���4��:'��A�F�T1)D�B�"-mO�c�����)I8�z&x�u+ۄ�2��J��P�]��I��Mп-t������rajq���/�퇨e�|��;�z7H��S �vg �+ZH�4MXr�<�6ߒyE��6'���ӠzǼ��K��Xʧ���)G�yO�5[_�\`8"�V=~�x���뛨)8g��Z����w�bvk�5�����Q�1m�O��˙��������Jm��^��K����t�?_QiN5B���"��Ҁ��A!Y�=h2��Σ���r.��!�cFX5˲�����^b�20Wf����)w��gp [0Ⱦc����[�,D�s@1��s�m�'OM䷊���9�Tk� ����:4�*��s��~5�Y��R�$ú(��s��ܿ<#�/?KS<�\� c$�{��Bt�<�y☒�b�.vѫ|2�H���S}wS�E��N���Q�6�鏗b�.Ay?����?6 �� r"Ƿ[;���듇и���}M��wuK:+�O�q���-V�.��l ~5 ^�rN)z��s�7Z����&&���� ����������Q�j6��=�}�4��I,v� 蹱`5�k�E��d�k��ۮ$y[�>B�z΅�0�KZ5���+���"Z���� �����T]<�����b��+Й�n���RQ#�aKxƏ��]���f�q��%�>A����zA��V��M��-<��~B�f^!L�=J�1 ;K� �~Sԡa��*cK��&^]��M�N�/�85o*K�=,�sR,a+��av�U:t�BN�����ÿ��V{&��G��}O��Fɺ4_ߒ�T���� |�۰���,�| }7�A�V �������9�� |����a��O~��-@C����s-�spF_9� x<_��?f*����05���H�Ѿt*+�}8��N�%ڑ +vh=��UǠja�J�4��*�}P|��M���N�]�����_Ś����:��B����~4v��}�G·����d�s����K���!=c�00�ɩX;�U<�6��a��,G��v#�ZR��1��c� ��Gǀ���66Zǡss�n�J=�Q;M�M7�=+��Pd[J��eX�8"�-�ePH��xWs��&�{O��OqK�0S�0aD�����@�C�4h��喡� ��qDjv&����*�~^�g���$��ЏK�\��}Z��Vk��LLsȁ�f����c$�qZ��\x�����[�m�Č��i~��&�V��z�~,�;�9*�㩻����\X0)5r�Դ�_�'t����8~�&^�����5�COZjv�/w���A�_�@��G�;KE`�U�M�H� �4��4\�.}¿�VS�J�Za*��2�Fk���N�e�1���]����'�P���S}�_w]Xg� ;F%x��<kYicn�l �ұ�f�{��H�P�RI�쓨fq���lo_Y{��7�� 6��t�^�B�|敋��Jw; }:v�V��������\���$�<����%@���3�qf!�@LFh�7����ϕ�� ��燹C3�^�y�V=��r�9'����b����bNI�h�b�n�4ʫn��`y�1��'9P?���]-g����5���#�n�y�I �.��/����Sv�e:&\�u����|ޕ�`V]�Y�6�_�†�Y�K�*z�+yMK�w�� ��z�T�����¡q{���J��+3�N��!�/j��#|���W΄���&o����s, �#�4�����hl/k3v�"@�4 �D���8���>��Z҅9iBɮ�h�X4���Ǘj2�9#� /3~�3S�#Q��=��w���!u�bb��SZ9�r3m)�`��G5���Z�2p_�-N��M�~.�6���q�٩�����t�<�Ő�~���-pd��*� � z�<���^D�ź�NLc��G�h�f�7v=z��r�Y���Y���{T�o�@�!�F��Rz歡��JfW���c'�����L�wṣ=x�.�T�:�`bn Y\�1K�e�X��:�N+� �������!żml�<p ع)c>�o��v��&x�e�b{�0^���h_��C�W旛���D~�_��,��`�ko�,B�G.��Ƙ�5����m���%0\��@p�)l�ӗlʭ��3J�&�_8��G�̇"��� �ҧ}��O烃��5o���$�n�F�\c����R��ϋ���?����ʺ-� a�!���TME���jf����C|�Gh[��#�iBEs��vAK3k=i0���\�.�� RG���Vػ���i!x��M��ϋ�B���{m���,gN[I�Z(�H�aAR����pb"W�Li���K��q ]�~e)�b�}'�?�Qd(�x���YO�d.�s���I2 ��27�� �l�f�ߤ֛�N�J������� �g�G=%�:�A����P�� N���`,���vS'���_.�-�l����P���꞊����xz�7î�W�*�Fi}�=����4���xW�>:��MM�X�;4�I���@vl�z��!�?~č���j1�檔��,͇=��F�¿�r����MU���o�s���{�~�}��Y�k�c{�ps�{���K�'�k�d�I�ΖC�m{�0�j�Gc/� ��+�^�b����Q�y��te�͐�z��g���lZ]��B�Y��p_����`� OB���,�Cᳳ��'�>#33�� \|��[�Q&'��=�C�> ����*p��]m�W��.`�K�u��Z�K~J����b��"he�!c�'���>�m����:qD���3����@ ���j�������_*˅����QI������ ���U(V��8��8���Ҫib�[�e�Dz0a�:�S��T��������2>��|h(��v{-�P�7�Gzx�����k��A���i�xV�ިι(w3�0$l���ϫ�{�����tm4!��'�D�ד�H�����/��KC���L �(���~�N'k��Ly���j�L�Ww���f�X2�4B�>�O�������Y�l��~�6��g�\D
Behavioral task
behavioral1
Sample
8a808cfcecf40504bf3d80687eb37109_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8a808cfcecf40504bf3d80687eb37109_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8a808cfcecf40504bf3d80687eb37109_JaffaCakes118
-
Size
284KB
-
MD5
8a808cfcecf40504bf3d80687eb37109
-
SHA1
14746e6929779c2af27564be292f3030dbfd3407
-
SHA256
1ec6281e3323cc92c3e4fdf9a6aa207b995c47c4b1d47eda96998db869d576d8
-
SHA512
41728417fbfcf4ca0afdf24544de1ae9600b0ab3f2db84fe618bf5c7a01832e35a836ff46d7a268432604860919a39f1a07431eb4aa3a64b52dc4bb05841bfd5
-
SSDEEP
6144:A1wPbTnKmYLeH8vyCmgiJ7EzAXR7ZWoIOutnJBdTKTfPXh0:nSA8vyZgW7V7ZrIfDdIfPx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a808cfcecf40504bf3d80687eb37109_JaffaCakes118
Files
-
8a808cfcecf40504bf3d80687eb37109_JaffaCakes118.exe windows:4 windows x86 arch:x86
1d61bb0a60a41ea8cedb7ec63bb66118
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLsetFixstr
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 272KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE