�d�#�����ϊ���(T���]����e�RB쪠�J��ؽ�f�v"V��`�3�h�go��ѫ�+���mY_[��1�/� +���,�̘K�(�Mod��O���<K�#���:o�(8�����`pdu�J�k��M^qk-�Q���4ZD�u)v�0_�{�_L��>v/�j���I���$t?�����CX�,�S����)yy��W. �3n? KƵ��~�z|� �3?��j@ �V����T�N��~�(��P��ח��`X���ň(�6�Ϗ�v��8�q7�SdF�x�Z9:҄@��8k���� ��Hg��q-�,'_A�#ơ��h{4�P��O�1�ܕ�n^C I�5R_+���-RQ����Q�o�wH�q;��l����vm���/]v����e=E��.&�,�v =���� '��h�Q+�hc7�mX\i�g���)�Kl#20�r�l�j��{��m�>ZK�e@:��ת4_p� ��d�L�I�}d��"����!S$��P+�".5�n<�g�/i(u�Ø?��>r�7��G62�{~FDT�Tjg�!�d@`��C)F�-%��ަs��X?#�����w1��mj��x]O]��F����}X��H_��NM�%��6�Y5����Ei�I�� �05�Ì�VȘ�ac�4mB�W5j{gs��&������0�_����&�\O���f�ˈ9��(OR�xK"2���z-�T���S��Bbݗ,������=�����������܂�a��K�)��%�2�E����\��~$��ķi�5H��S�hB��U��z΄�&�L��j�P���w4��p�_�,I� �x�'Y���*<$���O���dp���J�%u7;6le$�L��+� `H��Ww:l`���~x���vdT{�ni2@E`DN�+B� J�yʟ�V���,E�݄ P?�_\x���)�p� ��.K�x�/����e8Œ�3����v}w¦P�y�ѱ8� l�����kY��~p9��\N�/���7l�i�S* �<u�s�1�/��@q7�f�O?%T�~[��z�����Ia����x�k�>UV�0v�k��Z�X2��t��zi]D��:����ӭ� �>���7kCޡB6�1S,�����������x�5���K%���v����Cэ�B�Q�]���ײ�ӿ�P���I;�5z�4ZŤ��m9�m�� �;��Af�U���v7r�+S��KZ��"���2麥��}��q�{��w(3���L���q>eZ��G���1����"SR��N����*�(�hs�iEyIQ76�"ȮRH<�mh����M6vPFM������WdQ�3��l��N����\z���v]���kUď��Y]k`DkwCz��@(oNK��h��Y�O]���6��#,>ذ �AnY�7<����b}�"�k���H��&�K4L�L�>���3A�����%רv�1��w�$��%�I� ��1j|+�3&ړ�L�BxU���HdyI�����A�#�� c�������)~ɫ_�P; �UW%�@N|q~6��S�_�"q���X���K�BF�L���1c։�������jM�4�N�0?t�+vZ����b�A��b�qC�SW��V�� ��kT�F�M�����x�����g��:-@��z}�ܦ?��q�����NA=�R��d��^m���w����^1�N6Nң=�n�I���OsߣP�"d]Mf�?���*piM������ �Y\��}���������c)чM�A�d�G�D��I*�F9�������R���0Z��w�u�[�R&rsv" ��\L�-�&!fO2�8O�Gc��-!������HO(y�m��Xͮqy�y� M�Z���5�M����kBОgW�;ۺM������?1���c��nO����]�2��pwF����h�xZ�� LgP�9����m�k����k��C����T���\?GwB���0��Ĵ\%$>H5�c���}$�BI=2��I�$nWQAB]�-��vw���Th�>;�\/��e����e��L�6�G�k#�,2�*N5Q�~\(F!���:��a��Ԥ ύY��5#X�w�A�?)��B� ����4�7ƴ+9W�d��/�h�^�f8�_]��1�4�q�;��r��0C%,��w��dׄup=c��O�y�~.]o�D�g�̵���!����8���{U�*���ўf,��������"�nV��-\^w�?���'����0��A�L�|C����Tz"�!�!�K��Q�M��U����ˎQ�A0��E)��@9�K�[ފ�g���hk��QWKr� �ni��T`����������"�O���5-0�rNU&5���oJ7����P�:�]6�����/b�!��@S�f�f=쇚�0���.���:�W�?��������d�U��[�/��2o�"�1жG�]��V�ʒ,v��>%=�/^Qs���"q���# bA���b����j���w�&��e;;u|TI��k�vYqvHɓpZ �������]��.�9i͒N��~Za�ӳ^��j�'9�c�f�@�������e�W1 �B*�*���q�iK�����BTPw &e�hY�fW"�-a^������vHM���M D�u�2m7�>�Oc� ��NG9���9�e�b>�h��_L[�%�5�3o,�!K�� ��w����^�$��>~�.���O�;��sUZͻ��8�9.�.��*Ñ+xD�=v/;�)�ch���V�؈�CI�)��kG�H]�; ��⛞@�H����G��$�Vu�,5r�1�UZK� Q�v��!K��Ԕn�EОQ���4�W�%oo�7�c��y����������naц/�R�Ӑs�2�s�b�h�.\�Sӫi X�A��M�c2H%1�<Q�������%Ȍ=���6Y��i�H�;��KJT o&PM� (��t9�Cig6�7�bf5��fY���� ��@�dCm�gf��J �{�II _8��R��d���]�N���h.��GA�я^ ���8��F�;BYxg�R�w��'gl�����1>!�;�C�F
Behavioral task
behavioral1
Sample
4a4c9ea42426600e2cc0128915aebcb4_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a4c9ea42426600e2cc0128915aebcb4_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a4c9ea42426600e2cc0128915aebcb4_JaffaCakes118
-
Size
343KB
-
MD5
4a4c9ea42426600e2cc0128915aebcb4
-
SHA1
5b6cb9d7a1b671d5fcc0128058e0aef2fc64464e
-
SHA256
32867ccf128851404e6972b0601e268ce2a646aaa9b35c33db740ceb2a3fe3d5
-
SHA512
599771f5f887862e4eb8d894c18b618dc052c1dc851bc06ac44f683cc36ccf2cbaa5e27e555c2c41c2beb1b4e270d89cedb7b9e280b32d95e50b585cd3f4ba95
-
SSDEEP
6144:TVhCn9QG2wWa52ctfvYPr6K4NhZ/OFl74DJw2Yf9afrs5kc2kY:TJGN52cOPmmP7QwXf98s5kBb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a4c9ea42426600e2cc0128915aebcb4_JaffaCakes118
Files
-
4a4c9ea42426600e2cc0128915aebcb4_JaffaCakes118.exe windows:4 windows x86 arch:x86
21bb3ea947a85634dff33a95c47ba987
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
SVKP Size: 512B - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SVKP Size: 296KB - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ