A���@$� {W:�$�&�o5'xK�S'���l+���]��n���=�6�zWg�~��G\@���99� ڡ���| �a*����R��9ex�T�/���G&zP��E����g8��Wʧn*C�����t=�Q�+)��N��j�z�XH/W��2�*�tja�hn��nuW;\<�8(b '����/��Yp��Ec�@�mzo,%�a��h�w>𬗹&ÏJyo��v�'�:}��u�i��z�YwkμKk�4g�ovw7Iަ� �?��[�fTxZ����g�Q >谔DU��"]���P��=0]E:b+A]����3�_��@_뭤���ŧ�e|n���B�������s���>�D6�9�H�(L6Y�C���K��������-5)����.�����\N�a̴h'���I��e�K��=�ɲy�F���X��_J'�(�ZX_���xM�:���Rs�z��<̵��Q�����`������] �����6骗�U7۹q5ut��Q����"�_�\�8P@���"_�_��o<%77�w�}Hxvv�j��]<C���$R��ѓ8Q��"�L ����?i�K^_��=RtҤ���|��K"�1�v��ny3�y��C�=3oUz'���f��7�$˜�L7Q��N��D�f_�_�5�HF6L���g�K]�}�R�oP��$�9���A���z��x���t7t���a��&td��,�p��<�q�\rf�:��2������|��� ����0�!����0s+߮�h���S̗'R�(��KA�"�Eƙ{J����t�|���dߥ��e��@�z�W������2t~����*�Ol6����F��s~/��x ޑ(�~�ܼ<ƥ%�_h]L�K�����vo�M��>�rTE�����f��hs�k������X�^� xx`gwc6�GC<2�>��̬�7̔� ���kD�~ɔ�mP\�r����*� �����a�l�x����!�����[#��������V�a�pA�T�r���>Z�����w-����K��U35n(�!vb����Qό�O1�"�rX��f�\s`�R�´�k�� 7-���K* BqM{���V�C�<ł@p��fB���Ƣ}7��W5���bEU�<0�Pω�7+�߶~I.���^g;sM�q�+�xS�LT���@Ϻ�*Oˍ���:E#���Yq�f�ȕn��@O��mzk�7���}a�RC��+��y*P���X(�p8�;g�?��P6f����F���v/a�Hie&��H�S��G�粸:e\��u�� ��~����$�2-��C>�<4L �i�G������W����ߔ0jnG<�0[@�a֢��#v,��*ԡҋ&/W��0��,#�[�P����0h�3��0h�Uc)�Kx�8+sR�˅@B��=�7c��i� ��1�ݴ�OU X�w461��f̝j����6���l�Ԫ��@�����h)�����購�c�g$��$}'z��H��0�׃x�Ҝq,�R[DN���Q_���ڲ�&� �A=�zo�+�B�e�U&a �������;`k�ò:��M��RK��� �HR�rA�a��.�F8.W@L�*�[�����YK�i%��9���}�̝v�h?��R���g� *P�B��K0�@��(W���@����f$Ӈ%��x�P������:�(Z�� ��K �03�^�d�w��y��ϩZ�<�Q�;��W� ��������b�5t��)�`~�����BY��� "7���ew��]�x�(dHU�7�I��(�z�C2��pCՈ�.Ͼ,ʵ&��)gy����7�4�6��P�V('�h��*Ĵ5�2������A�Z Ll����������&91Q ����V�, �0�����$;�1��x�ؖG�����]�>Lu�*U�k`_���e�J�mH��k�l�p��s����:�_��Y��S ~]�>g�{�Z���1�2���9p��H���l�����^oZ+.�3Ҏ�E�}��ޯ�C�H����N�(W����Uɾ�Vst��1���e��x9���Z�V�A����dXl�ὐ���ˣ��O�]+����?G�:�!��'�f�V�x�P�g�$:lQ�]�_7��\�!8��/�知��͵��F� ��P�jbi�V��06�ރVa�w��� ���!V����8���mbP�X�-�K������*��� )ncdV�Z�f���"��E�`�K�n�M��`lW�bG��/��x�k;#�S)�P����JV�#��㪑�&.e����G̅�D�&��w��a��W_Z�ؼ�|��G����W�o����Ę�k찟�W�s�̔(Z5�[i�^8?,���Dִ��%н+Rx�\}����������~0�E}V�����~qp�UK��`��[�S ��D�� �|�evy+?:0��������R�/�4aOpᡌ��7��F;�m\v�k�b�p��-)u���y�\� � �j7�YS��6�׆��J*+z��o�B�_�������'�v�bx '1/Ζ�'Dž�K>����(y�P�Ⱥ���`U����M��<2�mߩ�c�\-�K�y<:���=�?Y�>�:��M@�G��ABh\�d#�1�V�<�_/��(s5�Y"�z����r�|��5�i�p�<����ٛ~u���]�����ˌ�����r�E��i>�z��J�6�O`ޯ����.����E�"�L��jc��yf��_i FnW���4l 8R�o�n ��f���g�(���� p�_h..��z��#���P)˥�A;�P ����[���u������mv'R�m����iث�ҞX��>���P�r��]���%�Y�&nj�Q2q��Ł���i�E�,������+*��Ie/���� ��&M����M�\��GN��ߜ-�t��nI)�B�a19H'%HV:9�\T�L;�ʷ�y\!@}��5��=i'�.���o }������Ȝ��Դ�{Ƴj�Z<�=~<���O���7��ʽ����Tu3���
Behavioral task
behavioral1
Sample
49e47b049379372e7393d288e93f2fe0_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
49e47b049379372e7393d288e93f2fe0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49e47b049379372e7393d288e93f2fe0_JaffaCakes118
-
Size
720KB
-
MD5
49e47b049379372e7393d288e93f2fe0
-
SHA1
1fe10769a64402a4d487e921ecae8d687de61bf6
-
SHA256
0bf91ea9cd72c5a68779a071f1e7d5010819141d32224b8dd3dcb1894be3a71e
-
SHA512
3e0eda45d67cf8de2a9cdd9e1f9f37a9761a33f3e4ca916f631d9423f21e05d9fb92efd5329bdadaa2687d3c67e9715f26707c8442602e25c6858ab8295e12f2
-
SSDEEP
12288:eOhweMsFZNo3MFfuKJ2e+u9HaJ6asJOvSWMneFD8aK/7f1yt9jdsV35xSKlKn49m:eqs3Md5J2He6J6asJKSpet8aY7AuVJxX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49e47b049379372e7393d288e93f2fe0_JaffaCakes118
Files
-
49e47b049379372e7393d288e93f2fe0_JaffaCakes118.exe windows:4 windows x86 arch:x86
f17e92d9991907fd3b4c9c51d89cb7a8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_QueryInterface
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 658KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 704KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE