�����o�i�E7{����Ʌ�D��j���JU�� E�T��×0��(��O.N�UY�,��uۀ�C�$^�>j�"����=�-9�����ȃ�~���xC� �gZ��aS�2aE<ޕ��MCg�S� 5D�ب��Ք�(3�AU�i��4�wT��t �8<���9� �րO)|�^)�e�2�W���ok<� ��|eĚ�F�h��������,L"l�Ω� ���3���\[���0��� ��ɒ�r��zu�Z'�,����x��DE�;����a�����ː�J��$�0g�@̫Y�Nw���tz���-Y���B�B�Ҋ���� ��߃ʹ����5 �����!���Z��h��D�~���8@k�e��J���� {����H�4��H��S|���R�BQ����S��s�#m�@C4���8�K$�A�͉Ӟ����\��}Z�����Rb��"Sj<�y���i~�<7�7��;Àκ�����*WG��s��Ϝ��]��A�z�O�e��N��p�8�1Q�h�)H��B�K��h ������������&��w���z�BB�f��r�:b/���pAݾb�dC\��چ_���<�$� � ����z�z�{(�2� $�9��� A�#����o^�44NJ$�]�D3j2�K���a{�� Q���u�u�!3�Y~��n�M��f�Ē�2�G�F�I�3 C�D�NƔo|�%YsO� ϙ;g;�ѿ�p�%4�Oלւ����x̌@�]����@da���/��?���6�u��� �{�A������4�Ȋ��e�\�bfF�.�!�M�N�م��.jx��Z����BE��ay�?�u�бD�4,�U����C-��6�,��Ioi����,kF��dqStr���|�0F�<��P/��6�z��g7� G<�w Tю��NJ��E�C_�+J*�0��v�㈎ 4|J��CY� ͨ�ՎН`b���os2u�{�v�g��@��%��y�������5���w���rV��OM�jz��In�Uّ|�������D��.��s��V���h�e=�n�YD6���ؘ�6ű!G�U�Uh�ȶ:`hn��+t�)��&Ù�X�j��O��P�`��W7@4�s9ȲDo����&�.g`�f+����:��B2���?��'DDeZ�ce�:�ox�&5�E�2�F��6��!+��.y�R��ދͱ���PE� K� `��L�PU�Q_�/��NJ/�x,�[G�6Q��; ��r��e��r�?o៏��yxp�|�!�����-����-$���y�`1�-�� ñR��9#D�~D�ٱc���Ax���^?�1����5|�����o��-�������lB]�d�x��`����������~m����N� ��v�����;�x(4j� x�R�����.]m�m� u\t?v)� �ʂ�U<��wdAA��f��m�mϾ�ڮ��~9���~��<�-�2��Xn���N0y��l��F��٢q�{����e��)�M�ƀ�cO�MFT�n��K����9-ӛti�{���^Z�;��%v9�:Ý�C){��.�%v����R�X��r��k�?�b������L�gE����Tڧ?ԫ�A�u��G��>�(�&q���TƏT{{�����CBw����w}y�T�.AӀ��1\�"�p��/����ugt,��!��m���Η�]�4ac1�S�4��^F愲�݉e�F1*���l_Y��qYL O��l;�C�����T��g�b��júˑe0�>��UW�ʐ1T������b���d������G nS��)x�����(Z'ut�tcv�4�i�Tܼ���5T�c� Y�"�$����O#ũs���٫`e���R������$qz�H���'X�p�`/��rg���y�y5{[RQU^���������X���yx��V��nw�K|1:G�����[���i�i�m^Y,Jo�c��PM��Ғ7��W PY2[�[�te�ajt��G�I�ך�Xq��T��f`�A�"������/f�|g��e�1�Xƙ�i�Pr��o��y�Ҽ^�!�tK�g���v���"r��仓/�^rեC����� �����DP 6"�I� ��i��9�|�'�Z����) Xp.���H���.1 �i8��h�؆�0YB�p��cP�ml�w%��E/�P8��E5�d21i+��Ԋ�7l ��A�,��.��R��/�/��"1Pq?�¤��Ha$�l�@�p#E+~��,�V==k��xX������|���8A�h]]fv�wYڽO��qO,�!���<���8G �]��,�긨��R��w~�a�qm�����BO3F(� .麑���MV%zC����������"ksv��i/bf��>���/�~���� �W�g���R��(� �\��c'�L�"�w��A&�$���r���ч�g�SRP$R1�X��.m&ei!-a�ȭ�RT��LM��ȓ-n��A���0���f���E_�� }�T�$�9�3~{��0ڔE7�H0�����ޚ��m7��7�7GN�E�vG̵�M)��3ygh����Bj�}�l���q!Ej�o_��Cg��&q]�ne�@��ۧ4�����FdK�(f���0�������8]��^��H"�4�>8��EX��%1��1���@�t�r�̈́�Yd2^]겗��v��%��6���JC�bM�ÂiI����-�� Vv�>�q�@=��|��v<��S��2�*]>]���6���"��䅥>m�}K������.F"��\$�B��0:�Zڕ�#�o3�M��e���'����x�x�X�ҝȴc��q�mI��-xϹ���!��YQ��G���d����1ח�0��W�'��p��םB�b�|~� ���M��݀� %�=N�wV�S��`]X5�)���N��/�O2~E��K��6��|U����J���S�Ԯ���`'�:.�D�Eq=�W"(Z�f��Z��Љ5ₗy���,F�J'(��6ޢ�� U�Eї^�f�����u�����ΥvM'4����k�������K@���?42ĈL
Behavioral task
behavioral1
Sample
3d4cff1b54d4f56ca04eb1a455a9e990_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3d4cff1b54d4f56ca04eb1a455a9e990_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3d4cff1b54d4f56ca04eb1a455a9e990_JaffaCakes118
-
Size
740KB
-
MD5
3d4cff1b54d4f56ca04eb1a455a9e990
-
SHA1
b5d18cfab0f132d5453acbc3da5857d5671d25c5
-
SHA256
60142be0171666bbf1773148b0c6b366c7cae0c13c56179b3c389be64eb03c8a
-
SHA512
a9ab482ae518c02ca1083cb0c3afc06d5647ecaf4fc8cfca4839d803a38fad5df7357ea29179c7551c7b233e2b1368a0e392052d02bf570eaac8de6bad2a9cd4
-
SSDEEP
12288:P9Ipj+SjGzFxmIQzLTNlew6UadUFz0gw2F/KXHZP50UD6Fqt1qyaGkV+/0G3:PONmnmRPTN4LJg7Kph0UhtQyaX80G
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d4cff1b54d4f56ca04eb1a455a9e990_JaffaCakes118
Files
-
3d4cff1b54d4f56ca04eb1a455a9e990_JaffaCakes118.exe windows:4 windows x86 arch:x86
71fc43cdf07d9edfea615d7df24210b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord712
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 728KB - Virtual size: 725KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE