��p�0��mx�u,�:t�q�����Rsw� ӝp�ɷ��V�[�p��b����x�s}��B�X��ka�9��֥�l�L�=C|�TffZ]�xEWN��m�Z�c]G`�H�z���o�q��D�qGUB�� '3�[3M����ߺ�j# -���+���@���q��kw;�`��0�:�FH0��)ڿ=@�g��E�I�Y������V5k.����ʗ�����'x@J���y"k�C�϶[�f��t�g|3�{ ���e��,����P��O�� �l��u��� �UG����a��4}?fiʫO�����B^��������ڕ�a���t=+C4��ܶ�SۅyD�j���`�(:�����!�k��U)Gˑ�o�y��|���L|I%�]�`�`I�#�\�[�G�>\�]�� �H�d���)?qB[�zKn�x)�*Ϩ�`�,���N�:@;� ��8��b�l���>����}E��c+�aAM��Q�f������u�_X11cB��_��õ^+b����q����FJ��*��a��x�1��]�pg�4���Ҙ��WF���8�Go� ֨�FT� ��r˴5���������(x�o]���T+�}l��ȹmRc����.��ҏ}|aХl�)�[(����� �Y��U�E�PwV°h+��B�7q�X4kC�`�Q��:����$s�0��×⥎9ZL*�x�vlp�v��ו3RD�;3^���)!>S7�1�x�.�3�(Jjڤ��*E�os���(��(v���y#T��I����Pp�)�t����6���2hp#�2��U^�iJq�����*��WyCk5G�&�Ñ- �2$�@X@��N����g{,gA� �|A�Z�5f�3��n/�� {�Z��`o1�VN�S5��Y/��I��x�yˇ)AU�bG���wbX�N�[��#�5���@��UP���*����Ĺ�AF����~���3}:�HGQ��V�i�M�u���y �*B_o��^�7H��ŕ��\�u�џ���b�Sk���C�'AC<?s��-��>�-�+���\ ���(f��b X��<��,�7��~���φ߾�+wli�V~������;�*�fʉ���=����"!�MxʓV��"�Ȇ� �{]K{�U��No{흆d�i�lV�y�dH֎lU���M�%�IUĩ��4���A7��}{И�O�Y�I|���k߲��#��s����x��pTP �if�4���k`F�=��.����5~�Ph���ª�f���Pk�_{�:S������6W�g�F��l�=��[�ѐ]�'f���'a�zZF���S_��l�?@`�-����/���4��R��r�ޗ$.I�yd�Z^�y3!�XE�n�7��Fc�u�yݿf��� Wg�)�x�^��*h#BM�$�i~*C���x�_�����|4������Ԛ��2T �#����"�=�K��i����"�U>�:�A�b�$Ӹmqw Q���<�C��1:LB�&F�W�oa�<t,�'j*��0C��)1O%�z1�p�[��c�ȹۤG��F�=����g�,��E�+@��|T��fw���N���"�T`�xý���A�����4��gM��l �����l����̊�5.[ݹe!)��Ɓ�.�B�e�W�h���W�z[ �e����LfKC����x�8oni���p"3�F;�wNG&�n�;�P�!�6�9��1L���ڀ�]���Jc��J���4p�+я�J�y d]jD�^��[�"�#+���=�\J`��5��:��Z�geb��n,W!��K�킛�����>�[r���3����0���F{s$B6�+��+�iH�x2E\@��B����Zh ��Ƌ4ln���q� ۉo5Ď��U���@3�p���8���t�l���L=���1.{�g��D�$e_���ǘ۵L�[X^��X��!R���l��N��yԺ��!4��^���J�4���]+��pi%�����\���z�J����Jg�VB}��O+���4�je S�0Ba�:��QN�E�g��4�ţ���d�[���ˬ梥�4�����z�I�M�z�=���r$�yVZ��[�Uz=ui6�'�E�v]wP�&�>g)p��}�Z�%�@�q� ��!ߟz�����M���&���R���J�6ʿO��@sr��v�����/��S���f9��7<��p����zK���T'��-�T��z�B����ϩ|>+�xA�s��穏Ic5�0�\��Sk��f�VG�<a�v{�O+��Ğ~��4�1�8��{u}m�<] �����.$G�Og+�<���B������;�,� �� ���i$�#���h� �aj�ΐ^E6�������nʹyU5����=�Z���(�h)C"�����|k�O�m�z}�N #�N1!b��XZ��4��[p����m�n}5��AF���w2[�B�je���'C�^:� Zz���%�s�Wmݶ V�1D:Lҵy�"��'Z&>wD)@ځv)[����cx�x䴟X��� ��h�n�m�8�(*����|m2��i�w{���(�RK#�d���HǿY��?���E���n�Q�*-rԡ(CO�$�dЀ0������ȡ(�mS9���p�����Pі���լr�����h/�*�~e��N�Oa�"��vS���`������YH�ϣ�3w��w=�3ѫ�"/��Ge�z �u;�����$ց%���K�#��WT~'LT��Bk�jC슊N�X}�"Y�2Z�9;�"T�G$��7D�nj����P0$�SJcz}lF� �rZ\�z�<"����D����lI�`V��|FP"���vޏW6�șX����$&�zA�˃F�4 ݑ�#*���<�T���g�c�UVV�I8+A�*_]U{c7�I� ���w=~k�Qo&���o�A���X�>A��3��f<S�z��đ�$Y7m"0V�&�{�� ʶc�6l�WŨ�ܙG��.�<��S(���8�M�-���2O��V�FXX4 I�$�t���/~jX ]�����l!��a��Ö�`4z�8
Behavioral task
behavioral1
Sample
8d4f1f34579ac9cd54d0717f80b133cd_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
8d4f1f34579ac9cd54d0717f80b133cd_JaffaCakes118
-
Size
84KB
-
MD5
8d4f1f34579ac9cd54d0717f80b133cd
-
SHA1
5b6e902910b4ddd93a21b7af0f7db53bcf90b660
-
SHA256
6777d6c3bdfe4b703b8c74ae46f739d4e4830cab288941644c1a09859ac92262
-
SHA512
6d2c9e212491bf88b80889a977b47524876d980050151f9a7e56b995e14e9c1eac12176cd2426299f9be03b411d9316f514c616e4926f4d9d9a3826b3d79d40b
-
SSDEEP
1536:NjdT3S103CxCMhcn9P8DL2BhN17Kt6vHtnHvP0GNqVAD65VuUYYB:NjV3S103oCScxSL2B71Kt6v5P0G0VAeX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d4f1f34579ac9cd54d0717f80b133cd_JaffaCakes118
Files
-
8d4f1f34579ac9cd54d0717f80b133cd_JaffaCakes118.exe windows:4 windows x86 arch:x86
cfd8fe33c09ad0aa3bb0c7152c0a1e85
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetProcessHeap
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ