�xĹ&K�� ��t��% oB���v��A�ѝ3sH� �V��ۙ���O���_�{�8�����/�p�٠%�4�oA�ȸ�gB�P["U��>�����-zJf|���h�ܹ�DCA���BgE���h!���+�����'ޖ���~��ç"D�2��Ǯ}Fj�� i��e9m�W�$���\�䑠OHz��E��}ެy:^�Un�ٸ�P��@(C�M��d����ԛi�ڌ|Q�,Z����� ��c]t��;w�@�넙�s��E�`P���4��e"6� ���,��dM>G<��I9clA�l��:K����@9M̉�{�(����;���3Z,�5�m�W� W������D$@7T��M!|C+O����U��ˆ`$vڃ;�?�����J0%�1}ؗɺ!�x��'י3�W��v��5�D��4�L����4 b�5bݸ��P��R)����]֏$���! ��B����E,ѳ���Z�:�yn6���U٧���^��[�0�2��^J�x�I� u�^Ie�&l�q]|"p�?�_܊�������4���~�P,7D���}0��@E���I��)�<���&�i��$�#�&Fzf�ݲ]%�\��i*&J�F]�m��>G^�`�(��4�j��%G� Z^����~����j���7:ŋ�j/R�EzQ7����pX4ب �ꃯ)���U�R2�X�Ӓ� )�m�¿�~� ���ݹ��x���M�=%����� �g�4�s�b\�P_�2�[Epx0�[���{o��#��:zG�;|e�������刘�� �#�Iѽ��S����\$�v��/�C9��� '+�DE`�F2DI7��N��K��3arm�����?o���/[IG-U��'z1�ΫI{���k��*��>Ϥi���H;2��F���_���[��kM�b`�g��+�쾣P!��#����45&gG�e�h�c�Z�>��eu�T=�l�쇮���p�P}-� chܯ`Q��}[�K�9�@*a�ya^9��Z�"��$�?N_�s7{�w%q�4)�l� �<�����/ '��� �^��;C�i��Q��4�����?ښ6�9���4z�i��y])�Y��9/'S�;� ����L�Vt��-�0��Z��+�U�/O����:0�Z���n7<���T�0l��b��1(s]C�⢫T-%�~��Z���k�'��8���Q� @Bt.1[6���h#Xx3O�w��;���~Ѽ��~�G��j�b���'��� ��C@gz 6���;KK6��� lqU?��֭������%$���W,�VA#�K��&ڡ��~��Zv|���ȸ��ű�r�-��D�M�i/S�B�e}����OUSX(^K���^p�G��N�j(9\��A��g����P�! �yM4):��?�Zs��h���w�p�X��s���KźSӃ�����묿�)i��;�b$C�'�/�0��L]7���i[U�������*������R�Ä����9g�L� c�$/=X4����nV^V:�n8G�|g���z�Du8��Tu��?LI���?���l�<�8�&�/�e������0$H�K�mn��*z�@�` Fn'�����b풚����'+K�J.��0v(/�����Cq����yw.#'=���B��ꪥ�xI0����z����}�|K���X���[�����6�g��r}E?Ce�����xs4����lĺU�`�Z�kx`\<~�q����~���ֶcR �V�,5]F,���Q^�eբ�8���(���-��������7҆�6�<�2A���/`� 6L�-��4��P�1vB��rz��Q{v��-�c�S��/6 V�cXQ���� ��Ɩ����1�"����1J~��Z��z���q�@lx��P/�N�.Bu�Z�j��:n�b���_�Eo� Ԗ��0,&n���埮��Rۃ�@[.JӺ�|�h�h)��/��w�� U�Q�u���@iXU���U*��́� j�����R���L+k��%�"�&[r�7��LV�,��$gl����3���JR��t>��b$��v����ђv<ir��~��%}2#���)-�,�&<��QjI�q��U���Ͱ۷��)�|�=���Ӡ���N���[�)?���c�)�\�L�"��M��n'�j��]*��3��VKer=��d�a�:���fT�sb��f��+89��F����lCBj��:֜�S�g����ͣ�qi,s�Jj��7������fD��J���a"��s=�v��ж��y0 jo�ךU��aß�6�|,-��`�6��;6e�jMp�IǞ���4� ��a��"�<��0蔭?k2Rk��|K���Q��b㍇�;�tt�U<��N�AD���غ.��ч���B���\���������q�W��� ����b�_�떌��2E��ckFwQ�n����w��аdt� �? ,���Ud���:�a�g���F[��ȅV)�!-���E�JHI�Cꆙb�}���Ǯ�<k��n�l�AH��g9':��)y��i�(����\n�/�!��ׅ/��#vOR��?G�sIL.�#�Yf�h��� D�h��R��eu�M| X��O�:�8x�� �g}��8��I��4VQ�Z(;�)ܴ��F,�e�n�����=W��'�7V8�|�7�G|߅3� �}��w�>p��_άx���Q��\�/Sq��{�e�hB1���y�a��uXOq�l�U��F���>a��p7: �NO�������L|&A��#%�Q�] �.�Zǂ^@���~��;�C4.Yjw~�H^Z8!�� =\�|���M':T���;LJwj��rYf!aȣ"�w��~�h�eQ4�'$#� ҍ>���T��C�����u���=�;��Y����|Pk�gf4���>,DX�\<��f�N��IB/KQ��q�Gj���(ʹ����pM{=����W��7d�H���)�`,��3�� �H>��S��œr&9�dhw��n�����/���B�/u�5Q�U
Behavioral task
behavioral1
Sample
89787a3cc6f8c66af930c9bd42367766_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
89787a3cc6f8c66af930c9bd42367766_JaffaCakes118
-
Size
732KB
-
MD5
89787a3cc6f8c66af930c9bd42367766
-
SHA1
4da89fd50862a95a3e55f074f8ae3c5a91de8a32
-
SHA256
7d5455c320fdf4b4994bc51a9636d03f793a10e1540a6c87a9ef6b8a5cd1ad50
-
SHA512
5b191f5e3d63f84734bc2dc955027773fb81bdc4bf5eaa673c51d840090aa4c400d450afe50770f6136ce3de7a36e044da0be02360a29746dc787eb2120dcc10
-
SSDEEP
12288:NJg5cqpDow4sKSLkVWVkuxexiH9X69D+hdYti7EKYEdSXW/rtgEQQVPH1infsE4E:NJgjpVwWVkkeoHYYhaGSXyrOiMnfsEz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89787a3cc6f8c66af930c9bd42367766_JaffaCakes118
Files
-
89787a3cc6f8c66af930c9bd42367766_JaffaCakes118.exe windows:4 windows x86 arch:x86
82922cc468979f0c2bd36ef7601ab33b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord578
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 684KB - Virtual size: 681KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE