m2F#��r�L�<��� �/�G"�{Q��)ڜÆ�=a�ݴ&�mC/NM�%��y�vGy��H�`������ YS��c@&6���K�`ِN:����U3�ipX }m�p�/"�9/��+��D�2�w��10\��ܯ�M��y�1-�a��4��l\GgEg���|�������� +�(bH�x��S-<S��O4Z����y��y�N��f����U��x�n]P/Ny�t�i,�XsE. \�u����tR6��N=g��)�bs��;9$�ǝ�v� �/.7���<��A���Lkޚd�#>FQ>*����������?;5*O��Z=9w������E�`a?%k�ܣn;��A��`��U/��[䃙Y�Wm���ű�,��O��d&��w�]I�Ij�/�a�>�>��Uqީ�k�RݯI��`<���5f���aB�I�����M�8eԚ���.ŀ���::�*�����e��%?{��)�w��P�����<b���i@ -5����Up�7����e� m{X�T�ڮHyaSx�����N�ă*BR�G�J���M���DF��߅�\�8���wgS ľQ�i9KGA!��Ĺ�yɜw~h:ES�2�Y�5��vU�������3�M�_o��617���L�B諨�8�QNΘ�|��;���T���o� C�".���,$�*:�P砒��jy�k�t�啹r"�.5ﭾ�ݪ��f�A|�O���^�h�A��W_���&N�=���&1� b@Gc�� ��qW��w�g���һ�c�$���N�p.��ȁ�f�-қ'�����u�)-)c� � ����|Q�W�I�����K}��H}�%ɫ���=�U��H�|O��.^tO_���w�������b�X��uX�V��=�(U¡ڇ%�鸑y��A(hj�m{8�V��LM��|���%�:Qb+B9�>�����9��!0(�Lp=���ꓠ�CF��tQ���N�RS��@����&������F����M\�OO��UkJ��/T�{w�.f2 �] 3/�^ `�Xv�T���2�b���H}��T�P��{tj�A�߫6R0d����6O���o4�s'��W��U���8|Q�X2�����7ϲ�q�Ka����jt_���!���d0T�w��K� ��1jh9�z�������*�������l?^��j����SHL���H��Õθ���i�T�ʌ]9�Z��Mi��y��j��)���7��T�*TT��c6?}�p�j��7 ��/���\'»��uo��,���)*���RN U��[g,��L0�}ZL��x6K+�v�O�_��� ����X��HG&�+V�K��e/V��l$ �@���l;���1��O���n� �����*P���yS���b�"$A~%�d�_[߰��<�u�ώA��isS��[W�)8���y��G�Q�dК�e�&>��>08hC��=��H������[=�?���m%4v>�m:�����M��?��"}^|>���7�I�������\��(��@G}�������,$��ԟ��<l�����U��LW���.�Z�C��7o�$>@o���yӄ��Cӟ���%@��{5.<u��4|l�xۓ*ώ��^�|V���51��8�L��]���d�J�m�s�u�Ȣc�B �H���u�l|D��O� A��ʦw&/�W��7�?�㟅X4�\��<�������4(��/��M�k֞Ce�TL��*CB1��Io�����^��`4&;���5��^'J�]�1T�&۩�,�U��Τ]<�e�wm.��N�R�/�|-��.��i�LJ�� �x�����bL52G�d%�[ݨx0u([I�o�χ���㻪�YRk܋\�Wp�Vl��o -��t��4�I�} ��eAA�զ2���3+d��K�V�Pl�,�l^ A��~��E\��ꀃd��\V�_L.�,���WF��(�x�9 �L�e1�L�Y�]�7>S�-<t�c0^��~�&3s.���̅�YW~3�4}�MD�/�-_���p�P��/���DDp�ƌ��@��UFG~"��)��3�p�g+o�o��zl���4��,�8i��&()1qb�B튥.��ń|�}�CRs ���9xʩ�/��)W�a���sqݾD��|��H�� �_�|ͦm2���JK�D#�\Kp���C�w�A���ャ�]���wb�q ��j��:3g�*�B����V6�[����{M�#��k�_�B#��m��t��W�4��,�"E�f/�q���F��w|�qP����}��58�� ��H��o�M����"1���_��f�D]I�1�x�v�^�൬r\9mZ�!d�|㽯���z��d��s��Z�k����Z��� p�!Dj= vqr��'�����j����ŞmI�� 0��O%��m7yGȶ�[aj��]mń��BWCN���L�'�/����~K����O<@rh�����'�\eD�kY ���ד��9Ы7M��Z`允lgo1tF�67���J0%�>A�XY;�l��1Dx�B�� �D�zN@@ͨ*Qc�zk7Іp��/��v�ֺF"�n�H.�/�j���n���'�2�� ���M�k[�ԡ��u:;�����_*t.�v7�"�[�.��Զ|��3�(kkA���ƻ�!�K�?���bi�h��� ���\��|�e��2/�Zkgkq����==V�2�b\��9���w��]�=dB�j���Lŝ�e���������f�Lm������ff��c����e�zޓ%&S��֗9���˕]�����h9��o�Z���1:�E����3� I,���_D�*Ȼ��[����t��-�����{3�ss�m"�'�c�1K=T����1�hbY��{�Kkf�_�[:��-=����t�����OOd���0A{�|(����?���E���E�/���E�fl���o��"K����I�o�����s�R�RL����$�<��^�l�wu����*F[Ve���+������7�IJP���5L����j�*��n&Գ(U��հ�<}Ʀ�1��44����b��}�㸤{r}ޢ(�Cx$�
Behavioral task
behavioral1
Sample
453dba4fc333fa24b09497d737084ae1_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
453dba4fc333fa24b09497d737084ae1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
453dba4fc333fa24b09497d737084ae1_JaffaCakes118
-
Size
376KB
-
MD5
453dba4fc333fa24b09497d737084ae1
-
SHA1
f9ee81f3356cf2abee2968c111d262f51ec0ca9d
-
SHA256
4da2b948ed7c43e4862c148e60cde42c0c70d342f250b81a3e8ed605515b887c
-
SHA512
cd77036872df89b3f193a67f687c647f5117557643f9d9b1d7932846573d464b02d681a0dd8db1884d47e9ac1b881dd08578ec5bf57c3865499f49c2512d8aab
-
SSDEEP
6144:bD4HfRncADmJrXr3ZVYcjR0uAJlfwClg4nJaKYHJnwwf77Hi1O+k4E+W8:bcHfZDm5rpBdPAJeCy4nkXHJnwwf77HI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 453dba4fc333fa24b09497d737084ae1_JaffaCakes118
Files
-
453dba4fc333fa24b09497d737084ae1_JaffaCakes118.exe windows:4 windows x86 arch:x86
344cd10791ddf047143be0208efb3626
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord529
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 360KB - Virtual size: 359KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ