gE�l�F�G&�/���ٖ��V�P�G<�g��'���jՔuTS�S�괚��x����E���¡v�wj��ҩ��R@2Y%�����}���� �g����_�E�&�jk�x��(dq�|,�z�O|EA����#�U�Jmb�H������z��~k_��݉�8���awSi���v���d��e ��Z"����r�B�}YB�*0s�&�EqQ�_�����]#�%�D�g+e�<4U�&���"S���n�n�.*P�����yJ<��6��$����yc����h�i��v�f�P���:��T����簠dV�t�1:'o��{ƚ.�����w�&��퉅IaY�B]����b�Ҫ�X�×�8H��ഷ��My�s�h}|O s���4mC�z�;��=֯8�FڐL'��VaZ�<(��[�ň9�*}���C�f��Q���WAk�Ȍ��'�Gnt�4��%JV����T\ �̚13�$�K�k�q˪I�+�E�M�N8 �rBz��E�)#�����D2��Uj�C�t=�@�'�:p&�c�\n��nV�����f�%nW9��.��&/̎�4��-�@��6VI���}:���5�W�9A �_B$�����A�Qp9��r�״$�B-�Fvcn�Ɯ�_l\yW� ������Ő^�e���2��|}23d���k+��C�V���#�e�ʊԻ���ߔoq�<2��̈����LjxK�a�~��oT<����!+&}C��(��X��~�T]�����PV"}_n��2D�Z�)��£��9. x� Խ��Ĥze�"�����ҙ?���:�6 �B�r`.2"$p��yc��*�l�;(oB��٨=B(S�[�&�]��Т=�*�A�u��x�\�@�Hu�m�rM���z�bSn����V�`H$��D������0���,����'� �t�Z�D�WAN��&�e�z�8 ��i6��-Ps�B�Y�uMj�Y/w��b3��V��>}J^��*�^=vGW����0��,]�@�t�G'�)E�.!&��"���4*����%T�֎��n5����^}�NyU6F��R�����G��7ȥ_$Y�`/�� ���e�4��!o���bfU�M�G��"���U���T��g·@gE@4�z�Xꛂ�VD��Op���J�l�����Y5�Rh�1��\f�S�W��_� +>er\y^�#�p;4���n/�Wz���I_��Ty��_�x�NM_�%�ٷ�]���5������{�g�7B�e�yş ������Ee��H��\�UZ3�5�b����2g�'�'���tn[�R�:R��,"��СU��u`;�l��{Sf��7ۑ�^b�4�m��T�Є����܊��l�"�����MU.���O�\x���A]��M���RPR��0't�G��<�c� GG<1��Qd��l�!�6��b��JD|m�����E�\���<)�I���|�c��BLט���%at� Eα�g����e�Rư� T��C,�b|3���ȌA����a�Y�0S2��=���N������0���S���>�o�I��Ք�!����qٸH�U� LA�,��-�����˅P~���R��)�W$�D��o�O'"e�ݑ��������6����렯[�3=č�g�t�ӛK�܂���ݑ� 5�F���/T{2t���ANM(������rr����4ɸy��2�{(�������<`�Z�q߃�J�'��ώ����H�FMr���t�ԣ��4QIY���l�����P\��|�cS�B���q���R6 l5���t~��Ӯw��R7��yy�\?��K1���>5�c�;?� p�����!pr@�Ed9WKƞs�����OM��&_�� ��Ʀ`��=Z7-��A����T�a15�Yփ�҄Z���y�|c���y � �[&[[�N����@�����iw�v4#��c�����Ԗ�3\snGM��x�?E��I�CSgi�^�up��ٖ�<�i/�d��z�1-R�f���ž%�RU��݉*�o|��̍7�A�Ae�Q�\��E,?��_���� w�챁/�k)�өG'�L�K�O#��zZ$���o�/���4��-Ry�A����(��x��ڒw����d�jڭ$�dL�u��.�U^��(�q�Y2�u���幥A�8��;(���Y%8�S:� ?y�}�U�i���g���r�f��S�L(C���O�j*K��Z��� JLp�'�Qt�+���{�X���Z�UK�NM��_�����;d�2r jr� � +�.J}u������b��b:�3��گ-$)�m�W:6��]��F+&ۣW�hS��;Iy��D�m^���d����<v=?��s��*P}J�[~�� �w��*��k� �x,+Qr�"Zm7�صG�B2�9�J���7`�n���Q�|��: �!����۳���h],#�Y��5v������Bs�<C�G<,}�i|���gg���ڶ���,1+9����lT��r;����{;��ܻڤǛ��v���O��Q��mo�XS��"|9n���̑�#!��ģ2#��������dn�x�e����8e��������Oj@�#�}�aVtB=~��\&lS�f��leCo��U�;(��Pz> ��dF�\i�������� I?�*�%_@_�Vt�,��O*����r�]O�sc��=LM�$L�U���nv��qJ���j1ov��ɗ$�KE�����ki�V:�Z�-\�Z����� ���B-����t�7���S�c�N=�dߢ��e`kѿ�r�U ܀P ��<�����m331�3�f ��Lʂi�A�����|�����+�±/l��Εg;�A��|���ȁ���b�k��� �z�ң���E�����q�~8��Fm%Ψd��D�P*ZNz�q���5��W����{����ȽH��\#�Bo�����I�'ß"#��_`�Tf����c��1*�( h�@Ԧ�����}�~xa���ߤ]���9�K���u�Q���qdZ ��Wv
Behavioral task
behavioral1
Sample
4add5dd784545d7879719107027fb758_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
4add5dd784545d7879719107027fb758_JaffaCakes118
-
Size
5.5MB
-
MD5
4add5dd784545d7879719107027fb758
-
SHA1
405a015005943a86151c21d00a7505538cabf04d
-
SHA256
eb257f58fc6dc95c20ac1196bdd00bbdf2f1d9fc8dbb2f3e3bf618ade6cd8104
-
SHA512
fce1b4f98c75b8938f5109870fb3b6b4c997954d5a0a650ee26138ffe3280af1b546decf7d28306a6de642679a54aa1b009b04a1e3d6060623b4ada45242d5df
-
SSDEEP
98304:2b7czj4hs/9L14b9cNqTqN299TAkQTbsHPosxSqiFhpLyiR2LUCI:2Hczj4hO+cwTqiTJQnvOi+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4add5dd784545d7879719107027fb758_JaffaCakes118
Files
-
4add5dd784545d7879719107027fb758_JaffaCakes118.exe windows:5 windows x86 arch:x86
e0a494d2d43d96bff0808aadafe55cb3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrcpy
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
Size: 42KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
twtdgtsy Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fpezkmxt Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE