���ل[W��R�����Xr\�O߈�@:#�a���>���mBED"���� ]W[����c5��\���N�G�费���ru�Ap�B>���� ��L�~�iLR���ޗ��Ph/�`�0Cb@�eQ��OXK��Z���h4N������`��������`U2��=���3��BV�C���s� @����� �Ǐ�,W |����7����H�c;���/[�� i�ed�V3댑Gޚ1I2���Cw�]"|������]v�/fA��uM�k�f.�g�?�-[������h^Cge�����ɇ��A83"*y��\��!����Eb���}�&�{R*�Tְ��Y��Փ�*�o��ښMTܱ� �Z�i�u4ArѦa�^eDZdɨ+&?��TgY��E/��3�N+���s�C�|� ���i$� �8�r`�V�%vƁ6��O8�u,2���H 0�<�Kߘ��y��9J�*_��p�d �s8�������W!泦���_m [&h��j�weT#7�����1��'��l����.�s����n�(�*��X@�M�Uy|��˕7v�"}����Fr>X�+�X���pF5�U>�~���k1-/�$�}ۚo�7�Hl9I�m��*Dg�V(gSw1�C��}����-^����[y�6H+�q�^��?:�����v�&�6��h����x������������hyc[���UR߲�H��a���������x���=�9�� ��|��[��s�����ۼ�"��e�VO*$��g�ϖȳ�DUR>�ZI�K�_��u��9�}{��3���-���֠��T[a&p�W���~�鱝���o���gңZRH�� y��k:���wI�}�ݡ N������� �r���C��L�Uq����&�3uP�ؗ��8,FF��$���X5�[�O<jZc�u<]�,�.�?��Z�+>�n]��c�c��߄(b+"|�H�S�!�[�x@4��͙�VOۚ�h��+?��O/al���{�ПbL�� hs��t:��@;�d��eL�0�w�*S����K�S�O+V� ��5��U�; � /J���[���m�ԣ�1:��6���V��6*�|?@F �cpn�4�{�J�@� �F��"+�,""V�x.����3���#5�t7���Bm\�~ώMy�6��c�d�_K�}�A��W���I�*�I�n�%��=\�vMr�+A6����IY�z�j�Ib������nⳁ���$��-��û���>�)�m#zX\���D��c�`J�#3{u���["}9S�C���@���`�vz/���d>�۳�-O�` �L 0ˀ�����`Ѻ�Ul�\G�'�N�C�S�x�bxu�b ��Ip��K�95�#3�oT*��x�[���!�,?�[�lau�,c'"��d������G�=#���f+c|��R aK4�f�E���$�L=�:_{���m:_H����a����絔��v�L�͎���z6}��,F��ux����mY0n�/8(�E��[_�0�,v�Ӧ��neq�;��GFx�sh��?�C���\�h������ ���.#��Έ��~�߶��Q���OF��"��m�!�i��Q)��x�ur�[CŻ� 7��U�_��O�p4 y_�g;���ﲂg:�/��<䔐q�� P֏`��.�Sov��3!��-��`u�l�݅�0�e.�_q�n�\�w������ a�B��]�+�8�(���o�3�_ʧ6ng>\_741<U�b�c�a�bT�-��t��#h�=}��d��V�/g��fwH�z�ul�/�h�F-�n����`��_Gr?a��� ��_9OH�y�~N4 ��6T���HߠI�e�t��{iYF@�h��9��]D�@~֓�����Qo�D�\��Xk�����z�E��v��@ְ4h |C�uUJqMh9'��ۅ�+LH\}�Ez�,��c\���c���úgF8�Ú5�]~lc1kQմ@4�C�yM�:��'�!t�i���7Վk[�}�}��G�?���5�q�L��G�Ã�����O�%n2������6��%�C��Z@�[}[����[M^�q&ڭ�ȑ��n�ˁ`f_�v�n�Es�R�<<~��ӿ?-�{b]�h�M��J�YL%90�K�`�T~.���DR�`G;pM��j� f����-k0���_�A� o����)��,�o8j�w�K���(����!7�CІ��wq���t6�F��A�u�F� 8�N�����S~��*Ii}e$?�7�� �H�v�!�'�x��b�Fo�C8T����tWk�K�q����������q�Q�5�l~�%u���W��,'IqYnhj���o�{(~Ep���ז��B儴;��ا��p�鱇��/�|���F�{5�+Ey�����}=���F� x,P*h\�F�] �v��w[-5ɬ�1DK����|N�����RX��2�U;\R�B�{0O^�V�mR�h& �;Dm�m(Ō�ۧ���]/�g\j'��K}�R�T�fr���:t�$2+`���� DIBQH��wg�=�'�>�����j�#:�(�]��uAg����8-�\�s���w $�.��[����j��3��0' ��iq�"�Pe���<|j`�-x����*@�EC�\��vk�Α@���Ka��}b�3���L�H+:#�d)�Wng����A���AZ��gm9�Zr���T���@�~;vt�<[��۾���GjI���0�}�̙�*��u��s�%��N��&f�I3{{]����~S�v)���e�X�+B�̧zD�Q#Y��'7�����:�v�^&�@-o���������������]���Ň���������!���Tb�������(}=0��_ru~5C9�!ݠ�����R����U#����0ma��.�w�N��c��PC�p:x �m���[L&�0u�q�x�Q��Y���x Ce�7Q�^��4&8�B�mia��x��@��Տ�Jhk����Ece�t]�&��!RCB|%�/�dg����P'.�W��:ma��Gu�e=��T��\��
Behavioral task
behavioral1
Sample
64c16161cfcc8ce051bae5871889fcfb_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
64c16161cfcc8ce051bae5871889fcfb_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
64c16161cfcc8ce051bae5871889fcfb_JaffaCakes118
-
Size
1004KB
-
MD5
64c16161cfcc8ce051bae5871889fcfb
-
SHA1
667395e5fbd2e820acbbc59ab47700308f532f3b
-
SHA256
8610a8d38c59bf95631025c741c3a2ab93192eb3a39249f609ae6325ee9b2110
-
SHA512
c920924dd32d944924b169f6f975e52f538632aca7b0bc82abce175f139aefb9dd79b42c1ed3d919b0f696164b8dfe8e6403f39e041e6a49d3d391ec2646ae41
-
SSDEEP
24576:UYV5z38cVDaf+gMSyBPRZ7H3u7t5hqL+N7biibM8GPcxtvvySQu:Xz386DOhIB/H3uRqLgbMV0tvx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64c16161cfcc8ce051bae5871889fcfb_JaffaCakes118
Files
-
64c16161cfcc8ce051bae5871889fcfb_JaffaCakes118.exe windows:4 windows x86 arch:x86
2c17677d74924b3a97191f06bac1d282
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeResource
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfW
MessageBoxA
shell32
ShellExecuteW
Exports
Exports
Sections
.text Size: - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 765KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1002KB - Virtual size: 1001KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ