�r�#J�^�������t�����!�U[DZ�a}�6�����En�pL�.4��U���h ���@��ڥhi"�bD�����;e|p���DkArTz�a���^d������g��#�N:���+��:�pow��F�:Qf=D|K�#+�*G�Ega��AߌJ^W� �����.�`ϙf��zhl�ɲa�7m��l<m��#���m����$\--����z�]�\�P��ƹۆ��(�}������d'nU3����>�;�C�X��$��C��h�~�GN�,D�/�L&Bl��S�N�� d�([F�Vm�$���n�d���I�螹�[��d�o"9�J�H����<�ٙQ^Ѥ2Q�"�_,�{ �v���Ԕ���W���pRjady�r������=U��:%49 �Q������P5�%i�״1{K� |��V]�>?<��xP�r!�?�{��c�9=�EH���5�m�F�wC �l�\ ,��6�d�O�'�Ŏ?�#t�;�-(h�h�"k/b�q"��C^m�P�S�����^ڊ1,}����.��b)�����G�^�� ��,��ք%6s[�L�5�K�69֡m�Y��U|k\( (��G$Ӹ!����obS�ɧ���='������~P�'��;��@O(qIR��!q�{<"�}��֫��+I���Ф{E��S��fl�a?��A�fa ���2�o� mB<��U�qL�&���������Q`�L?5��q8�a=��Z��q��\cs?����>���W��H�{o��S�V�[����i���ZY�G) �� [0��0sُ�5պ8�8�G�����i�J���]~r��G�6M��NjX�潅Ĩe����i�%�f�Ag�"�`�m]�c�#� ����'�3����i&k��e |���������A �E��: ��QE{� ������%��[�WO!��-$�U�E�����1��N"e��#dy�/J�nO ��Ӈ�d��no/V �OKp������m�g?����ћA��e���2W��� h[�>�� �L��*C�'������QU�ۻ!���!�YVR��}'R���uE��&��U��E�z��'A#x�@�,{��xv�4���o(�k;���ݜ u�LX��A��@d$W��v�M���? X_�F�����d��S:h�N�Xa$J��&��3ꨉ#���3��S�#-<X�=��Jݘۋ�(-oj� �k� wG���(��|0I�����p�l�����j4E9��8Ǵ��U��:��"�:���-c o�U��x�x�O���_�X��f��2��R�2�:��~�ù�s�F&�m�W����7 H�E�{��1�Z��X0*b�p��?�z�`A.�]����D-5+��89�R &�BDz���0�<5Y��!���ɫ8�%B�����)�Q�B�\�'��ֳ�H790�����$��v�H ��� j���f���G��T���7�_ܓ�g���Dbß��������b�V&��zC�Z�5�����q�98�$�� �pM�PMo}}�⏅5���h5�vk�����tZ��}�ou��VN|�����ϗ)����x��4�g� n��!W\*�Gy���r����J��=���=8���P�>�V�*��m[��%�*��"�|��>�ť�[�fv�'�uA�@�؍,P~~^���煹�����C�A���-�.�c��'¶p�A��8\��NN&����i��cw�Qc����0�4�w�S�t�9��r{7�l0��LfS�EV��Ω�J�/U'HQ�n[ |�5�fh�n0���Y���@rj� \��n0Э�Ǚ���+�����̗rO���f�p�2cM",�B���g�әk�]�H��]�XJ�t�x� ��H����ܤ�fD��A��D�Na����_'�Iؒ�O�|�1X_;4��l[����������� ކ���k�R�O�<,�j���&o�5Z��K2C�|�� ���ΣS~���d��ܱ9d$�g��d�������>Az ���,���>��&!�O����ϹIMt��y&�Kh�h�jI�$��r���LZ8������;5�<wK�p���4�{W��z�ۍ�*s<J��:~'6���pԘ������t��{y�9�╗����������h�VT0��I��<v}6�����YB���ӡ���{����7ŇF��joM���<B�L9�� b}GW��|u���c�A�O�C��E������j`[I�����֝�q"�{9���L�r�1���p�O���� "��f:h���*�x{��i"YodXT�2h��y{D�U��ݠI��� �M�7M��<��厪pr����iz�dw$zd�L� ��� -8�������4���}�A(��\�l���h�����%��+1c���v��ie�{����pH[�V��a����rk�`/I� *�Hk�3���ᄴo2h �z9�o� <���Ů<b��0�g��8�b�4���*Z�GG-�G�:�p�, "H�=�\(����_#3z|���^��[#43� Y�Y�:�W�췬�?36�2k [Lg��p��O�a\�g��v?Mqg��S�VG��_��Ğ��-��0��u�ʷ���ބ�0�^6��_Y�l&��.ǰ�}ߛ�]��y�����q�CN��W�G(�b� %���L��P$��S��7�Λu�ΙY��9��t\'���[�Z2��e�@�S��r_$$�[ܪ���s.<L�ϳ�4����$�q���:�9{�J!���td�K��e�������-1�+��r}�ةc�ϙ� ey���q��N9�|��~V��S�V��9���~P�w&�Z���3������"ܮF��)�_Ȱ���c��J�ft'��14K����M\͝����hԻ�/��;fhۓ[��&wSOU�q�����j�����t`tIͩˆ��[ 8�2I_yh�������|�;��2��|���%���b�J͚�Hwq@�K;,����b�%I�v�0�_6�t�d�]Φ/����o9A�!vc@��x#H\��s~���QL�Z�������N5�
Behavioral task
behavioral1
Sample
6a8378b76a2db2203c1b183bb4c82b17_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6a8378b76a2db2203c1b183bb4c82b17_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6a8378b76a2db2203c1b183bb4c82b17_JaffaCakes118
-
Size
164KB
-
MD5
6a8378b76a2db2203c1b183bb4c82b17
-
SHA1
2f3a6ff62c7514c60ee905a48799c7bcbe12b9fe
-
SHA256
f05e5ae385002543a473c108165a9e13ed36105d7f888d938875c2da6bb2cb2d
-
SHA512
9f4153a2d6e9fad23cce2e3e723d01786e194ed601eee48ba10ef211614d538ca69c9dfa89ffc1b382ab9da232676dc421de4fa7a2ac75b9e6c1a20de461a090
-
SSDEEP
3072:PRBMWjabBsQybHIvrVWGRbQ5o6RtzntBAn/aAAcOjIpGHC:TMgQGHIAGC5/JntePucWC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a8378b76a2db2203c1b183bb4c82b17_JaffaCakes118
Files
-
6a8378b76a2db2203c1b183bb4c82b17_JaffaCakes118.exe windows:4 windows x86 arch:x86
840e578b67b7bd25b53ac1007cf5f3ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord608
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE