Mˡ�-�e{��A ��p����iR�+45o-�����tKD�� d��EbW�VC�wW�¯}H����!����k�Um �"��ׯ��3t�x�����{FX�[�1���7��*�5�ٚP�M]c]X��Ճ�25BK�g�*����5^rTwN�W������<&c���Z�:�gQ�E�ꈧ�3}}?�a����(�V�Z�\���;���f9���Jn�*~��u 4 )�r���E�,E| X(�E�;w�0��7N�BF�]r��i*��02�#��s-=&�,��A%�Q����'�������T�|�/�� 0}uY�j�շ�#���^�A���1XT�Y����%��x�,�/sT� :8�)��'�?����[���ɯN������1\��29���ػ��U�i[�Աu�Y���R���<��4ļj/�S����Px�͒W^�2P��ŀmL����|dW-�c��&���lK���8z퍻I�Wh,\7�DG� �q��˪ܘ���L���R�?a�OJ/� #��$�>Z{��� "_�q�8�ְs�&�lnt���7�B�,�|��۹�&.�q�����v���3�o�������-��ةU�?�E������#�e���f��c�k����U#r�g�@X���k3�$��+s�N��K�/ʜ�s�7ᬖ�/�<6(�Bi�J� }�D͈z��t�]�¹/'e:ձ�D����g��Q�00Õ:��E&usZ7�崿k���~{ �5��J�R~�ʐ#%�� �Y���<S{�����:�E$�R� &��3E����O2���8|��-L/���ҧ-�QKzTq��e(�����1�ü�UN��H��2�b^�E�;�7�"��� �g�������p��r�/W�]�GK�NiwXy 0c5-o-6�1��vB7�^B���?����0�#����л�,j�3�$H�_���"6<�A�l�J��c�\+f�V����S��Ls���{�5��WG����%��~bo�{>&�i�A�C����m�p���SC�;�l>G���C#�g1Ƶ!�ŪY/тꂐ� -҇٫��X���X�c� ���(`M����n�� ���) �֦o�u����k���k��]���X"o���S�h��3�}Tj���y�n�|�;�u���k3> m8���A>��R��t���T�:��fE;II~�!#q�c�J�M'�Ui��/��h`^S�q� [�j@�nϮ�=YU0�<�v-,q$ JX�Oۘ�v��.�L���yH�����vC�;F�p��/�tx�����w��@��;��?9g)��w�����X�����t�� ����_�UIs̺�1���Y^Uo�UE�G��7�ܚ�c�h��0V�3ZD��#ѵ!f����;�'b����i�/QKٯ�E+�zD/�bE��;����8��gPc1�4�*ؙhБ�҅Ϝ������]&�a�]�����Ix�٥�T(,]럽�@���56�X� �(k��[�u;GW�ܻ���MH�Wh1O/\�Bv�ʽ`��8�;"���U����%�l9e&_!_�G�fo� �Ɯqf�GG�3eT�s�� �����7�b�"��wǶ�Q9�p-�L��65�I=bY�%�#g5� �NS{W;3r�$��r�-)�S���.�;���+2���8��v����*�+)gk�*Z/�,�����r��t_�^r5�v��R�=�����f������9l�?M^�Ț�_���1a�,>�4�z=�K���?J��\���3"��M��j�I���C��hn+>M��V�(�`� ��s��@�����"m��/��`��������;�3c�&�� ����=s�����9E �].��@<�w�c:�j���%�X!ى& ���oӄ�g+wbk��r7�p�u�ַgQ�fD���a�{��[6��SĈ��q��s)�t>'��6NSv��}J��*굋/w:�7�9����80�8���AI���[x��3���rc#��̀��~�ì.�g7р�mɖ���qb�'�&x2jM��5ݝ�%�ލ��3P9O}v�C��}"�_2���~�.�����9��~�F��C��������v�d՝vf�(r�D|m��D���;DF�!�x
Behavioral task
behavioral1
Sample
3c22f6a3bb126a27cc1dc21ff510b18c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3c22f6a3bb126a27cc1dc21ff510b18c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c22f6a3bb126a27cc1dc21ff510b18c_JaffaCakes118
-
Size
720KB
-
MD5
3c22f6a3bb126a27cc1dc21ff510b18c
-
SHA1
d5a3ce8f9830092d255dd811d29e9a562b115e04
-
SHA256
d359bd43d97b3133c520c6ba1b603ab79246eaf53f4ad653beb3396f98534702
-
SHA512
914e178c73f849b018e16bcb1ebfe14038b6fb3822edda01a4b9ac279f4ad731f9e0783ca42df4dcb48874fc4c13a1487dbde2dceac496d534b5ad89ee064626
-
SSDEEP
12288:LKhszm05OXqlBJ8DrmgIMnjoIlILa9lR+MtByYfP8jmKYJDB+21Qy:LKZaHJ8DrXF0Il+w9tBdX8jmdx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c22f6a3bb126a27cc1dc21ff510b18c_JaffaCakes118
Files
-
3c22f6a3bb126a27cc1dc21ff510b18c_JaffaCakes118.exe windows:4 windows x86 arch:x86
274755b3c9cdead6c7d3fe11d72db690
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord535
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 331KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 540KB - Virtual size: 537KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE