$/g�%p�rF�x�9���{8*�Mpi.g�(���f/��Y$P�ߌ�J����PIE��o�|�ٜ�rx��ޡ���pے`0�M��6�v,�\�va���"�r�}�L��n#��5�?/���^���� �t���^���B����r!p�N���i&�A��^��;|���G�*�H�,@�Kԭ�x��f�$���wK8�D�u]��\�z~�!��U+�.� yx�����x��d]��d�k�����-��h���gL�������xx̏�~47�;7R���=-G~�>�c�e��T}� ��ޙ9�Τ�����f�"Fv������( o���Q�ca!i ���6 ����0�T}d��y$�{E�����U�~h�*,)���%z^ۜR�犾|��hf��Dw��n<�L��:(�<����s���;������X�j�����Aր]�}��ȑ�5z� l<�@��}��Wd� ~����#5o��� "�O_MI�SX�s'��S��X'���b�w�MW���%�yC��<�!=�f�юf�L����*Q�\���� *�>Z;�'�#4+i?4�v �cOĈ�7��Z;��eWz�_v��B�e����ph;����,� �I���2#�La�����������Z���U�f�-q������i3�P!�(�=�r)���O ���ՅƠ�^��k��Wa�vobF�����d�Tص�U5`��j!�͞4\��Ҙ��0����6/�R�h�w ��HJ���0����7���o�1�,�~ �[�<��6�{'U������~pP��=��[����{h�ܴ(��_�g�q�$ʑ��U�a�|5H�(��Ԩ�.�p��^'q1k-A�'�y9�v�0�\����� ��Gc#*h^&Q�xy�����G���u<��3՞�M,�GT7y�7ՁwK!���ⅳͶl���%h��L,�o�)z�!Yww*�m���F @V�Kr��Û��������8�_����5�"U�͋ޔ�2�ƻU^�:��KJ.�`�Ec�0��"�J����b�7�:e?�p���l���HQK|�y:Xw�����Z6�LMak ����fY�\�@{L����{٤����yZ,:D� U��`��z�~y�~m����#�q�v��xԬ���@�주�&s����6��,ji��r<�E�����!����q�Q���K(�?��K��\"69yn��� Zj�V������$ ��SPUg��Qy�ƳJ��u&��e���c��������7��><y��� M�_�#M��h�:��%��h���aUu�N���~��sh�����t� zaM^�C��̂ը���s����k���4�C0�d��̇�K��֧�z���"��/����J��,:,�����!axJө���y�e��c��b��P����R*pk}���1��Ne.��!n�R��HM���D�(�U���_`d�zcv��d�N�wSu ��G��;�L�Q�m?|{W�����A��-01��*�:�l�B�?��Ƕ/�b�`�PnB��Q���ʙ/}�C&(e��z�b�D!S�W�\a�����ǟ��e���z2k��`NW��2���b0�,c��-�DQ��*�z���n�<��ܮ2���OP@���'��xd\�L��T__������+_�6��{��5�M��9��3v(BZ�5ɃU�����'F�^��/&�����b�1�%��1���lX%�ДI&+��;�<SX!��2άi/)i��8k�`UA0���'�����:��<�[|�j vI��3������,��Nl{_e�J���Bd��{�+�ߑ �������}�p�=�C�7I~���K����4�m���M9z�eXǠZyW͖Ѡ�F��.#��?�F��R�;ł�U\_i�����ʲ�o���Ҳ�Q��S8A��Q�LKi0�tZ4�|S�6�UQ�������-,��@�!��N�Re��*� ��j#�E$��kB���'�BP�:*G��W�:�F`A*�ͫ�d�N����fP�-�MU�-��� �5���$��u��{�c7�M���%C'�N�h8Ӊ �i��̕dUWvz����*�7���j���B��ʑ[t�/�̬�q��4��ώ} �����\u����7���I,Zr�;��z������pOS���U��^LI�i,;�Y�ǂ���e�HkewL�&�Hk���$wR| �����I�[Ε�������O�������a�`�J'�7��F.����N�sP�h��n20��n6�&.������&�Xsb�YW�0��Pi|�-��/ḽ�����D!��źxNȱ}0��w�77Ou}�c���e�Z��G������m�� �tj����Οc`��w��a��|�:�`�]"� �q�V:L���b0c�L��������g~*���e�H�U�Gb)�ϝ�y�V�}w"QY��Ǻ�����K��c�ɿL4'�0"-�R_+��ŪGz*O��r�U(�(�I��{D�Y�X�{#-�&Cb�V���|�O�䰥"�R_3< n�������W����JUІ�"�=�Ew�8G�{��sr�p]�5w���U�G�NW0�F�H~��,<EF��:�n��`�0H~B�两�y���h�h�|X<�|<IR5,�C���M�ac`�lHb��1�j�ee���U�b1���q�+z� �u&o�Çǹ6j�)���O�}��I�!�V��Т*�4c��L�\��4�"��jKq=zf�1���CH����w�ݟ�W~#O�P Ŀ����O�O��R�Y"R�N����{�V�e�B�0F�{�w��ѧ"x���藺�I��Ӭ��c��'X��YԮS�1I�0���l���v�@J�Y�U���/��|(�,P�ꛪV���[I&���1N���q� �닉�nR�e���d6��(9�a��d��g/�!����(M-�td��e���lP`,�E���+�Ή�e�kB�Ԥ��zɠ?<�.�M&��'��3E�N�R3
Behavioral task
behavioral1
Sample
5a14eb18a8286eb459ad62814583ab30_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a14eb18a8286eb459ad62814583ab30_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a14eb18a8286eb459ad62814583ab30_JaffaCakes118
-
Size
104KB
-
MD5
5a14eb18a8286eb459ad62814583ab30
-
SHA1
5e43ca6ce0311ebf92fb02282edd252d2b353774
-
SHA256
92c27c98293d0b9b5bd1af31dc0a7fe3886c959b865f33a3ea4d5fa0d8d38052
-
SHA512
fdf51583fa740df8edb0ec24f31414568c0244b22a951352291443b73993b2816548c26be26e7f2c6cafb8588ba63573d18e9c0830fdb9059eb75c27d49254e4
-
SSDEEP
3072:+88Mzm/IO+11319wOB5ATavGdBpRfqKha:OMzm/41PvkespR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a14eb18a8286eb459ad62814583ab30_JaffaCakes118
Files
-
5a14eb18a8286eb459ad62814583ab30_JaffaCakes118.exe windows:4 windows x86 arch:x86
ce8f0b32ef8db8269521cdba11a0ff2d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OutputDebugStringA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
mfc42
ord823
msvcrt
_setmbcp
comctl32
InitCommonControlsEx
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 88KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ