�鹬+S1��W��<�����İ��e�^�f����J��눛���`�u��㘩��Y��/[�f���$/����bm��x˪���Z�Q]v���)�%�,|�l@hF�c��e��������Kۏ�5��;�P5�W�aq�]z`��OAL|1��R���V��h-`ľ�%==F[�yET.:�s�p��X��o&�cn����>c>�M�BE��C����QR��4�5o2V"LJ����Jv| �BNr������Wii/z�t��[��5ck:��w Á�� �Wz��̗$�wc�6ٶͪ 3�H�m��%M�'ٸ��}͢� ֜��L������dS��Y-�7�Q�*��@���q9; [�����τB�3=x�ט��� ᤻|TNó�l�=E*3F��M-�e��D6P��x���Y�<A�O��d� NO�<DK�߲�� ؍�������P����b��Jb����E����J�����M1�1�)��>����skh%Yxn�:��.W��l��H}����Zg�����S�wͦ�E]���cw��?�s�u�) m ��Juf���8X@�������K�+� z���%E<�j�7�<���!'6W�U6x���?LtkǓǎCT7�p��%m�c�O|���_5�9��~�V��N�:n�l�q�X��E����5��Z�P����B���8L��Pح���8&6�J���5 ������J`q�W�~�ֿ9� ��2S`�3XC��_OC3*����;*h!GN�B�ک hx���'�������� �@� ��cI5����Y��V���@�\ke'z��<�?���+s �4��n�[��{k����[�� �6�g�[7p�)�h#����y�h7��\K�B�8:�rj�.*:���?BS��z41��F��-v���3��u��ژ����7��-�=�u��m�>�Ż ���\bA#��M�� /e���v�]R�M�Z��:����WH���i��N��Vۡ4�B�p���v\YNSu�a.��K��:��B!���~��h���*�4�)$eʂ���ل����<S�;:���u���S���P�8��b �����UT�pN�w�9���'xL�͇R)Zt�Q���'��� ܆3i��+��z��O���\X��^t�&@'��'�ݰ3X�������ɟJTT�a,����]����a9!z��V�{�9��nzٳ����Q�_ "�i�c�C�ډm���9�^T���;Sc���Cx�ģD��I��8��p9'=�g4��#�,2�=8E�~��������&�F0X�+M����^��"�F�&�KY�2�j�)��I�&���2�p��6,(��KVc��B��X��LE�L",��Ζ�xE�Y*ɦ}l�&u�&�QndIWtC�_r8����6��(��7��ځ�Iȍ ��zGm��ULM�qHM2Қf����������s:�:Smd�5X�*�½\�R3�HR<릱�D��� ̦��#A4�x #X�Ok �@�B�N�%�3�A����~�����I��y��rEl1F�y���Tr��0;��D'�9��c�\��Q�H�tP3��4&+��ti��g5r�B�����R����\����3xx��������d�Bgz>�"ֹB ���E���ɾ�w���/��"^U�*��w��=��B9�C�O�lBI��U<�h�9e-��-�2�p��w�#�Ԧ��,g��=�G��_�K~�^���o�*�g�ߙ�$��켬 B��X��D�� A��R�kxN�'{��P���J}>��rv�v�J�?T�@�V�Bx�GLqN;-�}��@�}c��x�Ӥ�W����&����k�e{F�B�V6l73N��b�D�*uX15t�|)�ޕM%z��n�� 5�|��?����:�%k9�����*)��ޅ?�W�^�6E��2G#��O�;�����Q$֡���M5!ސ�v�f�Tf� �+����3A�(�psC;�Ť����j��-���_v���L�b�*,�ȽL*H�,[}O`d2ø���w����xZ ����>�r��:S�o���.�\![�H"���w�^�V��fX��/��y������.��S���%�4k[���i�i^�)Ȑ����a�r=����q��38'�?!!�v � ����a�\��6�ʱ����-����GM��4k��l"�G<E����5."����4�A+��x8U�$�·Z���k��Wh��63a�A�G��Ӆ/0��5@!���f�$`��I��B6��<ĺ~(7L����.Y5+X�A��j�eF�������` ���5��g0���"ڏ�9�C@&�2[�9y��sf� �� �$�9KI�0m�~�EM�e�U�iꜸ��� �*�����Y�e���8�R?m���q[������T��!�;��y�мr���~����/�;����`� ���U6]���̥E�˯�G�$��l�PٙOщ�˒�O��th�zX1�8�N��nOD����]�1�� �)s�4*^D��,)<5PM��/V��l�~����nΖ�Lpq��B�[�]H�ւ���L>R-I)��A��?Vk��.�L�ڟ�������)3�!��CȎJ�m�/df��xZ4�C�f)�}�6��S���_��l��@�u.ßX\�>��������5g�G���/E���T�&��Jͫ'�[��C����Q�H�p�a��Y6l��Do�ǯ-�bkCL��TS�� � �����F��f�/L��q"��5h�Γ��&;����XN�� Hi7[��_�P����U�D:��F��vX�f�]f�\��vY3�4(�B��sO7��3T��+@-�����b�Q���1���hW���ґᡮ�c��;=^��� �Q��䩿;Z/ Vcy����}׳? ��U��r1���K�yC�:�9����4Uؼ�um�ݖ���?�|�Q����%8+ZBu�����Ϝ�eDx�I����՝���;��]���25����ߛ� j��$���n����> 5��-|�������8��TdaB��5��@��6�7�9H��v �3��
Behavioral task
behavioral1
Sample
8c0e6b653b07ae04501e1e69581c7e5f_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
8c0e6b653b07ae04501e1e69581c7e5f_JaffaCakes118
-
Size
716KB
-
MD5
8c0e6b653b07ae04501e1e69581c7e5f
-
SHA1
2152243ca5fc6eb97296c8013ad51661c82035c2
-
SHA256
88e7fdac28ebfec581371fd7e88e054254a37e175c301e7c6288884893cbca0c
-
SHA512
3c39169fcd06c4da6f738634fc212fa2b89dd8b72b2c9a516744240e666f06017e9e1477f1108ab9985b442a257c480c827a4d25a853a1c2272fcd6cf1a14132
-
SSDEEP
12288:+pgzs/Lq5lgbydVtCR7ss7euZ70brpIMbkJRsUFiMIYkk22kBkmMkkEkkCfs6k04:I9WPvoGsn70pivFiMIYk/cna9
Malware Config
Signatures
-
resource yara_rule sample upx -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c0e6b653b07ae04501e1e69581c7e5f_JaffaCakes118
Files
-
8c0e6b653b07ae04501e1e69581c7e5f_JaffaCakes118.exe windows:4 windows x86 arch:x86
02609ac0618eaecf287583827b375ced
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvbvm60
ord581
Exports
Exports
Sections
UPX0 Size: - Virtual size: 836KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 313KB - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 350KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE