�������a���x�ե�+ʰ�b���㢰�7.��q8��=��t�����gX͙X�s@���}օSB�E痨��;���R���0i�K��uSi����Zޞ�.n.ׄv8Pee�������/8P߭������!��H� ����3��`�To���*�n���~H�$G�}ۃ���I �5t�Ѭ�Hw��*��C�~HMi��bCm ��?W�d�!���I� �*�+���/V�8�O�N��������M��BUfH�v�m阧ғ�LH����OukY#��_��a���}�z���v�a:y]��c=���K(0dIZ5�A۬ n77�/����2�X�ş�[��'��&?���4m�M;�����Ft��X����}k�>�=0�T-o�&�'=R�/����.���B}���C�1� ̔�[.���ӆ�,��&��ޗ�U���[|%�k���v�����ѕ�'|*�Cb�WR�5�.��Y=�;�'��`z�@�g]*�5�~Mwz�K�M��I�4Sg����x�`$o(����&�a�!6�;Z��s�r٩�9����Ƙ�(u/�<i��?��NG�*�u�v�q������K��XV��Ӄx�|��E������`�K(E%R����赃��Z�4{`s �j��e�y4�=2��9�>�-�-W�шbv�G*AC.^=\�"~����.v~) �/�؇�39-�\��.�)�{��p��f=�O�����@.��p�o�?�˳bdw�-s���O�~���8*-�1�N[Ï�M`�O�r�*^�[ȑ���{�E$�ݠxl���5���..�0��) '�8sX��Һ��ܝ�Tv!(�c���g��D9�G~��-�ܴ�L�f���~ v�����"BE�BB�l,f��!�~^������� Tq��O&�F2�+��-��^���KX�h�|G'�����:�Õ<^WYT�.�G�w�ǣ�%شWK���s�{�DW�~��B3��*, ��O�٧���r�?}���',���{2u&�$d?�����|v���8I�� c��L���.�2��bw}]�s2�3I��W��ӭ���-i��X�ҽ�Ti��uޮn��D��4�����ͧ�{������o�!�s��y6��?T����������9oh�� r�+y�(D��C��$AԹ���KI�Z<!�;M�ݑ�m�.����Ɏ���Ys�EV����=:�n[ >��ݻ2�\����IyU�s`9����lܙ=)����h�{�f���MƲ:e�, ݮ��0 ��c��cD�ު��-/$�uuIO���B?b��.�Jd,V����L����*^�~7��y�&�3�&z����2�ʪ�<�[�\Lz\*)~U��YJq-�b�C��j^���� c�5oE{|=g��L��6f���4ʃ��Xo����c*��H+ʱ��#�x�ٯ.���Ēt?��u�(���5^��wג|� ��������_�.�L��o���jE�P{tM�62c`w��2n���� �Hx�{���2#����L��=��*�?��( ,�?�X Z�8Nq)/��/ԍ�!9��Q�����@U��g�i��Dzp*fv�J~��x=����V��h�a�����%^�ع�_����Yz��`��o�����pu�D�kHK��FMpkz���.4W.- o�<�9�+�M�7A��9�գ� <������(��-�{��*#��r��tv<,�u�ݍŜ��ģ�T!ƣ��f]�l@&�:��[Q��I� (I ���>�o���Lͬ������M3� ���@�@Ī��~���K�C����B#�F�F����#����@S,�f�L}���q��m�b����]f�3����Z����N�=*;���gC�˗�mn����Z�I�iz,7��bA�tZ�'��W��8�_��F�����PT�2�/֯<{J%��O m�zԍ%��) ş,jZ���}��Ƣt<�]Y-�رAd�h6���\�h�`l�7�nއ�(��ڤ �r�J���,�bX��=Y���_��D�ø��;_ā��b�J̏�v�WW,�ͷ��o�+6s����kS#5�ӧIJ�W��k����Ԅ�����'�o#�i����|�q��Eqs:>v�]g�b�,v����R�������&A�0���!�jc�ع��t� O��d-�����ɞ ~�I��y�x��1'&]9�M5n�{WZ�V˶/��r�]j��i���R?�e�+��Ȟ����|D��gF���� i۴_Ba,3ʂ�h�w�s,��Ѱ#�v���ɟf��OVy~� {�A}��-B��&Ni�<��h.!} ��A�Y�* VP���Ԍp�u�@�.�����J��:N"�/P�*0�P4���E�-���/.�,T�A���χ�w(�Ɗ5nzOD(�S7pR������� `d�vL}�j\�%���)G�ɢW�@�C�������H������GJ 븷���h����M`��Z>�2C��(�L��xl��D���!�'��6�s������[1���>���I��M{!��ݽ�5k�G�*k�v���4$|�v �� �㊷Ե�6���G[y�l����z��'�23�tN��M���n"#�B'q_E�j�떹��&�����C<W��wfM��D<�`1�n���[��|��������qB,���n�k'�[��������9�ⶈ���ߢ��)S���R�_�W�mp�ݦ"��ċnPb��ǿ�� ��EwTm�L+�/�M2��n���c�U%�~�+*9��r�&���+�$��M(\{�/'���]D�Lx'���ylF���ҩcs�ώ'f�n�Em�>g�L��%R���)~V����~��|*_=�T��������L�4���J_5 ��C�N6�ڇ.���A/�H�u(W���]F�Ƴ�r�ʌ��&�aN��;?7���л�؞�X�:]����~��Jf'������?� � U4R�5<z26�|O�ٯ��6$���I�Q�zr���^����6.���{�y#w�*����h8�W=�n�_dW�
Behavioral task
behavioral1
Sample
64e6f7335ef7209064addc688914e1a3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
64e6f7335ef7209064addc688914e1a3_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
64e6f7335ef7209064addc688914e1a3_JaffaCakes118
-
Size
1.1MB
-
MD5
64e6f7335ef7209064addc688914e1a3
-
SHA1
8ff638d21cc2bb712ad968c3cf14ff988d813439
-
SHA256
da4e7c72ce1d630b2f723aeda218083d90f62cd7c14c801530871bc8ad944bd5
-
SHA512
33d681c9f0ef35aae9ce58ae9c47a133fb608364e348d331b0c44ac85ab7afe769466eae5c5555f0f0a15ba60d162778e6a68dff8d9642d0db6ce038aa1f39ad
-
SSDEEP
24576:eFtpsXVFrKg/QT6tpnPJhH7HhjxCl6VE2m43aZl:eFtGXVFuT6tpnPn7c6VHm4Kn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64e6f7335ef7209064addc688914e1a3_JaffaCakes118
Files
-
64e6f7335ef7209064addc688914e1a3_JaffaCakes118.exe windows:4 windows x86 arch:x86
e0ffe521b833095f7200788c34aa3b9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetCurrentDirectoryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetFocus
gdi32
GetObjectA
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegDeleteValueA
shell32
ShellExecuteExA
comctl32
ImageList_Create
oledlg
ord8
ole32
CoRevokeClassObject
olepro32
ord253
oleaut32
VariantCopy
wininet
InternetSetFilePointer
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 291KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 782KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE