)�Sk��6Q�m~Tly�l |�I �Y������&�4ύ�0%��������²R�Du1�j�@���X�{c@��%3�v�S<Z�j�����D�v��L�u�8F���=.�[j��s���Ԧs�����3����V8=�;������~���R�z��1)!�z�AS�G����fuITi8�:��y��̀'�#+�i��d0sK���h�>��k��G�I$���i��{0��`�Y�";��7&���[�:�w��z����|k��]#JR���%����(�|����1b� ~�]��ڋ��Ǔ�&��*D��*����Q&��h������&�(�^��z��P��֪e�g=;��_9���ѢHCAa��r������Y����6J��VRAI��%Lff1�i�$�G�?����o��8${���';I��:!���A�R�i�&d�Pse#�oj^��R����%�|}��<#�ww��>�ߙ���f��\�ٴϾ�L�w���t.��R�lI�^�b�谉'~�И_I��k�=/Vۢ�:�������2|�I����8�/�c�ԏ���SN�y�V�^Cy�����غV�][����I!s]����i�={�'�nWDi��`1����1T|M � �@U�.�g��q�~�2T���b]���:G����]���D�>V`�l�B�����C�N�������k����3���4�o2Ä�_�3}|��Μ��V[���`�&b[�u�+n휕Oo�y�d5]4����'�i����ǵ~V��Ua�*`�¿��O'b���9z{����Y��$���I3"ݶ�VQ�^X]!l>����8��昝��2�Y�j^�[�D�Ə��L��>�2�k n��l�.�g�!�b�W-��\����牙����MʪQȒLMf��&�(ce�� +ڑ�8\< �=;u*�ORIp;� ![����NL*p������A ��X��~�g��L$���}����Y}F�,r��a>���.�$fX�[2m��� t�n�,���g30�}���� Y�r���Q@ӈ��L���u�K�E���w�E�y��ej���(������:7BLa-iͪ5�x�60�lV���Ʉ��Lj7}�*� �,��43u��X��D�_�g�0����[3�77a��;Pd&>U���( ��ȇ����m��;��-�%��*ې ��݉�d��bbK�y!z^�}���o�o��%܀�G`��.����?���k�s� %���&����y���ZC�,��iY����"4�ȥ�홖�p�˷����c�.��|X�E��-���R�\Bþ;�ER�©�c�w�}����+= ���T�=w�A~�V%߄�q �"P����c<ݿX�A����� B��f0)�4��*��z�s[;sHH�yI�U[]��:�!W¢0u�)�In�d�p��4)���3��w��}��P��bX�7��y�ɷ�[���Щ��$ߟ�N�u���ys2�р��O�-C�"v��tX��9�C/,��8R��-,,I��\�츥���+�~����c#��=���� ���n|�/� v�� J����?ى87~�Ēp��x�UA�h�;i:t��'y�ͧ4�$']� ��Y�(��/�$I��<��V.�NH�Գ,�����i� �o��x#J5JH%�4&>��0�k�I�e�����@3�^�̗��s�/�)��1�T��u��g�ںU��nn@sI��/6�� ���}<^U�LT��|udމD�8?a&Z�'�c+%��V~��k����&��1( A��C���hۛ��g>��5���w+h��]�Xq�^�p� �F��D0"�*��b�r\�q|��ȡ`�#E[����Uý��� �ﱺ~�ps�E�D�U��A�-�T:�� ѷ���3S|�p\K�V�Y_���5��������� ���)NE��2��aZ2/0GxWc:]9%!_6�E�l5�%,�LJ_�?s}��U]��"$E�5�U �G��U�� A��(���(I��p0} ��F���[X�1,��sF>�)JL��=6�Nk���� ��i�-h�]{fү�%�U�Aly�aY�fa�D[�EM�X��{т=q����Σ�����h'L���}zo?����{�)�Q3n��}�3.ퟍ��V^�t�C�7��E�*�� ��cM�ehXV�.G�����nV��A��n� �˘��Xf�-������J *`l�=�@�Vyh��&ж� !u0ڒp�*u -�i .�[�K��]*)`Q$:����r]�Q��Y_��"D�GP�3�T}���ط���Ek�ݻ�������W��Ա�A.�c�*�L��4������) �Z�xA�HA�~t���cX��2|��Px�!yi���?4~#�k��/Z�5ChS㨞����eF ]�d������\�t�������i��C���J�c&�{2�z��*n��%�s&S�v��_�}0&(���i��GC�='(Ӓ���N~g�J:lZJ6������@�M|bݢ4�B��{���1�j�g��NF����Л-�ŋh����o(��f�VW8�;�Cfވǭ�L�O�JL�&O��������O �%��}�epƐ���ÓZ�+{��ށ�q'�F'�|%?�n�<���i��#V���� ��+���x�3�o [)�:ij@�t����^����Cr�$�wIm٥��~b����=� ǻn��w�������9 ���ud�4��������`�]_o�2��_l�aYTX"qC�L�߳H�Dy���}���~��(ǯ�����!_�J�ikۍ����aS/����q��T�E�����v����'���O���<����rM�����G _��n�������C�T&�������&6�r���1jh$4Ju�x)�(hM�K�J��N\&��1�\�aux���^������'��!,�oH��k��V�P!`Q�-�si愝��RFQ`営ƹ�W����H��U��ږ�Xxe����־���PA����ƅ�˧"����h=��b��ެ�Z�ά��I/���֗όG�C�Wo
Behavioral task
behavioral1
Sample
7074c2e66fc05558bb690723b463fdf0_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
7074c2e66fc05558bb690723b463fdf0_JaffaCakes118
-
Size
1.2MB
-
MD5
7074c2e66fc05558bb690723b463fdf0
-
SHA1
4e6c0af38458b625b64fca46059c4050f724f15d
-
SHA256
3b0c385e9d2c67f9a3f92d19c9b0db568e93342b147f3dcc21ca4775416b014e
-
SHA512
0b51c1afabfa92782ee8f29838e0c6b80ddff6a7bc8f0a2b3d352b91b9eecc6016d1ca16bf0dc6172097510d69800fb96926640f570306b1411973368cdbb36d
-
SSDEEP
24576:RBkijv7AUyb376+q0GoSIjGmz9u/eZE2kJlToeLYZ1UGiRNJXkebAi:Rucv7w6zAGmz94rLsjZ1UGafEi
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7074c2e66fc05558bb690723b463fdf0_JaffaCakes118
Files
-
7074c2e66fc05558bb690723b463fdf0_JaffaCakes118.exe windows:5 windows x86 arch:x86
ca4434b74e0fb1e75e702ea927b86ee0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
OpenProcessToken
msvcr90
_XcptFilter
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 960KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ