e#J�{\����d�G�U� �;J�4ؼ^홙ݿ)��|�5 �DA0=~f�}X���V��=���|C�f�����0��5�L��¾��/]Ϣ��B�=Y�^��O^�9�c�%�ƃ$�fS���Ϊ��x���#�@U.���m��"�܀-O�������,�p�"��]�%��d�6�R���"R7�9�t�{3���[Ғ<�e��/�\�(�T�gng;M2G*T(���O�����p�V�: d�9sW��I���]���b�{�km��v�[$#��ͻ4���{�⌖��bn ���j��§��^���7%K��e�~W7���M~�n���Ga��sBLo�)�����O�W�֠a�t �E�t���I����o����i<vS�;��������Nϝ��а� #P�"'t�?fFs�XLQ�-)ʭ��� ��B��OX�f};���%oC|[�\���N,��h��Hu��l��؇�VYv��B�p��0*k|�-C���Q@'�iC>�#ye�J���訛KY��]�8��#']�r�9u�FG��]fm�S`��۾A,�M<*�hވ��fi�x�z?��}Q~�9g�q��ߟſG����r²wU6{9P�f�B#Ӆ�e�ͽ �]�h�Xa��൬�^�P MѽM���̸���i��3i�{���k}���у6BS��x�^�X.��o�9�{o9�%���[? �eSw�fA�ٞ�P��jH��5���oY5�Z����D=��>��GS�v�������O��1X�F��v��.�i���eE8&Y��@�K�#V�T.tĈ�7h��|�/]�t �a;\'f�-X%�J>/��QaE��%=��F:ȹ�Y�x�M2�����[���E��w-\�\R)���� {���XΌ�ɴ���Yx�&��C��o�IN��ŨJ�Γ>�x�:Qќ��<�����S<����ظ�'7�����$F|nq��E����1��bb��e��/�z,���'�1������h���y��BlyP�0.��"g�]�ֵ��n�)!Ώ���սN�I?�h�W@x�0�p(�1�āFj��O���fle�a4A���Ҋo��?W���H����v�jv�0SwL��%���G��C��~;��O�/��L$FWe��~KRj�麸{���W�����J$C���ݬ�E����=+�� ��nf���#�~&!w�{�[�8�&�N�������_]?�9��L��u��W�>{� j�;I(��&@�MMJģ��u���҄}��)�1������H嫞�.k��%%�;�U̒ l���A"�4$�aH����I�?�Jb/�C��P]K�$*ܟ���?FD�Vh ���� n; ^@ A1���4 U�>`�����O[]��Ï������ЍX��.�� �Fk�[]B��h�&l���a0��'�6 sd����gmѤXu����Z���={������ ��a��E�I��k�k����:ZMN4��%>O L�_�c)�V@D��U�RjZ��v@>P���%���hw��������I�Hc���x>� ��!t����f�;}b�*�$�2��c~V'�#�8ON�_�րJǴ�U�$�Z�� 1U��l=D�Ͼ6d9%m=nQ����p �X�x@0��g?��Nu��s���_�����L����7��7���y�i����vj�|;vDT���h[x;egd<�jZ�Q���T�Y��1�Ͻ���������0��u,A�EG0>ƚ�?��E�V�X6#;�ޭ���3M�t��i\�� �rm(������J��%�ŘJC�c�$�|�ť/L��\�n0����_<��y*KL�vh-c?�q�{���� ��ub�Ѥ$x�vC��<a�}&�fDy�U�����Y�G�+�q�FSQ �=e$@���`�*�N�Y�ؗq�C@锭@�@WZIq��3bH�40�x��]h����sQ�T��O�"����6�� 㬫��{���۟��L@2���2�R���{�F�tķK�)!:dQ�Z�>k�f����������R��Y��q����}�P�t��dn����iM�N͚�3�ؾ�h9�5)���Y��N �l��J�~9)L��n�pZe`�mM���xd��1|��C@F���P��K�Ɔ8Z}N������>,�i0��Bb2T��fO�����SPh]��B����Ac s3'�vυ���e�As.cC��G�/�$c!YC�H���M�ۑ���}���T�K�� �j̐m���δ�:$ڜ����Ѵ�l��o���+��ڑK�_v*���.,)SZQRT�Z�.w�K,���xx��6�U���Rk�-A-wM�`����ƺ'����c�*h�'����%�"��qƋD�9�o��ۋ@�C0&�Op�U��m��x�����/#���d���t��$�?���Y @��P��L���/�����;4��Gg"6�~Tқ�-�0���\+:?�N�hY�~���ו_��K����L�#�Uk��#�� [F�/&�����=����mX�)Q趞� �Q7(kj�Q��u���!"}���5C��)qr�>2���:��B ��� ��ՌMiB2ķ�C��������r����}���9����ࠉU������õۓ������+�nD��f�Q�$H�<4�p9� ��B��_��g9"MO��Z N�'�B�Q7a���-��A��G��}#��ƣ��gh��D�\O�%,���8`� �[��ڪ���.l��V�8�D#F�;�ߘ骉�0ϝ����w�Ͱƅ����qR��jf���`���4�89� � t|y+0� �t�thwٗ���i���&+��I4Lp�E��½��3%$�T��-���kۚ�����.�y�Xɺ�7t�z�#�]�p� �9�b2S�Pk�� ����3�<��Y��~#�{(�<r�s^9^ծ63�a��IWc9I2|H��3PB�Һ� ^:��Yⳏ�ҷh�8�:���o�V�fL��Ah���:����[ �K��9H�����t�gƷq���@�42�+�'�Іv��2V:�F��f]
Behavioral task
behavioral1
Sample
4499f9f652f8464d1e7029086020fe75_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4499f9f652f8464d1e7029086020fe75_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4499f9f652f8464d1e7029086020fe75_JaffaCakes118
-
Size
164KB
-
MD5
4499f9f652f8464d1e7029086020fe75
-
SHA1
955aa82adb03fe9cbff2a67c5e3878a5168d53dd
-
SHA256
2b4b13d4fb6abbd5bc2ee9cace31d8f873792a9f287ce67b4ba38fe4e64f2361
-
SHA512
113446d355e005edba3fcc9105b67fee9970dea190fffd2cb01fcf0e4c918e246cbd4afe817bccbce82018f2dd8f5391b2e907a97f446fb1834e35e04bf75840
-
SSDEEP
3072:iw+PUKWmBxq9jAISMPjitkuHeVqqpE/1AlL5xijQPOXkRUu3/PkRGB+q/VaQ:2sb5PbPjTqAPE/1APxijQMkmuHAGB+qN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4499f9f652f8464d1e7029086020fe75_JaffaCakes118
Files
-
4499f9f652f8464d1e7029086020fe75_JaffaCakes118.exe windows:4 windows x86 arch:x86
acee69c4e6a7a74242b8d9c2e0e9cec8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord641
msvcrt
__setusermatherr
kernel32
MapViewOfFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadIconA
ole32
CoCreateInstance
oleaut32
VariantClear
wsock32
connect
msvcp60
??0Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 152KB - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE