�u�08a0B����*���Bfb]���8��Β.���M�9zM�c���9���K�AK��Cd|ف���4�g/O)2��U���K��d�w7W�N�p2�P\��)�E��I���:cш�XS0q|*�W��P{�;���������sk��,"�Z��q\��N�t/0���������' Ԋ�v6T�>�隽E�d �i� ���䛿d��\s{�*Q�eF*M�6o���:x��*�â�LW�ܗ,�(l\'! }'�6Vs�/,�f�~�[�0q�����3� �-������%s�����(|w����TJ��O����(�����11�r�~1���N��Y���������B��eS������-��`��bd�u~UfB��n�d��v���h0�A����p�U�ǫ���8|2�u�2��&<�)A�����@�L4� c6���_�Awh��(q*wF ��O{Fp���$z�LQ���LL��s�im�A��}r���;�7F���x�/<`��/���L�9�����0e�b��Ĕȿ7�(s��B���ۋ쮋DY�Q���m�#����+U�'+J_�w��$pZ�k�od����h�L����wAR����h��M��G����ⶴ<����j.rE�UV����kȖ�B�WI�^´5M�n�rv�����f���[1z�a�q�Wٙ�u�n�r����# 92��J!.�{�`?q���V��hT����k=n?a"R�����./4�L�O���.gE���W~k�H-"�߃�k+��?#OQJ-�2idye5�vW2����xQw��&������83�SĆ���WiVi��m�*�� D?Z�A�!y�����]�U�Z�E; %h�w����s��ជ�k���V�H�h�����rf��vn�- c���d��x���6���]�����ӥG���<�V�3H�U�WW�Ol��Cu�2�K�����ɿ_碰��)k�p�7'IqW��:����I�$�.�.��P��N�A�ж���-����%�F��@�=G���b>}_9"*Z���HpU!n�"C��5���Z����U�ҡ�>�� �)$]�$o�����`������:���EA���E��,����?��>b ,�Glž�1��-�9L�J���4��7����}7ڟ)�g.�{� �E{�*,�8I[�ē>�ʀ�X�F���+(X���{&X3��Q����5M�xک�ȶz��r-D<a2[�W��s�;Q��&T\=�faiL�N)��m���lF2��}IR��C�5ނ\d:ģk����Aն#k�_b~�,o�����]��Z~�Ǯ�nqi*�`�^-�<#.�y1�jQԊ��0�{�_ DmMQ+��+?�ǰz7��<0 D!��B��O5�86�.#o�X�\snc!/�^��`4�y��.��OO�Y[v���'�<��h{ t氉�g�ї��5�S݃�ǿ��v�e{����7>��5zj{Rۜ�y�?~���m��+q�IFs:Aޠ�5B�����~���Kt���_Ny�-�X�_��|��w\��Rb�xa���,p� uw���x��Jw�#�ӵ�h�X9\����U�����^!R�����x*ޭ<ۭ>�tq���F�{>�p\Q�3^�J�L?.�xUTQ'`�]����E�*�e��;)�A�Y�.r���A�Z����I�x����z�mF�qH9�f?Gc1�k���Sm��q���2:s*/ȏ|����=tc�&1��I�l��I���~$�,-�D)�T���)�����d���))Þɭ~Dyr�qO�`�]H�;������:T��;<��U���o�Н�kJ/��3�n| �q0숼xg9mBO�f,������<ū�=��t�����'v-�!a���ɬ�1:@��Hr�g,;¦.s6�J�fe��}�-��Y����o@��&Ql9�z��a1�O�T+���0�jp�B���s|-��>�+l��T�\����+xߤ/yw�U�IHo��{�t� p��y�Xz<J�m,h}j��� 5��oH5�~-����Eހ�Q �������l7>Z�ۏ�p���$7�Xc���{�k��/V�P,���'���wt� ��x�^��B�kQ���S����Lπ�Ӡ�L��^��;9���n�0�� ��vNrP@�.,/��8&H��q)W���;f��T������z�4�R�v&O!��K��N��L��oYW�M��#����X��E%� ����Ф��q�;ik�t����(hֳ���ԽJ�L����H{��Y5����%����b��J�����JҐ�ߘ�h���L�i���v=Wr�pEM�$7�߳��A�d3�& ���,}~�n`.�����2BJ1�ۛ|�B7R|O�͢r�5��v�"��g\�k�� �c�����h�Ls�T�֊�?� ��8��2l�?��~K��{����s�螡G���|��{����cc�Q���`����WV�)4�W9S>�2>ÀZA��~�Ck�@s����#�v�t,۶ �j.�J��$�$'��+jJzH��b,�4���G��'~����_����Sۏ�ZIm�C�4Ѿ��Uc��F������N\r��[%i-j*�?��M��q͐�Mp��x]�og����@u���O��jl��3GQt�n�mY�����9o|2G�Z�Ld�i@�&��A{:�� �r���ŗ��p�ml;!�Z6�A��!�H_T"ұ˃���n[�+�@��-��__xL�����|���?����6x�'!�\�Sm+��f5IP(!���j��i*���p�<L�v%yH��۵O�@y��V� iTQZ����Ê�����(]��)^mƅa4HWFWuɸ��,����c:��ꦛ����Z �.���cf�k�\T�&�ʉ!�M���;Eh�new�a ��\�w��ħ��WH�R�z�*c��X*&M����s�)������tj,��$��ǭ�j�0�R!���Nu�ST .!>0��m�D'[̒h�,��p圤p�ց <��RW�coY���k�Z��G�Q�'`��� K�S��2X
Behavioral task
behavioral1
Sample
5eb4de749222b787a58ff5e6a75fb287_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5eb4de749222b787a58ff5e6a75fb287_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
5eb4de749222b787a58ff5e6a75fb287_JaffaCakes118
-
Size
716KB
-
MD5
5eb4de749222b787a58ff5e6a75fb287
-
SHA1
87cff1102fc66460d63f23aa75616bc3e0f0ab90
-
SHA256
6b5fd42cd8b27f4e22cef2b590310f04c89fed24428e5e9fd4935da26368486c
-
SHA512
989835265d94d57790497164f287a24ad0ec88304b83d377f88f6cf4f70bbad5df538c30b0777fdbfd27da569e1de48ae57be8e905ad6181527d26633f79623a
-
SSDEEP
12288:o4NSQSs1FbSjsrnt5e+T8MD2uhQ/022zT4XKgZHVyzQpxUibn:LNSQSsrSmnnfT8LuhQUUagZ1yzgh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5eb4de749222b787a58ff5e6a75fb287_JaffaCakes118
Files
-
5eb4de749222b787a58ff5e6a75fb287_JaffaCakes118.exe windows:4 windows x86 arch:x86
5c30ba8faef7eda7fe7c18e06e3d0e32
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord528
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 704KB - Virtual size: 701KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE