)�����H�Hh�)'uᗂ�%� � /���)b+¥p ?|��� zj�X'�p��f����Y%�ę��"h���v�+�+?�Q�5�˕2Y9���ry�����D��a�l���x��:��h9++�iE�{��+�v�����h����:3U�n�q���Ś��{������=��h��ž� �*(R�O��> �+N>����pT��3x+i��s�2yy�� 6�2�E�$�Ԩ� �����å* ����p~ڑ�b�%��|Yk����v�,�gނw�' �&6C^fcz�;������3D7������Ń��oΗ��؛�eV��x�Iis��Cu5��u��J��*m���i|g9V���Pv�9��:Gʾc�γ�H�uX��|�4^����y�|yo���D��f��)�,�t���-��TsK-Yہ.���ғ]xD�̳��x�s��m���yGIH��0+d��D2�:5^I���<��k��z��U9_.=��/�no�B6������r�jEQ���_�u��9]vȅ�2!_r�&R L�E�K�f(���q����� N����$���[�Zj�q[Ů�d� ���W��v9��7�2�bj������ I�x$%�M~��vp�q�㐊z��~ğ�//OH�!���#���%-cn��s�es���ٍ���P1 �_1��H��2��>� 9��l��0tD�Sb�� \/�Ȁ=��֣��Z��g|�VE���^���#�ڇ+ �D��a��`l�v�nR"8{_R�d$�s�Ҫ��>4��'�Ҳn��21�\Z�6T%>ؠZ�3��bӪO�t~C`d`�e,#��*?������V@����ό<q=?��&�)�t*p|g&�t��RtF]5��'vy�fi��.S!�-�����'|���H���C+�Y��l�#���(5���fu���#�G�=3���=�ȎA�4��G��YB�����x/Z�A'�\fH�vXr�h\!~FrO=Kx�t:�� �,���q���%��^����RDl2oΜ���L��Y��z��n���;��S.(ާ=,]rh(�����:p�RrɈ��)�T�d��e\�N�JQN� g5��-��a3ޡ���^�>����7�y����E�K8�]-��#�gl�>�/���66��~����2�����|<�hެJ�� 5��(���ͤ�̎����]٬��ɽ�_�2��<s(�G-������S0�|��C��&ϯ�J���jr�b�K��%���g�$�}��XD�n=�/y �f� :2P�G��P=ҞA�0���)��껐T\����:��<�8wT1�p��]=�gn�{jx��,�5���2R%��xi���UU�M,�=͵=��4<ˁt�b�?9nSՔv���Cӣ̽9A�&��b���� ��7�I��^��T(��^adj |]ږ�����K�:�(�@�4X�S�|��Jh���9�(�\�t�:˧[�ɿ�������,gK�ZΟS_1^ p�7�uϽ���`����5g�����zs���4�Iݳn֍��Qlט��+��#t�I"t�R��FL�P�Y�T�i�������Pn6�e���$�`;�`�4Q��w�����b�ݑ�ٛw���i�������/K<\���pM�ը���pr&���n\_�B�A�v�|�!t*��y��~��%�+Q��v�_\��"?�y����V��$��d���=kX�da�9g�,�O+����W�� K'?K�L[<h]�ai�`��2��E9���p��5I�#�n�@3����aWc���4H���:��-�jJ���B��� r��,�g�3�{o�l�䵧%�� ���ɐ��Z� ��;��W=1�_�B�:���o.�3�Uɋ��p�X�a�e�}31���� �H�@NG�T�3˱��d�rt/�_P��U2]��*����M�O�.X�0�D�������C"��u7�kn��p[9�.[�]�M���96 ����r��F���/����x#�����7�%f-+�X���@�G�G�3.�9��;3VN4&-��Ds�Y�M�����m`S^3��颺�����3$�\}����BW����δ�U:�(���;���*��M@����2��-�Q�~�L��'��x�����J����y��ҝ�t/�<&v�9�j��W=��ri�rv�wV���%�x�dm�b�i (�4O�*4�T���!�������tAS$>���kq�͵=��D�_�.��Ns �-0Ԕt��4�e��6��;�9BQeh��>������S1���l���H�<���].�-�gz߸ c�l�,�����r���v,v�����g��s������P��#�?tK���:ᳳ���T�^Q��ؒ�pa0�=�ْ�R�5Y*PW�ۣB���e��_�o�r��[�E��&��S�wڊp�Zٚ��B�F����9�'On��n�����>�%�$��zJ����\YO��i��fW���3i��Mm��_��a1� u��l��X}��w�5�z��?� \�_��{<��g$0&�C��{h^���Sr��[w�����/��<�B��ӓ������t�!���� w/����OR��Cf��)���X�d������%�R�iJ��kݗQ����Je���[�m*!�yvW�'U�Qo��jP��t;��k��킏��1P�t����+@���~��4hP��<�\���Mv��<<�_@���e"�X�pX���}�6>3��lP�ye)S7�fZv�ht|UD��Xiq�,jhb�nH�M�dуد����" ��kOِ��@H�����%�0,�>��a�^ag1����#4���4�Hp0�N��kœJ7���Q�Չ��5��O H��9�2`����W[0цtK�0�m���(�h�O�?��&��p��*�+'�=�����Y�+�`���;���������<b����=�v�]�g�U�jffC�?��� ��%v����Æ���X��`�&��F#Q�)�9%5��O�7H}1o[hg��xL����m�������
Behavioral task
behavioral1
Sample
70c9ab740fd547031be5f7620520369c_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
70c9ab740fd547031be5f7620520369c_JaffaCakes118
-
Size
1.1MB
-
MD5
70c9ab740fd547031be5f7620520369c
-
SHA1
511ebbdcc13cafd3fa2e4d0fc44337503265bd68
-
SHA256
4057ed5f91ab6b690451e3cde3c5b655a660274629f516772fe0ee5e03fa40ad
-
SHA512
393c587747a41a712e5fbd288b2cddd950f587b23cf5e50bcde40980a8bc86c8632a77626fbb8e2334e2124a112843959d27e593cc9cb22dd071d8f434ba84cb
-
SSDEEP
24576:J4jSDPOTszcZK0cP6/TocUmuCDezhVBI2slnC3CWMr:JWOC/TocUmHDeFP7cNWy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70c9ab740fd547031be5f7620520369c_JaffaCakes118
Files
-
70c9ab740fd547031be5f7620520369c_JaffaCakes118.exe windows:5 windows x86 arch:x86
820ae66f4831e518b5467eb6c56908b5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryConstruct2
kernel32
SetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 913KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ