oM��7ׇ`,��7dR����*�}Nf��վ[Sw��'6� ��� GA���֣d+2���`�&�����&��1C�O�w�֩<�� F�k,9�������S;E|X���pMUv������?�I�^���ʣ]�������W\��� �S��g�f�B�c����C�� .f�FI6� �hd-F��7�5K��<n��� v{��_�V-�y%��x����t �~ЊM'�u�<�'����8 }qjj�c�&�b��i�.�)��`g�"6�e�H*�%@tZه!�w1��*��:����]��M/w�m��� +"h�TkUv��CY��p-��/�SL7�5��*�(J\�hW%:���- <�B#A�������ݍ��:�� ���˻��pe��v�� �{��PA��{���T:.N(��1+|���"2��ы�ޓ`�����E<p�/�����v^'.1�e�qeZ�~'*Ja��v��GB!����f�,h"u&{�2�� XQ�B��c���2X�B^�]����i$�)C`ϳO��_2E8\Jߜz��E/��v?�v���ae�xQoD�n����O�:�~z��TUZ�GuEU��+����ad �%Onj���s�Y���,�.K�,R�C9N"�pE��$�W?6��ߚ=.a5�Cn�����Ui�l�d;vKg�#��k� ��1��,�����_p� ۧI���lӔ�a�����x���3��1��� �l��ZjXc�\���oZ��t���PZ�E��}[�`E]����A}���Q0t[�4��E nC�y�Z�/�⎎9F�&�W�7��WuɲBV�Wd۩Wj\N�!���&g������E1��^���R�����N��Vx�T�KB�&����IN��q���zW�p�>;�\&S- lN��I9�UR��߉^� U��`�W�b�|���蘈-�_��i�4���} ���K� iA��/,?@0��XN)ԕo�x� �'�p�U{�q�6�<�m�6���Z\����${!���P�$�����%H�N}̖�E�ޙ��4,ۛwG���U���PtҬB/��D1��)��VK�(�bC\�s�p^Ki^�U�S4�=�%���U�����}FM���ԩ ����B�<�wn�cz���ቢ�ėj�����T�^:fj|פ�2,��.P���bgJF��V�3� ��-{#��f7;�b���<$��YK���w�F�d�(�S��f(w��ܛ�A���o'H���7}7OJ������a�`i?4a�ʅ�����B�)v�$����4���E���]��7�!-��P\�^�Q�S"�36M ��A���Í^R�}Kh�"Sk�Q�/���8ԁ����^G��*@�U3^���Pr��c��@'����e%]W;���=�Gb }߬j��D����/�iv�1ђ5�_R��p���ա��~��Ǭ������K� �K�ˏ�CZ6*O������Q?+�D���,�B�������G,�ph�"���_Y���s��{�#�pt�� �Ȧ]Q���_.Al��z(�KuR����i�5n�]#�+��\�wW���.��vH�x|� /�Vh��M)��s>��㌻}� �[%�:���"�����#��L���H����i�� F��ʸ�r u�|�~�-}#Y0m����`�G��4�T��&��#$F����n�� ������I�6�yޡ��I"���� N踭�*��L�<.�L�9��s�~�.�S!V� T���!(O^�m�yr���U+S��h��/ /$!��'͝Քi��?��S�i^FS��s�ó0���]C,���`I�nA�,|��,���g��ARQ �g�k=����m��~�Xg�u3�)A �a�$���X�aء2a��ο둳6�Y�w��/Qf,�����+G;���Z��rj�d��K���ᚓ|�p)La{/������3N��ϋ)vzk��� ��B(���4��d��8���Tl�9���~l���+(l4;���U�mw��R� ���x��~1�L�o�7��b'���zd�TD�J��$I��w��=7Ė�g-�ˍ�����(^Z����BFq�tH�*Ҟ�}g��W�o��|��[<��v�}��Ǹ�~v���PM�3}�eQ&��Y�w��Y/��B�lk����� y�^O�D��$9���e��o�"#/��1p)��{N.?j��.��H����b�]�b��$yƷ�z�>ƺ(W�{Ƌ�=��{f�:ekM��n��1^M}��Mx4��o@|D���3�UZ|� ��R��X�\7�y����Ηb��_ d�����WL1�]��˾4�[�9�[�oZ�M@�y11�8d �I�r/o *�7F�!6��,��$Զ�,��9eV�u ,Z'ʾ�ֺ����5O��=��n�����"|w��)7E&��.��G0�J�ngʤ�D�����>O�~�z�G�&K��UM�DG� ����N�Oo"o�x��*�s��B�E�T�g-�F��2ڧ3z������<<'&�T|�� Qj4�e�����k=����Lt����j'&�5�.1w�,of�'fE�@Ƕi�JD�oX�?i�^SL�=o���������.�R��qK*[�������̜���y���/�:�� �҄�k�ʦa�0-vy��' �G�!]��y'I���\#����'��(CLn\��= @���4�Eŧa-',�x��Z̡,\���|��lH�Bhr/�n> N����F���+}Cfe�/�;�H���w|��屋���0��28��^�W�3�2f�����O����H5����6��=Zk�R����θP;���q,��r�;~�"���Օi��9�!J�g� ��Yy#�$�t�(�NB��v��%�m����L����/-\"��$c�:�u����%�) ����n-�_���2���搙PB9�C��ͻ[d�i1����Q��UD�l�<�e��8�c��T ��y:�F�� � ������K?�I�\kA��� H��Ŏ#m��}8Q� uq�\�w���zUUСWA
Behavioral task
behavioral1
Sample
5f6cd60a2f7a6b1b6b8561b0c249af3d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5f6cd60a2f7a6b1b6b8561b0c249af3d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5f6cd60a2f7a6b1b6b8561b0c249af3d_JaffaCakes118
-
Size
708KB
-
MD5
5f6cd60a2f7a6b1b6b8561b0c249af3d
-
SHA1
71ee150124eeaf5de6ded11bb212a73325911001
-
SHA256
7f9a928d91f36b8be7f5e54071185093b1ec6e4dcb603f39f9342fe554d0053e
-
SHA512
d3bf05a4b898fdcddb7c3193292c00f51be95b9cfd973084be5e6d61f8dbb78b4428240eb699939d425ac38506431f33702d57a795cf83a73ee2a7f5e738a258
-
SSDEEP
12288:emSlt0cDGA38W9/9XND71EkWKeh1f3s0tl6yrUi1zA6dWriQ/dZ:eNt0cDD38E/rD71ELKuhs0Mi1zA6dWrv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f6cd60a2f7a6b1b6b8561b0c249af3d_JaffaCakes118
Files
-
5f6cd60a2f7a6b1b6b8561b0c249af3d_JaffaCakes118.exe windows:4 windows x86 arch:x86
e8c1d7c1459ecb5acea3327d6f94f6f0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord717
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 660KB - Virtual size: 656KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE