�����s��^�=�ʞ%+�l��BV�օ�����z@�r^��XT�� 1�w�q@`H1�CPgl� �)�?t�^�#�t�+]y�k�A��9��{�$j[��2�%֒�9-0����ˣ�9�wS~�;�#�<Jp[5� �� qo��@��STll�x�?����9C�;��������C�G?��_0��X~U������3Ⲣ�[ �9�F����l@�u�LE�h ���j�n��|��.a�K9i~G�W��}Nl]���f�]Uv%��ّr5�/�k#r��_��,�?��x��s gj2j���-<5-�-��%d\!���&�a#v(_��N�vcy�֒t�:��li�~�5 ���'���S���r�ȕ���q����gL���R��3y'�T �qsE~(]� �m��n�{��{$�&u� 4yqJ����a�_$o��5�(�M�<k��nf�rD�n/��spL�@��'�����"���S�����t�C� :ѯ�v`�������N�H3NE[1�ٝ��I���f,��y%&.��d{o��4C�2���S���u�I������ &ƌF���5��KW�j���9�5' ��VD=��s[�V,�])�>���e�o��lZD���q ¡�э[��o�/a�v{�$�_21D��,�&t-�j��)��H6�N�H����ѱ�c����f��*����)��-�������Ē{�5��J.��Z�����ۑ�����-�#̤�j1�Q�[�>(B6ZCLPp%����ݸ~29��C��SF�i��m���C ��0I��I�D���y����X��,���K�vu���9z��њ�xu��Z���g�#�y��Q��^3�۪v8O�� ��Z��7��~�e���\R�ڊ�z�,-\��D��{��Ȋ�8h��8H���$%k�˹���V�Ǖ��h�.��z8�n���<�����<F5}��.Q�°B�2���eW\�Ѳ*,oYih���k�����nCsr�4_?�N��&u��GY�s���C�;i�Bv��VnAc�[��H��B�-k��������$�M��i��n0����]D�`���7*�f��ݔ�"i�W���$*�����@x�_g=��P�xzx�9�te�K>�ӗ�F�`���/{U��Y��3�ɡ1��<xR}yj4��]ħONS����=��1��z�>O�llG��G!������ ������X{�ܯ��8�J=N6���J�\N��М�;F��%�M��$���������0���v\�\��}�XW��X�����%-S�9��V7��1��Gu�[�rrl$|"(�������2�����ioh�_J�����uH�m��jV�uk"0� 0Nd���7t����� J��Kq��ac�K�X�Vxާ�T���)�&���$\�B[/�lf?%Ho�t��(��8��71`a�h?X���k�� v3߷��}��� �� ]�>��~�ȅ���áSQ��`��_�c���,�z��'� by�z�-!�� ��'��y���v,��r0��c�2���c�Y �h]N�����^�0'>ń��&�Iz��(M����6�|�sk�4�.��"m�P�)�F9]�s4��4�DQA����HO�xZ���x��2�h��ĹNB�j4���0<��7�xyY �����Y���!��-�#I�}�!���( ] �y��U��e����qK� �e�tMse7�I#⬢v0b���mZRaè|ۭ���>���Sq���V������:�$UN=@��oh�l7CMuy�� �7M{�s(l�c㯱 }��z9Um=`YG��Wl����E�\��;]��F5�@����9��eMP}��B�i?�*�����ܯ��H���&-��"��^Ȕs1�:��ѫŎ�;� ���y�9I�܅8!z�L91��������%��:`��6�g�kIk\w�Q/x�S�c�z����/�Η������R.���k`ԓE�\�Z�>�e�?�߈rg���}�L�� ���:��(@�ʜ�U-��E��3l}��G��U�<N����\h��]��^H�~�6�MUi�cS�֯Y2N���1J-��5���3�cg�l�,�ԽG���ۭ˒�����nQ�B-#3��^=���UE��y�b������Ǚq���������-`������8M����Kυ�*� ���[����+�UJ�M}���qc����?&�L:���M�!]�Hva�ͳ�)�������__$)L�`�S�6s$�ָ�W�G�{�ӌ�Ru��/��#��&��l�W�� �0_���tC��C3����in��m�l����� q�ˋ�$ \���peM�-���*�T�gh�v�&_L����l<�'ݖ�l0�Z�������֢m�{%��V�g$�u�N��Md�Uʠ�h�\���k��דq� �1�"�.����Q���$G}�M��0F !ɲ�3F �� !�����g���ϥ*9�� �. 2ܬlrC��-�._Yrŋ[�aHhYL�Q\Oywu��@�E��dφ 1��;vx3�O�������(lq��(�ϛ4��'�����|%��hP�WK߾�I�>ө;+t�D�[����5�V�b��C��r�l�k�&c�e���*h��o�X��Ơ*���rVֱ��('�3gaVD��>�u v�����(.r��˔x�lY}��@��Qw3 Yo�^׃�Ӏ�-�ՃX#8�+dTk�HIJܫ`@�q!��,��E�iZw6��H��Q,�b}��P��g(���Ovi��"5&�b ��-�A��B��H̭��9����u?(Q�MH(���<��5Z}�:�d0�q�vE���%��"�;����!T��3��ҥk̗��#f$6�r�lg�)�\cQ���U�>���D��?����i� �Mn R^�i��v:���` �ڹ�x�Q%H�����yZ�s;��덍��c6I1o��T8�=Jñ1�4b�G}ǽ��a�0�U�8j�63�����Y^J� �!d+:'���O#, �qS>O9�\����{�D�'�x4$���������Ӷ��
Behavioral task
behavioral1
Sample
8419a126577d24fee3aac4b5ecc41937_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8419a126577d24fee3aac4b5ecc41937_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8419a126577d24fee3aac4b5ecc41937_JaffaCakes118
-
Size
948KB
-
MD5
8419a126577d24fee3aac4b5ecc41937
-
SHA1
a513595fd6aaace8c7900b574ef2b86520f29766
-
SHA256
c0703a3af1a66668234338293fea923b572ad417d11b504e5c5a61881000afbb
-
SHA512
f362629e8749a72283ff04061a8c654e39f661fa29079bf2d5ac5c4bb425a513f365eb367de755a02573b7fbadb92434b2194fb0bf6869326996450c0cf10343
-
SSDEEP
24576:ueoSEpSfC5J/jEwuW/UAgjGrn7JnsEid3WYDfADCf:7PC55AwjcEnyz3WYDAG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8419a126577d24fee3aac4b5ecc41937_JaffaCakes118
Files
-
8419a126577d24fee3aac4b5ecc41937_JaffaCakes118.exe windows:4 windows x86 arch:x86
22fcada33a7202f9fdddc7e5bf21cffd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc80
ord421
msvcr80
_decode_pointer
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClientRect
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
ws2_32
socket
iphlpapi
GetAdaptersInfo
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 399KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 932KB - Virtual size: 931KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE