Ɂ��('�v?�mL�0L��%\��e���oŧ8:H�J6]wsy |;��l�m^^�"�䤎x��-?%o��4B\�Ocs��Y��h�~L�m��6$ Zk ���<�*�t!K���� ���J�!UV�&���g�h����hK?GfY�;l�����&C�*0L�EiBX�Aث�;Rb'�1�@���������ofa�Gya���s�m����f ��K���ݾ̞¯d�'���j��^���=�Ak ��ǷYʐK��ı���hp0/9����Z���Y������1��uL�@�<\܆��@h���̈�=���oQ���������_%�)����N~k�y�����qy�n����)�UK�gf��(H!�P������s۶��FQ�Nx��=�#=�U~sy���"J��e���������uVֹr��.�7�.�>~�f�*)���'��f6����).%���n;Ҷ�iA��R\f]G=�q���Y;㿛ʹ �A��A��fE�K;�d{��%d��,�B����Rd��0'Αvϓ�j{�T)�.��̄���@�l�m������������ \�§��n�2#��r��j�#���%��L��0�|?�3�(b��B��ي��@��V'�D�ġh�m�bF/� N��w���Mko�T"����5�ya�����7�� ��� +W�C��2HgE5�i���o&@�M�(L�DzAz��%w�P�Z���dn/�Q�bRĩp�!��|�p�h� w<r����w��r�*��Q�8}��Sp������Ir�8:�(d�X]xє�<���B���Q\=�G6!w�R~��p TJqYv�(����EZ�Ah�&�Z��V �d#A����(9#���E����&��)����X;4P��v��S�V�y��{2��Pԃ���y���`�##����~�u��~{^ǁS!9��2��'0�4�If'`.$n?{���q����w��Wa0u����0�CdafX]e!�k�)�:@������2?9v�� P�X�;[�.��eg�W���� ���͑�OC2��� }�?���������TS�P��!�.��,�v轖E���J _�B�Zպ ���!�����x�x�� Z/�C$�o5y=���� ��°U|۪X_S��������'A.��L2M_�w5�v��j�k�Xas�&b>`G���sK�bZVs)�&�Ӣ�G�&%�V� W�����D�6+����S�m�Yz=�sC�V�M����-x�����:0b<_�gkܲu�,2�=����zH�/T������#Z�ʗ,�D��IF"�B��:~�`s����ߕ+1�-B�$t��<)#·�ɍ���H�ߕ�e5ߖ����8��W��W��E;�}�Wê���ʹ��C�blCU u�R�1���� |��Cl_ɇ��][����U'��l�Ȍc�2��E�q"����Ϫ���9K�N�y;'���>c$sh��A�ǻ��d>u � ��!FV=<��)������7B�;�:����M!v*V@;���;}��RKAհ���R�����Wji�F�K&e�-k����h���.��l U��m/��%�5��K@��l�夜}��*!QW�t`��S��OX���ޤdձ������S${#f�pPI�ŴT��V��x[Ͳ�"G�nV��������s�]q�Μ�p��s����z)��������WA�+�Q�R1,��V��!Pc��F��t:�lS�6�%c��W�M����LơѢ1ݦ�Jz�f�/P�Z�& {X���a�PW$�|C<EN�d���b~������2x�Ľ���:�^�8�z�?���C�(4��Cg(�YA����j����^�rlX�k�}���0��T�{�Q�ȈhO�x����R4e��s��̟��zN&��,�ba�3�c/L��/,�ă�&�HZ� ��|��QI[�����c֟߫X��ءm{�E��ƶ_��\�f6����_y@�2xCQ#��������ͱ�B�5����_���)�q�e�e7|�B�n���(�I��3^p�d���r�����P`�MQ��}�e��p{O������A�:�n3�~]f�b8D��bwO��<+�j�����^q�6�%)^��Ѐu��}�!���@`�����X�'�:T���{�I߬K�$���ߙB���|�a )�Ϸܨ�EY5�}��ϑB��Z|Dx+,')h�Z�D�4���!+�b�;863x_�����P���P��%�g-�L�N��C���Uy��R�.�T�m.R�X�Δ���@���&����;,q��j���q�c����9�\��Hf%J���jb�ؽ���%�Fz�N��� �����ff�Z��^N�Ґ��^�������{���~�j����ɣ!y>v� 5a�k�h%�쭂�=�����l�D����� �a�X����|(� 2 �b)W��F쒿`��S���3��rD@{ou(ݗiQb:��,��{�u��V�*�>ȞzcЏ����D1����[������멜U�_c�Jr��>�Ly��p�v�r�?/���H�B��8����^ś�g�ir��LV� ��D<u. �x�Wc.1D���w<C�(i��]�[�t�������8q�-��VP1� ��a���_X9n"B�܅!e�#�J6�ť98�+��^Ī�)�:�̐�0��@���Y��ը�Z���U-볗�4�����ӒR� �f�!�Aƙ��:Ch���o��J�]}F���U��Zyƃ�3�)7�@K�a�<B ��o�J;a�rό��䔶�"�~�;W�����7QB�h�uJS9벟�ыp�_}�i1Ie ��퓌,���߱�7���A%������X}� �\ ��i�V�}B���@!٪Vഁ�ҡu���|K�a�P���ޯ�̅�]���<���|���=����$ch��4��xP�c��~�4��a��Ǐ�ψS�`��J�;� D��H-D��G�g'����������cZ� *]�)��,z+�)n�KP� *�N�l� ������
Behavioral task
behavioral1
Sample
65632328fc04318bd1874c4a31b0701e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
65632328fc04318bd1874c4a31b0701e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
65632328fc04318bd1874c4a31b0701e_JaffaCakes118
-
Size
416KB
-
MD5
65632328fc04318bd1874c4a31b0701e
-
SHA1
38b4bd9e6179d21a6dcd8d04514c7b69db267cd8
-
SHA256
3fc539b4af2a2e4f95c733c679dcbb22e256046222caab0e873ee3f25fcb5d6f
-
SHA512
bee8f1acb091d3785294087abebab8584ae814235710956ecaf303e43dce16750c6328a85111d3aedffe38f3cf62b07acc5c6a50c8309899a340ab856944e00c
-
SSDEEP
6144:sYdbBzam5zCkk/7nKIu9xjm/K4XZG2AU8q9JNqUR8E1smyJpl:pbJvFpIubm/K4qUZXNVRVsHl
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65632328fc04318bd1874c4a31b0701e_JaffaCakes118
Files
-
65632328fc04318bd1874c4a31b0701e_JaffaCakes118.exe windows:4 windows x86 arch:x86
95fd143ab7868f3b3e10b85a39623c26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaNextEachCollObj
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 353KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 404KB - Virtual size: 401KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE