��L1N������E���d���r��:]h�Z��{�ӯ��w ��(ż_�+.�-P�}�H,Yt�%�*���OS�{&a��_���*�,'��߁})���W�ڗ:�n�ٚ���\v�*��Wc\(w2����k.���r���f���W��S��� Vֽ�r�Ę�Ɛ�I([��5����=,ZL��S�����0�Y�2�tD�XOX�Vkt鏸 � �?����@ƪ@��u���=��d ʃ-`F�}/|�����h�]�\�q���#x8�j3O�e�36o��G�Z�J����;���a!e�ڵ��H��t�"���á~6��6n�O�G/D�),J�� TVQ?"މӈ��<���;l=5��3�̧��!�ګ�CW1�U��wa}�4_�����_P \�{mL�Dl�����bnL;'Г�h5�:I�B0'_�;S�&�S0wk�zz��?3�6��C���2����Z!>�)2�7!�iz��䩋M�75�x^>�/9GԲ=2,3vOW+� ���Jhk�%?��J�)���߉����=�=t0��$�>a���е�F��C�fżM�{���- ���&�ez�� tN�������C�S�Lk����B[���:�ȅs�B�\��W�tZK;3:p��x��㱝��R�d֫���"���2��Pέ[\���M�J56m�9A���m��C�ûe8s �K������b������.�1�-��g׀N���E�㟟S]��P~j�����\�_�qT*� ��-,��Dyi�s���=�_�Ⴣ��Q���';�q<��M��p:_��@�C�p^�)�x���c �?�Xy�D� &����(��- ��+��̂1͠a����W2;�l=�����H*$/�x��)AY������9�WsZ����*dwMM�O�,o� u=�T>D��72}r�쳴���}* y�w(��N ��3�E�+B�=����z�Uj1���aNǏ����l��H,(��j�_;%�j�qM�Z�1����k��݉��0y<9r�۷|H\�<�pE՞t[�Z��ýi���^�)�� V�~=p��O��*u.���KT�����)�".aa橕��S$� uV����aP�b�*1:�K����a�ej���<�7�gt@xTs��'M�1E�}�o?X3CtUy�K&��м{�BB����x��͡:١�0ݣ�kğ��BA�b8K˞ǝPC�#�����"4X��̰�s���b. �W���s�������L��Z:2���@P��/���ű�H�Um�ZO� /m)��־��ç���~�7��K���)�H�T&��}p�'�>�Vd��D�L��|�p��TCˋfY�e!(�R��])R'*�;��!�$��S�0�.�ì�e;)�kJ�+�>�G� �~$-iQԸx� 9L��Y�Y"�]����&�}���\MP�>h^2F��G0���p�-�� '�K����������b�9U�ҡb+��)�y ̤�bĥ %�KW��,��q�����1��mdP�� ov����^LԆ7q q!l�z@C�'+�_��E��L=�?l��a���]�^�g��V9����ʷ.8�S��M�]��vV���_MIJT�ډ�r;�G��M�ݳ&��s�6#])���%!(����Y4uK���N%�t�= ����d�K�B��⿅�NCIď���B� X���U`�/���2tñ@�.����B�0��t�Iv�l�Yxz�U�AZ��u�H�����L�8U���ˬ�{��];�}3� 不���ݞ��a�&�p��E��Z��l���!i���H s�Z& _"�JQm��ŞV�]�ωH�;��J�CYA����������\=m��::F�c��ɡpel;Q�DPp�i���v��%W�b�b�_�o4}Ԝׅ��>&�\>�/��$�V=��e�T��*�>�����"e��ǯ8���W�߬�0�X8/���-fS�o�E��ݬ�<;�:�G�Y�;�k��O�F� ���� ����������.:U�v���5Y�����w>Y3(/��l�.���8�b<I�9Y8���r`�4���,*�@�@���=O�ֻ���%���������f�[��;������)����N(4���v1���B�9����y�_�ɷ���S��f���"����\t��pvzP�W�8��yl�8���El�@�?ZqgAK�����(,<M!v�1H㆑�� ��kg���,�m.y*��\Ϊ����r���fd�d"��᮪��č�@l���.9���i:����E�O U�f��z�T���w� I3?2�0tT��ƀ��~|���@��%S����-�����pk8�Z�Jk��i�x\؊?�o�$¯][�A��E�L���r��;U�Y��b�`t$נ�U�s�h�8����h���j���l�d�y�Ǣۮ�~�yޢ#~����/ �C殡0^5K���vZPP��7xq�����@��y��_����H`z���׳�=Gun: ���Lr_��i�Ӥ�$-��ƌ�|Kg������Rr[�6��J�(?��������x7鬎)(m�A�bK�P�~�0rD�hP Ԧ�TpPu�PC!6�J�hy$Cwj<�!=���ebO�_�|����tg�5g���ǁ������������y+j8���.ՙ�|�.:Qժ��&�xR S��lLD�+6��~y�P��'v\�U�Ñ�ivaZ���l�F�z�k���� ]z�!b�͂�kˌ~�-��n�}$���b?Vv����|=G�EFv�Sڠ��\��Ё�u�Ѷ2�c t�vm1�ݞX�g��t�^����Y�D��MH���X��NR��tH5�M��������M����ȵ���e�����A{T�㍄l4�X�+" ��CBN�m:�3��#X�ܻ"�=_��J�UBڢ���v=����j!|q��؇�Late�J��Lʢ&�!����m�l�v��'���X��K��ٶ�}X5 v]��9:B �l�W�r�������߄|6�|?�� �^�
Behavioral task
behavioral1
Sample
5ce34d4689ae7f810a69a3610bc1be1b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5ce34d4689ae7f810a69a3610bc1be1b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5ce34d4689ae7f810a69a3610bc1be1b_JaffaCakes118
-
Size
136KB
-
MD5
5ce34d4689ae7f810a69a3610bc1be1b
-
SHA1
a5103d4015e0dc92ec18b018bf584d14f040595a
-
SHA256
4a62b49b91a2cbdf5878e8b2a55ee76b4a07efb8c7d53a107ed30051ec2b047c
-
SHA512
0b3939fae90ea91ff8a34b2c6f2b6413ffd1a8be1d6d809209ae6e19b405623e3bd6e3536227fb3f50769833c208ff887a57d3f49227353ce36ae3cefa0c1253
-
SSDEEP
3072:pqOd97qdJ3w1h9W81HyqYF39zf2ZNMOGCMwGWv:pFSrAIyE3972ZNMOEwGW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ce34d4689ae7f810a69a3610bc1be1b_JaffaCakes118
Files
-
5ce34d4689ae7f810a69a3610bc1be1b_JaffaCakes118.exe windows:4 windows x86 arch:x86
93a91a5649ca0926168f78e5b102b0fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
AppendMenuA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
_XcptFilter
comctl32
InitCommonControlsEx
msvcp60
?unsetf@ios_base@std@@QAEXH@Z
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 116KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ