ʼ�����,�Ƚ���)@�S~Q4J-c����5T&m���Ӄ������&��� �q*:i?E�R���r�����l�pZ���-L�/�������f��<9��N@���v�`uޢu~�n�A����j�� ��x����*z�.Э��M��/3#%jF3~@e%gl��-��J9\ma�S`�ϥ�\X���2��"@Oz0o��O��e���DI�yR�&��}����_qeomdu�hH~٫�x�& h���3��e���Z��G;�o���Ks֚��Na����o�ა1��P�E��i/x+ $4�2:O� �d�{�O��M�jj��x�Z��J�$�&���� ź���.�}Cx�4����@����q�3� ��c-�O��)�#:��'�r�m�r���y�;�V�� ���g5hI�~�>���i\���{�P{���a�j%a�4���������7��͚��'��S5��|��]�$����G�����G��O���'�%� ����5I����qG���ܚ���J�6��2��mR�%X$�������2L���2u�S�b:',��P�ܪ�@�� 筋�����.��s����DU���oH�N�������]�^�B��x3�}mG�őӫ����6(�ȃ��HD�wڧ�n����E��gӉ�� ��Ef֖1S"��n�.���/~8�� �2��w��/�CF��J�#}�������Ü�0�o��n>����S�P�϶�� ES2�5�oys^4��ѱVg��0t����r����#j،�B��l~����M�ۣ]��ڡ�Ji�{C#| ��<d5�^�1�<����J������@�1e��]2Ő�Z: ��1k��T(����ޚ�1��@C���$�z#,'ב� �� n��@�ei��()asݪ��)vn����P!���2��3m($ͥ~Ъ>��$�X�J#�$��8�OKa���C���Q��QmOǙ?o���@Ա��%��|��zm7nz&-�)-�%l����;&>�3�l���$9M�2Jf�{',���z®ӓ��SZF��(�@��z?0����gi�C-�a�-��5=Z`#�R&�ri��8��>����n��A��G��irsv<��=�{���^DhP��j��-���&{�;d.�~��sV���ƻR��� �g�M�z�����43Fo����u�D���qUu�\�Z���� ��=��p��YPI\��맆�Ф�w��H�{�V!B9�M��B!�Q�$T�;<��A����� ��bK�/���U�{a@#��i����Tt��q��B�� ϋ��gI��"�ϰ>�Fb�:e��3D� ��h4y������o����E��,��3�$&�Ɵe]vFN%Rv{m����F� �P;.����ժHyv��b�-���D�̑�"n���B��C2�L A_a��}7���Ou�ݬ"럍� ��'��`�FL���Y�D����ڰ���k̶���;���8�g�Y��D�>��-��������w8���5Q�s0Cu��}+dx�f/��7Y��6�`X|\�]ldS\QSѳ2˙ph�^�BE�@2�I���&c9��t�eP����<t�D���.�|t���J�PL�a�����ߵuwL��ʿ���f�٪qޯ�92��ؼ�<�_��枑+͘dY��6���������������:��hh��$�H6�i�ޏ�:w�&�H� j:� ���;��~���s�F�s�*�Us��,�z���4;���af疇�I��fj̕V확9��#�a��z�2D��ݧb'�u�+R�J ^�_�L"%�a����[n�h��8�pl��*[� bR��t��8���H�"M��#=1ES(��P��Z�{Z+n���DXY���5�S�io�]� �k���O�v$�m��Es��t.�=�B�Ư��b3T�hh)(���Y�`�-3�� ;P>�bkV�������_�w2�=M�os�0��;��Y۟�ߵ�n�E�&|�{��8L � 4U�u�R��47�q���W9WNI �2��T�w��q��:�3P�+��'�ٌ��Ѱ�V��fg��?�c�6����{���QW�����+��U���)p�*��f%YR�(_����pW0�f���([k�<���̡�O��MX� ���B:#�Vi�����Cf�������(�S��x ��xc��YY�d�����2#n|�ܝ��gC�]�dR�e'$ۜa)��y?o�,S��(���ȵN�n嘘lA�����o�L�w�1�zP�\r��O�xM|U��Ѝ-���A�l����֜�+���/#)��,='�^)������ڲ�^����6���'�1�j�Kz*�����ª���_�ƞx~��"��ܿE�������i��S�m���x�����ʔz����� 4�Sb��e ���W�N9��(� ��l<�.�>u,��L�m/�1yPU�Lg!�U&�ZwMv��5��G�V����>M-ؾn���̌�����e��؆}7��>"aE�YL�A��= �ŁS!��(��������&��#@�1����;=� �C�Lf�6f=QmV*)xn�Y,�'�7�6|��.��w����T�^�y/��~lZ���ձ�Lqڱ��Ѣ@F�9��'�\Z&�2����I:��}�~�^|��О!+�T 5˙3�#/��ޘ �vQy�A K�[��2]O�d�Y#�C��~dH��V��]i��W�y6�_y�1��el�MfE/7�κQ �?;cc52$��#+���}�Ն� ����?��xx���A����Mzө��UԔVn�R�Ҿ$�� hI�ܣ�N��«Rfߪ:�F}7�jA�_�O�!ܔ,YL�v;�W~F����)R:it�I��$�Fݢ-�1H���k�c��'-�X(���k�X�THw}��W,u�� A꾍A̚ ��r?1鬧̌l�i� �I$^��g�8&���)g�t����c}}E�[Y|�y����=R�-�����.b����{qo�����m4��_��A68��� iZ.�͌�`�{&��Q����u:w�
Behavioral task
behavioral1
Sample
5f49143d5c0e2872e02454d045d171e8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5f49143d5c0e2872e02454d045d171e8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5f49143d5c0e2872e02454d045d171e8_JaffaCakes118
-
Size
236KB
-
MD5
5f49143d5c0e2872e02454d045d171e8
-
SHA1
b2b97ac4fd0a2c1a6e295ff6c493877035b377fa
-
SHA256
c002fdf7f49fd800940c5ca75c9536f9ab3407ebcbff7f1e7bf7ed31f5a0d64a
-
SHA512
401fe9a1323b555af7b3f5eec74f62772ac4e1ca7905fcd04d1e1b59990f423d8de73f28dfb40c23192702efd89c1fa00782f9fa02add745889d4ecbbc12614c
-
SSDEEP
3072:PNjZLmirIuwgOzdOYJGJ2eUda+gpv6AFyo4EsrgEzWzM78BJWSCAw8QJiO6m56z:lEirI59FJWwumtEQWo7s0vt74m56z
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f49143d5c0e2872e02454d045d171e8_JaffaCakes118
Files
-
5f49143d5c0e2872e02454d045d171e8_JaffaCakes118.exe windows:4 windows x86 arch:x86
807cb38fddb714641a6bea8c96fc2fe3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
Exports
Exports
Sections
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 220KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ