�f���g D �$p8\e�����'�� �ܢ��4~M����t�A�S½O��$� S�� ���l�yq�'PY�[ )�qW�Y�+:���1�Dj��W�?�[F-u� Of�����l��H`����ӽp�.݆����>�1G����C2�n�a�Gw�1RQX��l]E�Y�/�:����&F8���ג�>�5�����Q�Y��f�֔C�� ʑ�L����+d.�x�IS����Ƽ����s�(��k0l�Z�l���1f��x���]j�ǡ7���k:�fjai|iŃk��]�֚�g�(��`����W�E":Dm % W�v˿G��t�!u�@�ۆ �p��� �~�Ɯ�i�L��+�;� �����I�u����1�*��ե�����_��4F��b�~9��Ը�L�P;Pr4-Ǵ\fN���{#CG��IJA��;�e��?�7?��' 79����.���l��BJ��H��L���5I�"�9�I'�-�D<l���[�R�N|�ƾ��)��j�n@��T������Ԟ 3�7!r���';}ZU.O~�N�� `�(��h&�Xf��m��b���d0Q@� �mʴ�wV�r�A��� �=�^B��e'ۢ��CN@#t�P�ڕ����S[��|���g&V��js����5�G���)��Ľ��)��B��ؙ �Aj������n�(����cP�"�殴�a1��'��b�.0��&ٰv�A'��F�)���z�l6��z��U�4��,�u[�h�C����w��H�l1��ͣ��Hj���J��}��HH����$^`�����Ɖ�wóf���HH<� >*��J��3�(�W����!����W.^��¥N��� :�]���d���B�q�d�X2��!�P\���Hh╕�F���_dm/��m�9+ _U^W*P��M�')�uݮ�fx(8J�BC| w?&=��m�C`%���5�_ș� j�#��=���$T��7�t�r$����v��xT��S�b{�E)��l�b��!�Ca-�K�_S�WHK;��.�<��T[��d���v�͊QB�� �f��7P�Nr1�fF >v-b���h1���K�x��J�0A�'�'�ҁp0l�֏=��Zc7�^���@��,���U�2ߑ�Z�'��VӅ�MW�9�B&'vR�S�FHN���\��P%<.S$��k)?E�d�P@}88��@���$��O��*�_�]ӭ�� ;pה/8�2��t�Ŝ3��"l% �,!�����t"���}��E4��F��NW�~��"�0�>�ׁ��e!��������j����VQ��> �~i��c$�K�l�����M�¯������p�x�����A�$C�������0A�� ,����>�4��)iТn�9�J�s^FdDT�K^�^��#���#˯*� H�G�"�s�]'Jp&jpB�`����,u�����7��36d�D��UMep�^vʰ;��0������Q��UG�2�!���W(ۘ5cHX뗥�t�pNʵ�\�̰?5���������A�Y���+�D�����?����,6���wa�0|�2���0�n��/��`�������V��!�8���]�"%?�m��h��; -C%��4RW�m�G�S�;�p͐�����ծ���=0u��1R�y�9�o�;�qr���X�m���)8T�0 ��@�-*6��~�枷;^F4�V7���s����O/�<�Wb�I!�3g���̜@�K=)'p�>�w���%���ܣ�h���}INx�Y���ũ�3Vn��q�qDJ�9t�T���QL+Ja�����K�Q�2��١���FY�� �C%C��u=Aܩ �W݄۾�w�����3����B�_�0�2�d�`0��z��떆YH�("�1Q9�O\el�ã}��lLk8ݤw��u�L^��9��QG�S��������r�+��6��=�>sO��N�"�H�ㆽKxXϷ8���I=J!5ccU�ǭ�uMJ���߃!�w�����Sݒ���~4]4f֧8��mFZe��t���ܫ��@$e28��:�6�+�����a9,�� ���.�-O��! ��M���un��`kB� ��T;�yI/�������ׯ#��Z�e�R���L� �������Ә�>?�v�/��c����H� �g������4�x��Ό�1.�H�q���d�R�� ��e��+�^3���o0#�������1����gu�W��I�S"�����gR�?�뛖 $ ���-��-E,�ce̘��^�D���[��F���ېg%��R�JE �ȗ���Е��+5��h\�O@0�j]�<����~ �}\�*N�%��4)uD�+���ԜS�*ũ秋Ƕc��E���oR�WT�<K��Ur�q��q ���&�����)�n'���#)���5���g�V2(Ţ�����B7�>�LvJ��ً*��99�������8̵�`�Ȗ���� 33���JTmi*�V�z��DLJ7}9u�-53m�L7�������q�7~b$C�W�bx��Ӑ=jŗ��k�Ķ�=��H{\A��+an}^�~��N+t�ac�}<���lֵ�����9U���PC��;��>dqR�V�;��9?m�� r�.~��~�MA�&?�s��"�t���N�I,GtZ x�?i�k�r�W��F�I�$R����BA.����_��Y��d�[o�?ď�jS�j6�1���M` qY�k����)ֳ�gͮ���}-���ʭf��,C�}��h/-��|��?��SE��մ�F���^�����u�y� ��w/r*h'��1�������jc��Q?[�$i���~���zn2�ñ��ɏ�\����Ԍ��/GYI����?�@����@cF��B���^����M�C�o���h,%���G��Փvd�&�R��!n�Rq��@�[�˒�l���k�Jy�spu�U}���QY4�����ze۷V�k#R��!�DŽ��KZ��Opp��}^p���0p'��������А�-">�����9�c*=<�@��L�9���
Behavioral task
behavioral1
Sample
70ea048879cd23658f0a028b223678f8_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
70ea048879cd23658f0a028b223678f8_JaffaCakes118
-
Size
522KB
-
MD5
70ea048879cd23658f0a028b223678f8
-
SHA1
6a4654a3b5434d3c2dcd0cd78abb0e87d6eccad4
-
SHA256
d192f2ea54a0ba23335afa63cd30333ff01979aaaefc949d1176900b62852272
-
SHA512
99d5d25e058ff719672a2f1a6d2851b730388acdeeae1ec8b94ae09ef064f12735ef49af88d9543e03ed6b95e2a6af038a25f3424e5092de5c26c9242d13ff7e
-
SSDEEP
12288:bkj1vRft8x/7kR5/6U6iUyJtA5zQcYzP36E74t/btrQEwv:bk5guR5yU6xIK501OKW5rBwv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70ea048879cd23658f0a028b223678f8_JaffaCakes118
Files
-
70ea048879cd23658f0a028b223678f8_JaffaCakes118.exe windows:5 windows x86 arch:x86
46dc9ecb8b59ce1af3f99bc6044b4a97
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 488KB - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE