�]�1���%��s���Ў(��O�s���my0e6��y���,~Vlj����8G��)�ʰ��8�!9��(]���R˩���h�y��"���]��T�tݸh,nF�01gp��G���IӇ���b�2aV��p���e�}��a�H��8K������n�N�d4�-��m�mG f��6�0MNї���P��������ϴ��$����=h喭����4��%�h��ooJ�Qߝ��z{����xIl0���Ff��}�?��g�b�� Z5�ɿP�X���ގ��Rp���> 7�P�nq�@4ۋ����x������.�W{�x�Pܣ�կ�R���"� �<�B�kv�1m��f����y�d�ֹ�'�?����#���>��vH!����xs:�"yݴ<Y�O���o���̳B'��=܀���M[ �/b��(̫ �i�r~n3�=��)}@�U@E�K��0�s�/C�B �}٤Bc��ة�ܱ6�<�u;��g�=��n���� 2h˝��hC�Ţ���N�ԑ�E nJ� �dh>O�$����(\y2:��m=��a?�mۗ3����X�q���x)�Ա�w_���^�LV����L�}Ȳ�^�9u�Sf���Օdb����8DcY��_S�ܜtwY��`��(2�3^��XpV�g2��Z�A-�u��PKu���'(��-(#�5�Ƌ�L�?W��mr�nE���͟���>筹���+!Z�����M���D+��e��� �\�GE���J���9���M,�C�%�������2����֭d�0ѳL��{|]ʢ�?S��� 2���ǣ�~��]8姬�Y�K0�(e�ӟä�J�4Ta~���]P���|ON�*[�x>�S�dY�F&�����Ȱ� y�eR�����P ͤ>>�Vv*����D��ʕ��x� ���wQ�`����\Iܫ���������MO!G-#ܩ1�o&�C���h��L2����`k3��U/��\�f\��E*a�>h�o��������w�h�!GYwon�j\ݿA\��aa���g�Y��g�B_�=��F�䠌�5��dP�K�HC��(0%R-A��a�n=�hL�+ʥД'nht��v��0���-:$F��v�&>����������wy�����Vڛ2W���ױ��!�(��Gо^3a6��[Ϻ u�� ��撺��n�6#�|����Ыw��\�G�cѴN�Z�]�g2O4@h1dr�D=C��!�|�q�*~J�ʣi��ɧ�ᙧ�h���h���ڴ�K�y�+��N��SJ}:�e�[y;����p����d����Ǽ)e���3���^��^���|�}�m����e/k�p�K�d$~?���cN9�10�{`�Uz*6�:��\J���&"\��nT/����L*Xh*�k?Á&������5߃4�� >���5x:� �<C@��rM���V��*���S�|�3JPJ,�'�ή�-Ѣ@\>��<�_��Υs0>������|�\D�����(/~�o�\���(d����>2��v��1���#�\j��^����X� !���-��)��^�\ͣ�����ElI�W8��V�ך$@���}N�xmQ0�h�cG�͊+���QYd��P����B�q����W6?N���g�R0��4ɶ� PL����*��A�<�J�`���<�l��|������n�x���ųyfԴ>�8��Jg'z�j�5��H��($+�Z+�EtC��)�I�E���H7�7�xb#\���:|�b��M��EèC;~oY����L=[��롤�]��Y� y3Iz� l�r\���\w�78O��w��<ǵ�_7T/r][�-4yӌ���X���_�Խ���A���Q�]��I�p�A1�6��˙����[��gK�R*��bz'HVl�[T|KE��QK�`.ֽxUp��Dts۳����]RJ�puD�E�th2��ˮU�]pE+>��yp��~6��M�4;���>aȖ��L��<��Go��6�a�mj�c��!�������Q��I,E�B��n����9�U��'��@�5w��7����_N,�J���onS������7bqR�#�'�O���1.~P�7Ğ�%�)�(du�_�-�)�,����b+��V�-����^�Tyw�J��چ�*��2��;'R�Ȍ�BeM��]'�=�j��.��ݰqp�H;E�D��gSn�>G�d��i��D_��y�'�ϩ;Āh����Y�_���z�X����u��i[���"�?[e]_���m�_Bk����jvd(�����Xꥡ�����Ń�����-K�4��b<�bi��c=���]��C��vWI�k ��x;3�d/:�p{L��_� U�#����vZ_�7��a4���Z���>i<�m�h"�� &�'gX»�{�#T�Ѫr�T�p3� ў<�ð�J��Eh�p�`��h��*c4lp�@�[����mӠ�2v�`���n���{����9�o�/�]ς^�o��AY|�d!ߤW�=���ä����,O�a)�Τ�:L���cV��A�\��G��#�vDr����^�/�Lx�����ľ�F�G�d�4�W�T����I{QxܲW�X��%�@���t�F��O����(� g~����.P%'�̥��q#��n�����>��� ̠�5QA5̡i���^L�)�W��b��a�U��:+9�i�(i$�l�'�hG��a5F*/�������=;Fn�������Eu�G4�s�r<J`!��.�^��'so�c(����|k���ߺ���]���˱��#j�2%�k�f*�� V��7���`^����)�����&K�J�Qߑ������.FB���6�d_B�d�\������?^�DJ%s���Hl��5���)�ƞ�*��j�A`� �t���"�՛hHG��u��K?Y��Ƒ|Z"0בU�0Y�r;������>����� �� �2� �q��� �|�Y �ޙ��:V����X�l�/EB�����s��tS�M*�AҢFN�2b��P�ؘH<��m,gSA.��q�5��Ĺ�����K>g����ټ��I{ _��3x��9��U�#�^
Behavioral task
behavioral1
Sample
8c9d163fc6b627c55d9301f4b73216b5_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
8c9d163fc6b627c55d9301f4b73216b5_JaffaCakes118
-
Size
736KB
-
MD5
8c9d163fc6b627c55d9301f4b73216b5
-
SHA1
a4a1a2b3e9544a961da76f4a06021d6afd2b51de
-
SHA256
761adc758847edccf018945ad41ff9752e71ae71cd96ecdb2e3a1696389f8591
-
SHA512
04a4e2eba581aaa0f2ad4328b5849d93e4d7c2de247334f828b37b3b4fb31454d0241698ca8ff7f8d4b7cdd024b35e82f63dbc8105cd10d1ae1505b8b26dadb5
-
SSDEEP
12288:lc2vXF7Y6d9V4H8+ItR/kYVnR5a8jc7c8XiKm+8GNsgKCShH:lcAFc6OH8+mdpZalyN+8PxT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c9d163fc6b627c55d9301f4b73216b5_JaffaCakes118
Files
-
8c9d163fc6b627c55d9301f4b73216b5_JaffaCakes118.exe windows:4 windows x86 arch:x86
24a0eb41b5fef8395c6da74d48a3fc72
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
MethCallEngine
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 437KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 724KB - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE