j2���m�~���H��k�K��pN}��B-Z�GM��8�fݕ��:Fs��'�ot9l�P;k?en�����Mpa���w�8*�U��ء�I�(�o8��1r�(�S>dځ۾5}�ƙQ�N)ӑL�з��! �B���6��"Ar�o�M��j!�A ��JQ��B<�ɰ���_��fT�筫��g_Pw�'�D�]� I�i�w2��Vi �:�U��R �ťQ�y�����2��R��`��Gd!�2��d���J�δt�m�����p�O�6hT́UcT�b5����=�x���j٬-�n7*�%����:a?&�������DA��,��Wuܖ��fY_I2q�U�"���_�t:����*~���0Z��<?D�]�������_qe���9��q�/��R�!���S0ZJa�˪"=w��}�+;J^��?���0���>�C�y�����\�?/7gC۲ռ������)?��y/:�z�SCksP�`���u�}��.d�٠ÑD���<Z�Q����~,��:Hѧ.�����a�@r�K��4h1��{ ��PBja�2x��lF���l��o�!�)��)ߞ�o�6Y� E�1v�zʧ����㢩R=3V�}e`���l%5��� �}�<Vۏ���V�J;������.��k@@hK�!Ro�:��/O�Ң�Q߮�M������Q�}/U@;٨�*2��d��iմ�r�>)>�<9xB.��+�(���A�s���@���k$K�0G�jl>��}�M��U�9��M��W&�f���/�`�HJ�"��c����09�8��93���.2Zn�����0��Ovz�b������h���q�a+E�+��#(ϔ�LK�����k��G�I7��b��ԩ5)D�����K��.�����K���c~�aH5�1N_��Y6 �)��vs��U��;��]��oS��.Ő�G���K �4ص쀔<C�s1��9�unFVZ��<vh�Z��!C���{ � >:VJw���m��Cv�Eя���%(R[����[��̊��Z?DIM������qn�%8�eBZ�,W�%�f�C�1��c���� "�|Т�h��N�g��qo��z"Pvݻp��[D� n��OU�gM���l;m��.���1��v���A�"�Ȓ�Qz�{.Qi�A-���7��R�ʣ|��s�A��z4�>ܰ�\�ZQ�������Q�'�a��F���z���Hx �rŀV�w������7Rw8 ?t�iA`�+��'�c����ߟ���� ��=c=��{�iꭋ��.����2�Q���/��n"*ܕ�p�Z�)!���Y^�?�61n�Y�O��qؓZ��z���m�|�6�����~���q��5��^Ϗ9Q?��ZU�d�N^��}ϑ��+1������`���f�nл�.�%�e�]�j!�6��>ܜ9F�t�=҅��]�`ɻ�����a k������]�%�~u��O�ұ�+���ɩ�gY�?���#j텡�2�0���rF���{\/�등bM��}�o�b�U�R�``�w�b��m)�h>b�x\F��J(��bo��JF�,$I�����ܱ��ۼ}�X��a��2�ه�5O%�x�Z6�F��ȏX`���y�5�g���,^�wD�gRZo���F*�;��WU齱�9&����!G���-�ӺIj+�8COҭ�s*��Mt�&���+X��V�U%�+?��9�y6��'ˋ܁sj�HSP��v��]�g���h +���؇���S`��?��/~z8�e���Wѯʲ$�*#�EA;��캕+y�l������#��Xz��.��D�ڟ�o�c�����ȭMQr����3����z�֪7b<j��J�u���4��S��w��\3$��[,���B�33)��.`�0�0�9�1U,_�m�0L��ηl>Oɗ��R T�M�Qr,�ץ������z����*ձ����9Z,�n�qB��a��Koa&��i%��������5�\�!(�|B�ʁfY�æ�s������K3n�ې������� ��|�� ��9�}"7�=Af���8C��\K'I���jF�j�\��C���k��M�� ���<#6�������h��(��-iC�^�E�L��v��3���Ƭ��$J�@hK͙f˹�W�!�[l7ۄ��h�5as��z}ǢHi�����a������+� �2��*v cЏ3��/Oj�����_���'A��Ωbg���M��e�����o���e��C���ie�TT� ��w�4�~�2ϭ�vz����־���7�l���_$E�����u�iA|^�ގE��.�)� �Z����ǻ���F8�g�;�軡\�x���+ �]���$IG!�)rx���h�]� &�U�ޢ~}�,������&�1�")�}��Y�,�*�JX�)���� ��?��� ��HY�o�eWX�χs�[j�"3�'�ҍ���h(��ZF9J���k4��q��/��O��m0�{�W��n����37�' ?�wkD��-O�#}<h���U�e����fw�tF!��<�{���Իn_�no�0ׂ֯�FR�0aMl�Ѽ��r�ǭ �~�h�����9�:���Q>I�2� �h�.�q�����j~F=)c�b���c�ݔS�ՠwiѐ�p�h� ��2��d<䔘+�?���T�zGp}�4UR��T����g����T����!Sk�.�*h`W`Wn����S�%���h����d�C�4LA��Z��("3M���`1�8������&�)b�Ar�{l9��P�A�J���czh�Y�Iu��������<��栝K*3H@(yՖ3�b��Vm�qw����5�ٵ���t�gX�܂|��f=����v���0��ŷ��8���ߞ05o趛~G̀YӤ��y�����E��&I���� "��e��K�d�f8�VW;�����L2�Ԅ��JK+7�O�Ϊ�7�� ��O�w�d��TnN)q�Jo�6�:�3�}�1�@�ٜ�p���Y]������A�#���(���f6������3��e��I٤U�%դi����b�+
Behavioral task
behavioral1
Sample
4d55557b4436b9da3851d48ce364d012_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4d55557b4436b9da3851d48ce364d012_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4d55557b4436b9da3851d48ce364d012_JaffaCakes118
-
Size
159KB
-
MD5
4d55557b4436b9da3851d48ce364d012
-
SHA1
b13f569068b9a1ee93d90925d2c20d5b92ffa070
-
SHA256
2ea92c8ddb6e9e1603fad37ceaaa3e5ca9ac1eb15df9d497032db5cb36c4076b
-
SHA512
7c8b22be13bc92b88ebf423ae1c06f4c8ed00e539e60c7346c4e5b3c68069b430cc9e31fc346048ea953700910b6f977cc3583c6118eaccd63a98d3ea1786f76
-
SSDEEP
3072:oFyqZqJ2qrpUi28sy/b8Uu6k7BJR+XdP2LXBJLFqKdU3e1h9:oVZIrpUi28T86k7BJR8dOltzdUY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d55557b4436b9da3851d48ce364d012_JaffaCakes118
Files
-
4d55557b4436b9da3851d48ce364d012_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 507KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 384KB - Virtual size: 382KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ