�&�����&p�XXt��s{v0���_��C�WSI!�L_|�Ir��@����;�F��gH���N���A��ŗ'M�t����k�gд�X8����z夺�xL�����4��ڊ9v6��uC��hT��� �Q�2l�nm���BW�2�Q�`�f��ˑ���ҭ:�A��^Б�?f���\>���D��}{j��)6���9����/�?c��f�M���ta2u�3g����+E�캃���b���+�.Ia��>6���S���3�Py��J<Y;�����jVG/֤%��[!I��{w��ސ�����i[�,D� 7��&��q3k���N9B{���+���al�#�g ��s��RzA�I6�xgQ�w?��<1ev�Gw��1L�4��5�N�H_�VB��(��T�*Wە8�$Xѭ�αJԪ��vK��d��Bi9�!��AK�5���� �J�.�M�S1Ou�2^���Ĕ�*V������V�1�P�R< Kd}��:�W���IRT���DAO�`��gp�;��h�RO����#��3��Y\��@DԬ���..��d��� �GM��Ml85D�֍=�������v�qR�%�ꉎR@P8`~W>D���c!�/�-�����u��E�zoi&+_���凇~����I\�泔e|Y��5yp"�֡��\[��pn(��DK�ߐ��N�U�B���q� �~[6j'�J�yi 8GO�O⽿���cO �~���B��s��̱/���u,2U�Aߺ�k�d'3Am�n���`c7]I��� ��턗��*bI�i��]�V���b�/��B�{�������,��b��R��df��% ��t�����W?v�V�\I�'6�`Ԭvr�=�鳽6�����#J���.��4%YZ����k��-F�/eצ��,ș��[ �Uy���������IT �4(�Qt�Z?1!|�3����� -(ݛ�������D*+'p�ŝI�9G֓/+��^��*(��V7����Jl���fq{�R�HcUQw0j�_$zQ�-'I>ގ�y���wlز��^�>��j�����pj��)�/�c�9;~�x�ZSp�^b/U��젬�4Ը��ie��`��T��I*ٜ��~����>)L*�ZΝQ�Tߪ����pk�6��H����!����{p�-���F��Z�z�nM�W��_:�N��Jۼ�A��˛鍸��OPz�����~���!z�z(��_K��Sg����n������bv��C]+�����Ҩv摍A�%W��Q^�K��A�N�o:Ι���1��Q���1��p�s���?��p8}�ʜ�X�xS�$,�H�)q�R�(8�����E���V��S�U�@����e�e�c��煻W��-=X����`�q(kYҀfo���7��8����`"p�n#Ȥ���Y��u��������1bƴ�7v��8��j-"���v��_�f�Bn�EI�4Ŷb �U&��STÆ�8i��.��}�E��Pbb����!�\f� {o�0\Zq�uB�cF�$������XtW���S��I��ߠ'O�u�(gE{�m� ǎe���M��3��qI�����]��[�f���uՆ�6 י�R��M�8�_���/��=V�}�%�#G�CZ�_��QNU�!44)?��G�b�������,�`�j�c$�s�.5&�}��>b{፸q��7�7�D���/�㉫�t��^� ow�3C}5,�`�hł��kmR�N�&���} �d�/颅"/���5VU�O5��T$�w�K�H��6�?Dl����/������%���c���Ģ��n�茥�"����Fq�7�:4�I.L�d��E��_T�PϨ_L ��a��\P�xU�*�l�{/'JJ�]��C� �ᴴ�?����er��1.����^�u��R�.rj8<m�R/���l����5�#5('�Y���_Nj��y���� ���Uþ�.��`Z������'�P�<숲��y�(�+<@�Q6�3�MʯV���N� io�6m�{���H�g�]��f��#��!�j�ݽ�w���ϖҗ�<����S������>��at�]� ���O�af�.j�S4)�&�7h&V���[I蔜ձS��w��l����V�A_�v;��������Mm}G\�*�mP�W�eκ?���W�g�Qie��Tn/�@��^�Qp�t^�WpE�*����u"��"l%ω��C�[D�ڔf*�� y��&�#�v��[�T��M/�i�wύ"�@���ѡU�l�tSap��֖2ad��?}�����R�d��K����҄�P�;�c}^��䜺z��:���,��`�vqQy>Y�9�;�+`~ȵ������BG�^1�D�Uhjɭ�o'�Õj�TqiMUy�B��|�~�l��&��{G�������;��-�=mΪKQ٬�� ���|ƛ�����<��}K?!9Wǿ�(lj�ސR���%<:3�[��A�I���nfh}���HJlWHu�T3#w]46�M��7 �,�y��O��C�a+�=B��!�M�T���MI����=��-HC�*Vy�gE�c�U�ZX�JF�}uI��&�Sm�gvZ߳�hV�B��|���M�L_��L�������>ϊ "[+�l�I�Qo��t�O���=D���#!����D��ʷ�C��}8�;��g�q���<���j����l���d�J��G��"�c��~L��Pq�h���s Q� {:T�nwޓ�^�߃^����7����3��"����6�9�&�eĉ�}x�F�zt`A�C�M`aEn��o��������l��g��:'i�>��|��e��,Z�k��ZFT���D�vT�� W��s�|y䘳�˷a�U�.&}���ߋE4�i2��Nm#�w�֥65���`w�1X�i���Q��BRF+++��pZ�����=S�tП���4F �'�=�Ī�?s�����p37�� C~���~e��y�^Ď{n��{O L��Z ��8?��d���Kw�,�����@��Ƞ6r����U
Behavioral task
behavioral1
Sample
709c9b59fa50fcbe1c7eb046fde64021_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
709c9b59fa50fcbe1c7eb046fde64021_JaffaCakes118
-
Size
708KB
-
MD5
709c9b59fa50fcbe1c7eb046fde64021
-
SHA1
0119a788e5210b69540fd89a1188e085bf23b70d
-
SHA256
1eb59972e7f739068e39fcc486b47789cab245b866370c6e8ff7ee065bad4f64
-
SHA512
f787951990d9b2367826cd8b7579131c623c94b1ec41ecaffaafead3566175d2ee729d40538427741a1def09f9405b9f5f708c27cb48c628ed853915f42bbdae
-
SSDEEP
12288:Os6sZF+bUWzBw2oXrvd5YxvdULc35GExk8otJklcwDpbsg+CLy/HbyknW8X:O+0b7G2oz7qNpoMcwDRx+CO/XnWW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 709c9b59fa50fcbe1c7eb046fde64021_JaffaCakes118
Files
-
709c9b59fa50fcbe1c7eb046fde64021_JaffaCakes118.exe windows:4 windows x86 arch:x86
17fc8148a83e681e1ed618805c628c76
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord598
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 660KB - Virtual size: 659KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE