R��I���x����� �x`v.����w_ '�Z��v�p@S���5Κ���NaT�R��̭���S��J<�K��6s�Y��F��d����a��p�m@`��㵕��A2*Q�E=�lӳ$ ^K{v�!O8��v�5�f@�W6�1����B�ࢹh���}���7�v�-�)�L[�J6� w:� �.ܤ�嫐����{A�=�ѐ���_�X��M�������H��OR���+�'rÃk���k �$��ɗhQ���i�tw��ֲ3������ʗ�=롰�F)��Sc�܈LK�z�2��� �߫Z�rV���b&��GE1g��ORH�9 �[��J��VgJ@�9C�>�l��K� g�@m=��r�����^�o8^�dv��T It�Q��|&^���^�]���?%æ�;~_����RȪ�F[�F�nxT�����#kYkXO&J��b��iF�s�LE�^.m��C�p�f��P����B�v :�\������z���-�_��:�����`���4��I|���;�#���� ��$E�w�Y9�:q����o�F�"����O m�_����X�g���# �KRZ2c����?�ޥ���Q߀�{�b]��Qh;�N���~E�c���;-���"��b��� Չ��@���-B0p���\�Yx�1'y���:����Ӯqm�^Lܾ+�a�aGFn��(��� ��o{�9 ��0�Y ��(`]�(Pe��d���'g����|��7��!1�*� 4=�fj�"���E|Ƀ��\��J]��v������jMk �#X{�����W�<zO>�-�`2��z�n2�D�X ���Ca��Y�f��R0=�Z��C"@�{��wZ���<��c$��P�| �����ޥ@�����N��������0����b/��Z%�3��<��By!* A����:�n���k��X�*-��p{6����|&2n���������-�d+q�)��& ��0��R�f w�n!h ���>���`j�yި;U����xH��7�j Ϊƻ�k�%�o�UM`�A��H��;��Tr�?�)�gA0먩u9���,$_0wZ�$H9���y��:e��a,�od��u*��[�e�~D7�����P���ۈ���D[M�YA��nL��w���}�u��ʱN�90u�-Ӂ�����ol�e��w�k�ʖ��"�EX�}s����6��G61���U�p^����)��_�QTh���>������V����^��r�Y@�`���u'1��\y�;��,����ؼ� |p��\Z��K�/~¨y���:�R��)d[�� �P7h�� :WQB���<���"�5�J���Q����n�z�f�4]�D���;^ѡݻޅ�� �Q���b�����v��j�-N���Y���m-�C�rh̪f�T�mJ�>�4��~��t��/���A�(���A�� y$�������/���Q�p���a(>��"BW�S���J��e��c�c��%"����^�(*^�-��������v��*��oH�^�P]-ۏ#(�-�u�C�pw��#s�XR�d�����rDb�v�K�_�]J�%)�+O�4 �B�J�<ӟ����/�$�R��ٔ.7��Z �Խ���Jz|&0�މ�,V~S~��\#~|M�W��]�@r�iB�fM+��w�a�Z���� b�L�y���Dg}�/�<S@z���3��?�����69-a�,��?g�#!�~�%\���r�ia�:�ĥ�-E �� �_B��f ����u!���=��ʙ=�[{9W��Eu ;��[]D���~,���� ��ޢ$�d����L���CZ�e?3َ��v�P��2�$�)�b�����7% ���"�!�q�[yX�t�o������.�V�P#�� <�'��iC=���:��R�64yX�Y_��+Zm�7�O�y$�k�i?&j)8+("�a���u�с01L��Nǻ�$J�d���n����n^5KD�����cu�����Y�Y ��;�`J�ih��fIiO��iW����:����L�Io���'�F�Ӻٽ�X}ss㨜�n[�����>d� G��*0R�P��T���� ����ZS���X~����z0�Uz�+. )���R��o�*b�rG��J(������v���EQm�mjܴh��b�ML��VA.X�����毭�a��&�q����J����/Ʃ3��cet��\_�bD,JEB�����o����'�,�q@�B�[>���������m}�U���Xs��ag�}�J���}��П7�:O��#�K蝴�ݨ�:'a�&���n.�"�悯 Ơ#w���b+:�����8�=Iz�w��Z���Ie r�� �Q����@h��� �a�R�eF�78�3_�(�G���*,D�4��S�߀�%�i}�����UX����C�"{lܶ�c�e�%�rP�$����F��ڻ|��$=��3<�p��z4�(�dC0�'��d)e�Sx�f� �p�Mɓ�'(o�T��wI��FZ�͎<%.�Y���U�A��U�@6;��`��P�O�D����0^��������5v�P!��5� {z.ͅ��T���(a�����g�j<_��Ր"\P Z�s��0l�T�h\-M�ߏ�FƦ�Ꚑ7�����,��WgQ����\Z@�e��e�*��o���Q��1Y��Å%oE���� �K\'M0 �2��B�y�B�t��Bե�2m�Tn�_MI6d[^�|k�$� �|�b|��E0�?F��&��~l�mY 5���}�aE�W���|��ʊy���TXԗ�,=�"���{bչ���an03� K�����o塜|��,���v�m�.��)��T~���3��2�G8x2�#q���uީ�@��_�X�[��8J�o��c�{c�q|xjb�0���0���u�Y�<����;va�s~�"�z�~���U�\Ve�q�4{'�v��8��mۃē���aU@xS��'�a����_��[0'�F�8ޮ��v �l��.�ܘ�R�8}��8jk����De
Behavioral task
behavioral1
Sample
89f101e06d26b7690b486cdd3a7c21e8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
89f101e06d26b7690b486cdd3a7c21e8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
89f101e06d26b7690b486cdd3a7c21e8_JaffaCakes118
-
Size
122KB
-
MD5
89f101e06d26b7690b486cdd3a7c21e8
-
SHA1
326447d234a49498230856aef9814b54fe55baa1
-
SHA256
9250ac11a64d8b0c49faf2d3e1e5c54d40dc2906b2a8469e88f1ffeaa77d5422
-
SHA512
df28ee76c80c2ff62ac68356176b86be8fb1f1332c9bb428268a447d9b07e5ea0506b9b8f3f744de5e0f88a83cc25832dca8d1db35baf2d03f00a4b02c877f69
-
SSDEEP
3072:gmD/Kn45L572ZWJu93zGUoSF3g6X8J4jlM6ZDqDZfB5FrGjp:jg+iZ7F370kqz6jp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89f101e06d26b7690b486cdd3a7c21e8_JaffaCakes118
Files
-
89f101e06d26b7690b486cdd3a7c21e8_JaffaCakes118.exe windows:4 windows x86 arch:x86
13610ed0300ad691beaa2e1045905372
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFileTimeToFileTime
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
advapi32
OpenSCManagerA
shlwapi
StrStrIA
msvcrt
_controlfp
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ