}q)sg��i�\��#C�ET��'V�2j��1�aq������8���-��(��CU�g��؍��S6��/<���@ߘ��TЏ���vC�����aq�bbR�CpڲAh���%�v'�]h ��ޕ<|ѻ$�1���朧���l�����Z=��� ��lۛ�?R�=y�+1�x��̻uѤ\I��|��+�HC�Sn�|O�/�,0�Y�l ������a� h�y�����c�����v$���#2� e�d>}J���A �}���y��ج�R���%�c�!9�v��dil���G��F��Y=�.���V�o�Q!_��Y��ٮ>OwF �H�&�k���V5u6|�uh�H�IR��/���O<ʹ3����/4&�Ï��D�����T�-��:qN��5s�q����#rZF����ʻ)�:��;>��:�{�Ҽ^/���+��Y1��A1 ��OQq�CP���N�}� AB���Tc�В�9M�F��_��ʩz��t�����n����'��������4�`]�,�n�� 0��-���@`��)��і�p��2��H�}*n���|�7�B�vp�<I�^n���vU�@>"�ݸS���Z`���s�M|�ibw�d�w�G+"���h\�HG��;�G�����`u)���/�3�Mh��V�dZX������4AZ��k���+\M��d<%Fq=���_H�O���v��=C���#�gcD-�~� 苡~U��x�:�<Y@�b86(�$��B�<=[=�H-�g�����r*�q:�X5�/HQ��[f�r�ڭ�=�B*�"2A�&��D+����'}4n���;[�/���W����:>$�ɨ�%E���,�B )X� �D���a��ߘ�t�hc�.�h%�{> ��IJ.�i��mX?E�m1�����Z�����|���&���H��d<��у�t�G��fP$ �D ������)��B�t�z~,�|f��: �N�Y��U!%�ͅ��y�;��MI���ޚ�Z�³͛O" kʜr�9�)˲�:BC�;6�Q�o26���1:4�?��tx�9mKa�nZ�T�Hz w��}XXc)�ǂn�>[8"��(�����97�](V�n�r���2{!���!#dWg|�{;�h��<�PT��*FZ�qM�ȕ%䱴��͊o�����i[T� 2�n_�.�F��������v���&���¹�=�����DWӭ�{[vM� 3��Q�H=���4��F2�$��2Q%��V��f���Jw"dx��~�۩�{bDP^9L?�z��B��Zw���T��d�7�p��OU�"��&�t�K��z��)��y�jM�;`�|����)Ux�5��pU����eH̗�`��v��Ֆ�N�*X�)y�G�j5,�GY�Me⤆� M�2f�z����ݦ@=�����]����p��l{y�_�O�l�6�V���i-`�jƯH�֖S���Ӭ$Q(��^ {���-,iHIDge��j�����ghU�01�b.|��J7����Zy�]�Q�<;{c�c�t+�� \J�H���u͙a�7w���/���̿��g�� �� F%2�c�:R��R|�]D�{���S)��E�������{��*\`�E����´0�<e'���ϱg�#HJ�Q�6�Rz9쿳W��<�=X���t�˪��]5x5M.��J ��٘"�2�07l�Sj������A4��~�GL��/T���,��(��������)�&�!�I�nJT6u��m�Ise����n����|+���}nGj�g�v���c�)����V�)�C�����Y3BDz�P\x�!�$8D(�g� ]��R!J�M7r[���@w73����� N;�me2���H��_lo��i~��piv�3.$��`�2�~+2���Y�":R�7�vh؛�В>��'�;U�^i�����5�&!N����������!�I�]~�I����.��>��}�i pmg��O�p�P�u��9�����; sl���ԝ�GQI�c��q������QXf��;y!�i���k�.��E����@�����G��r}��dG������u ۥ�ySgH���NV �[&<*e^����Pں�V�I+��eN�]��T�Vq�����^�p��tr:�7G`e-�E�w�}� ���U\�q�������~�#Mr�i�q�d���U{����Y�;}���ҝ[m�6�jn�yԯy/�nG��k����,�`�`�ڤiԐ�)T�{ 3 ��߲{NÜ�D)!��&!��6�>{!3���C�pv�!�7r�6���+"H}l��3����+8^CV;� O,�+����d0�e����6���Fy���K�?�C� Z<-��X�F���``��4?Nl����V:�ߞ�����|�Y���( ��N Hl#��㳽�(��R�7�C����_ݹ{�}5S6�4���=`���K��&�-��g��{����儶�����Kvc\�0����47*�t�Z��!&��ߎ�0c�a����g2��;b.En���2[�jmᅄ�̀���?��k%תi�z8 ],9m��s�HA��P?kC��o�:{D�����Ϟr�B0No+L�N�x=Hh�[;ˮ��������pX���Oi'zC��[>#<-��k@�sB�B8��1*�c������<\��긣����-*�b ȵ�@أpe(I�G��J��d��{Sa��x���Ξ�4�+���;<dG�F �n�)A���;k~?L���ȁ.�r���щ��h��uOg�'6fY��[���5�$? ���6�q��X� ���*�(�ҕU�zzʌ��Ƶ���,�y�=�_���ӷ�X{4�,��F+��!�Y.�n[lg��g��6�)�2�I�i�䡦*�;O�(��0C���v�y�J���M��˞7�4��ߞn�~���90n�����,�L ߷��D�������M`l5��\#����!0�{��mz_��? ��9��j�+H��>��U���5�۸'$ʗ��F��^�� �2�{�(T��>}��7�I��05Q����H���u�v=���[�H�yLJa�~�����pJ��
Behavioral task
behavioral1
Sample
5ab4d9347b91c34445154c399019f828_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5ab4d9347b91c34445154c399019f828_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5ab4d9347b91c34445154c399019f828_JaffaCakes118
-
Size
1.1MB
-
MD5
5ab4d9347b91c34445154c399019f828
-
SHA1
0e4b0e6ac632eb578ea133dd28b714aed79fb02a
-
SHA256
a61e36c7b1ae06c15c2e55381bc8a58fd540252ab7b42a8bacd7250467b0e997
-
SHA512
920dafef6c88aeca416c9f3a069b452c806b4b1aa0133436ea4a41d1b4c06139150abf764861803e8638f733810d504c06060cc1d4ccdd3f908aae2808d30815
-
SSDEEP
24576:AXd/BSsIwEuTgo2EstTiLvnPQIaY+CzIH0CskKRwj:AXd/BsVazwQnoI7zIHyk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ab4d9347b91c34445154c399019f828_JaffaCakes118
Files
-
5ab4d9347b91c34445154c399019f828_JaffaCakes118.exe windows:4 windows x86 arch:x86
1c232307099088c309620dd45e55844b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wvsprintfA
gdi32
Escape
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
ExtractIconExA
comctl32
ImageList_GetIconSize
oledlg
ord8
ole32
CLSIDFromProgID
olepro32
ord253
oleaut32
SysAllocString
ws2_32
bind
Exports
Exports
Sections
.text Size: - Virtual size: 449KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 595KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 936KB - Virtual size: 935KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE