����(X��^&��Z<&�j�R������5-GrJx��As/��DKҊ �>פglU�e!s9@șU�f]xg� ��x�o��U�d ���@A �{ᤡ�|k��Y7D�w<pl���`��)*V�:�M��S��6�sM�?��0��ڧW�` uiZP+���+��+{��m��#0��R�_[� "R�����\�ٞ�!Q��%�8LI��c���@E�擙��UƓ�k?E���sT0�sD�S�}=�@�8�wu9���� ޙ��A��r�E���M�6�D�֎���B���Eҋ����x�W^_}�(SS��mn����}������WM�v58:�"7����)�%�?�"��0מ�9 -��R�)����vJ<���#��������dz.vn<�5��[� �\Y��`:~�� �+K+�~q�ה>)� �5O<�Q�#�ϷJ�]���t�@�N�Z�� �;������'��g����N���h����T�Y�҅�ƃX�H�RA�O��|�-�����A��/��p+4v��Ù>ؤ�O \�B�& {�Ǚ���o�QZ�D)J��D��mh���#�]��������S�MC^G��uB����1��2P.�zr'q��^�*�'���\r�Q���,7�V�����՟��vd� ��t{Kq̬��ޣ^+U��V��A��;��|��� �_ɝEk�L8k?o��ύtQ!(���*h�zC"ZMJ$KON���֑܋�c@��ƓkS�5�K���ir1��`,o.�BV�I� ���/���9|\p=y�-��UulQs܇@ EZ:�<w����,*.<x��(�"�[7S�-b�? @6K�&�b1�.�l!�#�ŋ?�S}���㦌�r�C�e���M�Az��g��=���u&�a_�{�'ShBW���0�څ�h�T<8�.�#Y9ۡ*[���-5��/�:�S�1����Ai,/a0˵߉��<��C��L�#��ʊ����q�s��%���ӱ�ڡu��%S��}w�rwe��u�[!�mu���4�pD��.՞�@�U'�f��Vij���Gau��/h�L�+�|�eH��%�H9$}���b������u:IX�b���h�7g�Ң�T,@Âa�oP `^lC�CV�ս�_�� �[\�l'�m 1���z��ь?5!� ��L����!e)�ܺ��C4��d�]7b��{�knݳ|���:X��7�eب'�ba��g��\Y�(�{��4�/dz۽�����p�Kq�� OR�97�)�^��QMa�D�ֺ"O��7.qRׂ���P�몈L6!ܼ$��y���p ޝ���ĝj��?쮟8�gY��q�\�5л�7��<H,F���R]������%,�\�v^�55�=���!�ӵ�y9}��7���P�kqʉ}���?E�I�T�]�l�:i��9���������E�-�G�U8���x �G��Cj���D�=���[U�b��8,�gJtR7���`��%�;������C^�[F.����.��{i��$��;���ԏ�tF��0�߅��k$�_rD�S�ˈ�=JzƲ��y:��Ԙ~��q��qӗ ��=筡�����:z�v}��hlw�_��<�>l��z�U��M���������6|8k�GQ"c�s��/�]O�����jw�׳��ŃH?�z��"j� �FcL� ��@�SѶt���)ܺ�=�d��n��"��CV=vf�f@g(�ŕX4��E;������_�9z��e(���X"{�NtM]�2����p��|v$13��h�a8�d�o��?��1��*a�B���Y/`���a&��eH��P'�~�-u��>���{Ĕn���vL+dͬ�"�>��+���Ti���Q����\��3���Dǯ\ދ��>��aD]Fd-Z�Q��L����Z��\�A2h �B���@�=~az�����熗�Y�5���!��q��el�k��-yv��V��Q�Ҁ*.η�~\ɷ��ʴ���n��m;KV�3;L�k�3���p�S�J�v���δ%f�P�-�f+71�. �D�m�����P��-�<y����m�� Q��L��堥4����e�^A ������d"��/�(��o�'�ܦ]�eaI&Z�n��IkK��b�No$>�YZr1K��?��JoW�%� �y�q��eA����B��k>T\4�LV_���:d�x�C��>8�H��8��BQx�7�t���-6�tQ�:�$��l7H7�� ��9Q]���+��8e����L��m �Ĥ��I� �w��J��m���ⳓ�챐 ���1lZs��aF���&�qH&:Fw^H�A��r0�I �U��p���3���_��W��Q!�HxuȦ�O�����cK(���T1�aD��s����s�p�QӖ5'L8�����p�LZk>E~v�R|繨���3�_/z6�6����}���r�$�#Ie��Gڒ�u(��3))�!=�](]|�˂�j#}p���3�`K��������.�r� �O����Z�5$sJ[H�xe�I~�w��YjY����r����/�4)?T���ZFpw ؍��A�Z���(\��Ӡ^��65�2њۢ��~T.�Q��ո�? ����; d/$�_F�e�+j�rS��|���%�8��/$��%��3���q�T��H���}���?���q�{;w����xk� � � �����[ Ͳ� tvA̐�[x����)�ʅ��b�*29E��"�x�t��d�@�W��ȏ�*VG���M$��u��G���h�9j�p�l���R�=���f�0�b4������� '=�4P��_��v��v��� �q*{X���c���j/~6Ii�l�G��DeP�e_O��N&M�:� yl����@����B�+����`��"��Vw! XH�������n�Td7ԛ���Q�?���|F`t/��k���������i�4NX$��zW�J ]�?R���z���̈́��m'#0Е�_ߪ�o�|�����ϳ�f���Q{���|L{
Behavioral task
behavioral1
Sample
885986ac9ac972b45fa6feaa709c1412_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
885986ac9ac972b45fa6feaa709c1412_JaffaCakes118
-
Size
748KB
-
MD5
885986ac9ac972b45fa6feaa709c1412
-
SHA1
331ba6465d9927847b4a860e6d10b2bd7be885b2
-
SHA256
d1de9ea427c2048f18ad303bce65043b301574fa9b30914da9c978e6be81b834
-
SHA512
d952769dbb417d5b4fcaf6ed62a8ec9176ca7c189daadc89d961572e702db5a687bad2a97e2527aadf5b3a7bd1a1f0589d1bdcc70b65fc635860aac7fdd94288
-
SSDEEP
12288:9el0P3zSwiScH5gLxQFslpmO6OBEa4z21bt1BHgcL4/89MWq4RbxYd3sGgvzh+Rg:rs5SDg3z2JtXd4/+rq4Ru5sGKkTi
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 885986ac9ac972b45fa6feaa709c1412_JaffaCakes118
Files
-
885986ac9ac972b45fa6feaa709c1412_JaffaCakes118.exe windows:4 windows x86 arch:x86
b928e5004a193a5a26fe9d6a25045f33
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord632
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 437KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 736KB - Virtual size: 733KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE