���_��Ж��� D9��<y����2!��c(�I�������h].��,õ��Y�I�_�9�a{XI����2�21ے�0��ry�g٪Dbq�����ɵoA�(� �d��]v�[���L�٥��<f�L�����}�^ [މf�<=���x����A��M5��"���x�_'Ǫ��58n7��$��y��e�xe@��rWaw���?�AA�|?�fGN�5�㨩�G6��\0,���5A��}��[�jN����I�fx_�P)$��'+��6*�!�w� �`������K�˦�؇1�q����I*�Og����Bs\Hw�x�����٥���f��ԣ���"�9Sk:�F}`�헄r�v�kKI�Ѵ���ķ�_���=�1���MOC�:�[��R�S��b���ZO�0��;��l��k,qү'^�G�p���NO&҅��5!���J�����!��� (���f�H���9� ����R�������+n˓N�6]��Y��qs0Zo��ٍ�>�n_�� �5����]�";�� yp�Tl��O��z%����Xi���k���@�Ɔ�l���4�X"��{�?�Kce����!K��"T�Q����g�05.��0}:4�[�N �pI�HW�[�rt�WW�4^O`Yڔ� �IP�<��}}0D��r����>R��q���� ��#����x]J��lE-�!�����P�� �e��}QS����]���TKii~iP�Y�i�f����ǹ6���s�F��%EaK%N0��u��(V��[��U��F\�[�/��}YkY���L��b�2>�v���Κ��7|������XɅ 0x�!8�o�� <�+�l��F������g%^�dz�0v�X�6f�/V��X�������ϧm�f����)j��&#S��">�� �`���`�����]>�{���`����`ؚ��B~�D��0dE����a7�WxB(��a�� _ws%�8YȤe1ǵ��Gʮ���T���<�W"�X1��Z�g���c1�[;4 t=����c��/t&��Q\C>�?�c~ZJz{� ۃs�fiʨ��&̛h�S&�o{!e���AFgX���}&� �M�G:i ��w�a��b��e��x�I$�j%��� �l O�]��R�<��U_����.����k�6���֕3���B����\p5i�u��Y0(��?��Q�l}�n S���+�Ag�����M�K &נ������X@���������lZ���_��D�NS�$H�HyI�_r�֦��I��6w��������=_�*�)�`���ll���?-��N��3�1Ms{J�`1�#�!���!����풏���rΆ0`<G�E�Q��'�y/�1v�G�`�~@���#����1+!����겼)�Ic>y�7�§��I�B��>�� ���k�"�F��3�B�2.�Օ�Q������f��`�t���B�S���$:���R~ޤ�� 2^2���K�L%v�s�Y�p���H�֚�K/K�/ԋ|�U,����6�v7.)�aK��Q�oKnd2ߛ]����YZJv_]"�|�O7L���(����0��4M@rD��?���} ���¦/Q/�����Ӥ�֜�Mx����zRE!k���=�O��� ���;�շ��R5Z��� MFc���������.(�P�&����io�D��\k]Yi���|�1��r�@DsX���m1�V�4Z�=����9ץ�[�<�5�G#��m\.C�3D��?�����vm�����V&D�ǣ�=��k,K��v08�/]��-�� =�%�hy�mE����=���2:����(+Nx�Mt���� �����#o{���_�\��A�Jj�%�J���?�)�U(�-��2�Ԑ$n���H[t������`�3�>�(�ᵣ�7����Tm@vxO �AF�Z ��t!I�bM�&��� Zt�)�Jp"��O�8��Ǥ��c_쳗�IY�[����mg�q��E�%��U�����a�����;�ʽ��M��t'K|.E�hn��p�l]j/)�cI�7��A�?�UJ�����I��c����<R��v���?5�b�'�Gb��,����c<��&�)*l�[w�t�v�;�1��]^���e��:���S�"�1�43����5���$-1�}Y�������QEK�4�uF��|YnB �{�$�ֹ�2�$�p�6�Օ��Ic+�������|(���tm�٢T%�WJA,��9��`Mz?�{���ߥ�r�fI�$.1t��x��O�U�-g���k���ۀ�:��0�.&�����g�b�Cjw XH%T���쥣5�|�"�̗i!`���a�!��;zN�Y��z�۴�I��1ũ�?m%���C���q� ��!]�K:�"��x��j���0>D�,,��ܷ�`O��s�����{t�1�MG,[n��z���+2�u���O�~ ���@u����U�-�������Dz��� ���)���H�wZȉ���2�d����>Ѱ_�7��FS��_`�G0��Yz��k������%o~)/6L�������o��b��Y2=���CR���|Pv̰1�!4E�h�la���p�pXR��� V:V�Ґft�pFh��M���[*hs"DSr�v<�f�&~�|(h������l)��}̽�\�Cϐ,�[��pOEA�s�:y��X rIl�^ l��j�'�mԗ�S<��X$�Z��r�x�B�0{b�}}t��Pq�4�ã �*�@�qLPk+i����$���bηi����Fh���He'�0?�7D�E�Cͥ�{ ��0 �����Y����SW�4����c�Yu�D2-�b���:y��H�n�g�;GPk�N^�{��b�L���7 d�|�2��MX|��^?z^O�3C��^��s��}l�p_�� ���<i rb�v�_��5��G�ލH�b8�>o�wN�oRs<̢-&$�(�d�C�R�[z�k�}&JHO��Z����e6�t���ػ;NACfa�G�m"�w�[�� �X�X�)X4�
Behavioral task
behavioral1
Sample
5eaed1070be8424110e80b057c5e8be1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5eaed1070be8424110e80b057c5e8be1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5eaed1070be8424110e80b057c5e8be1_JaffaCakes118
-
Size
439KB
-
MD5
5eaed1070be8424110e80b057c5e8be1
-
SHA1
cf72c9f1127c5caf7c9fe346d30f24ccd459464a
-
SHA256
d8c51be5df307e7e24a8aeca7c654feecfdec83724c7f3a31d1dd254f06da6e1
-
SHA512
a2e6c9e80c4b11751c78a03d63d82b4428bf44d8cf797164316a92fa08dc9059239fca9a71e62db7ed7f1a8568aa21a550ce316522b40e9a404085d525081dbe
-
SSDEEP
12288:gdkjugXm2puUzGVYAAiIpfszLsNa6h+N:AkjugXm2wUzGVYfPpfSLma6h+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5eaed1070be8424110e80b057c5e8be1_JaffaCakes118
Files
-
5eaed1070be8424110e80b057c5e8be1_JaffaCakes118.exe windows:4 windows x86 arch:x86
df5e8f74117235ea96ad96e7c26017a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.double0 Size: - Virtual size: 376KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.double1 Size: 368KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.double2 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ