��"ɴc�z����,l�忂v�B� p�7=4�]M��� �SPAJ�Ԏn$;'�s%�G�W=��3��m{/���8�nm�=i^���ˏ]�<���QlZ5���3#�{^h�������v%�L_e#Jm&����(1Ԡ?M!GS�x�����9�D��A=�J@1� ��Y��D3�,��hY\��ۭ.��g��i����xV�*k� ��S�j◐Ớ1����#w�����2Mѕxg��\�a4 9>�~1��2 �x�����oݳ����OΘ�q�Я�J�ʹ2��&a���e�������R�E�CC2�J�c[-9Ҡ��𡺐-8��M�/��m��9�� /Ѥ����j]�"O���;-`f�1�, �]+��S��۠��� 4�}5��H����nޣX�d�VJ_ܡ���TU�2��/|�*�������?��Z�M����>�2���Gy�O�s��e����A��p�Q����o������?�����ћ7�Z6����D ,���=��n� %M�;�W��M2�|k� �ddjz���=��/�$Em���ڏ�`?�m/���y->d��@��{���bt�Af�6�-#[��]���+��:OkIO �W�y�p���|1�sQI���p+��N�Dl�=�;�y��@x��x%JƧ���#��d�܃Q�� بO���j̗bf5BӚ-G�?Zf+16�)�W�k��ѻ�M�VZ����AH�jy�xxڽ�v�?$��;�{��n�c"�� %Xq�jw��_څ)�c/d�g%��7ˀ��yHa�-�O�6t��<Շ �����$�� ~���1�9��eM�J*�r���컦�����~M�9̃-���۽6�k@��:Į-�8��H!�ɀ��{W1F���_�A�k|7GCi!qĚN�v�6 0�>�S��Ǥ��{��Ex���z����������QB�Q�7��"�j�:��Z`����U������a� t)��Մ`.�b��S�{�z[��CSemdPz����SiS*���f(�/'��K���fw�tuT6��X.^��D1�bb>4�k|��Y� �Z8�2ԕ��ɡf�:}��:�dNf_�K��I{��.����qX^}I�ou�!Q����g� ��8���,���l�����Y�W?�F'���y�V+��B!ҹDp�7�L�D�:VZ��~���pK��1�8]��k���P�\�R�����ȅ�-�jX��3�Κ����q V��(��♈,qW�nps�6/mi��~�y��H���� d�qJ��}�i������_�$ϕ}�X���̩��Em��_����0���ߐ��g�'@��i��-B��q�.3���lm��@��(vZij����?~�(���a�P�*���B��{]���U�Xl0�/F�,�sg�[�^�=\�{l�i�4�u��^S�1�?K%�s v&���%Xd�y$;{�sר0��+;B]�.�+�Ǚ�B�d)�ZcO�r�QDEj�-��g��a��'�����۟�oDn�)�#>�2�H�>��B�̓����b,Lh��w��� �ތv�Ka�]c_zK�ˆ�+��C�u�,7��T���\pvӡ�og�?�c7ʓ�X�U���u���>ba���f'�.�8a����Н*�0#k���&��_��8X�M������7��!��i�!DEV��$)e�8ү��Y/q�X �%,���H{���oyN<�z8���0�^ �Q��C�L� G�B��B]�c�q ��ͷA�P��c���e(�Blw�5����;�W�фŁ�!�"v<]�SY�z3}� �'��W��SM�~�X�?:��=ߡ�B�x��`��k�S��U�{x�{s&o�����g����<��ch�r!e�h,�R}�Ƞ����/o��'���d&f�P��TU�ڲ.��d0������`3�aRU�l<��%��q���l���<c�����x,��FT�(3�p�����.��_|%�B�H�C����L�[]����-�z��D�e zR��օ���jbQ���jΦ��x<Mv'Oǩ�yA�����榪~[E��HU�Q�x]�)�VN� �Z��ǀe��f���ý�/����G� ��F��n����r�����L=������sE $��(8�~���ͤ��ޒ��a��J�_��҅�K���u�ı >(�}��Ԍ�S��:c6=ID���+5 �_s��b9Q�NB����X "PN@��f�/:���.5���n˲��]�}e���P�H��;�(C Rc��6�+b�ʓH_������g�#�:��'ؤ��ڑ���zK3��(C�)��[�l\��w�S:���q�����qdo�7���ٱr�og�;�-��_)S�HA�A;��G�>�ɓ�s�=�&����?P��s-N>���T|w��'���s��MK`ԌX��M�����c�u���(�k��m=�pS��bM9�oq�i�M3���;q���C3��e���Ɔ����A�%A�C��b��TH̳p��Nif�+��]�E �����y����2W��?��t �C����TR�W�ф���E��Չ@l�� ӊ�~]�ɘ�r�ps�Н3�5�Xf8C�̖)e��U�_t���y��Z�{4ݣ ��#}JP��~�D�C��[X�w��5~?-���c1jwҮ��o�[ߵ��K}�=��]@R����C(͙�GX�v�T�XH��۷�"�~�xU2:��J�Kg`Y�ܸ��&<(����� �����1����ey�Ñ�\EޮGaNiY�2���|`��v���t�}ʄzE(��n��� �Yvt(�s��1�㪗��e\E#.���RO��+��5{���#R�|7z{/�9�q���K��tc�z����'rf*|��C�8$N�sSe)��1�Da�`D����Ӫ�*n��2�\'�m<fC>�Ŗ���P�p�h[H�P���E~�@ X�h������!�;�#z��k2�W��o�zw7��]G��O|�#5�����X4�O�-��k\� _F�b�z��_��YM�(��UUo ��Ҟj�Bz������
Behavioral task
behavioral1
Sample
4a89463ac10121ccf8a1230cf1584f69_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4a89463ac10121ccf8a1230cf1584f69_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a89463ac10121ccf8a1230cf1584f69_JaffaCakes118
-
Size
344KB
-
MD5
4a89463ac10121ccf8a1230cf1584f69
-
SHA1
c53ace4ba0458723ec4a1b28bf60c8e0a362c80c
-
SHA256
fc085813055e2859e855afbdd99be1ac88dc16473adaaa373980b7f02fcbd270
-
SHA512
ffa57e9b965484c078ac5552799c0e49e3c49b880bc49fbe7d8e74d5fda5b740ffef48e339880b9bfcd0f1c2a5374e88be02d030bff5f1f1bd2ffa1352df21cc
-
SSDEEP
6144:I1vGd+752Q2wseNNgmh1O3TE6HHlChpQ+2IKwsiqc5m6jPqgkWWJJmq5MjqrpwKW:OvU+7IZeNNgmW35nOG+uws1U7bKWW9MX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a89463ac10121ccf8a1230cf1584f69_JaffaCakes118
Files
-
4a89463ac10121ccf8a1230cf1584f69_JaffaCakes118.exe windows:4 windows x86 arch:x86
3720d9613f94a116dab032de5ef513c3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 304KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE