K�������;)��qQ��_�#��tnT��L|,�HyӀ�j��͠?���/Xz%��� ���eI���*�d�R*�.ʥ��<��Ow�5e����@q�X��1o o����Ql�.�n,�̣H#v�������c<-�&U�];����,����sh�6"�nBBdj��K>"� k*';�.�NP3���.�Vd\J��vձ.5D�4��4Q��5�gk"�a�J-X�"��i�gFd�Z�X���e |&Ӕ:e�����Zk4�#���8aDk�tC��ec$�T[]��[��Hmwh�?��QNգ�k �jR�s�/��黹Ȧ��oZ�ɡ���4�R��m�ŝ����y^�l�>��'Dc?Z;��O;H�S}R��#������������{^�c1���pE����y�����t���ԃ�V�|��4�, �$�:uc�r����l�͜(�>��g����P�P��+�y�:E� G�����BS}����p��af"z��:��x�������b��1r[ B��$�o�2��/$S�˻�)���D��������Ξ�ƵY]�xٗ�$� �e���������^<���"�j�rpG��O���c���Θ���M��H���~��̦�R�4�ν��ύ������;�n�<יMt�P8�x��\0�v0g93�i�)vo42���y�����"�wo��Z3�ٱ��V�f��H�DN��/�����{����͟��W�&&F��*���..��~q]�H�k�>�X?½���NH\��OYB��l撏� ��<Q�i%+���s0��M�gl%�sI-]��Y/�F��vT��ieYs��p��_�H���:k�����NU��x�S�����X����|�3Y�ץ�<ޒ�E1��81�qt��+9A�g�)�#.��- ��)���A:v�V����u�*]�����7��|��Br���(�����I����O=������ �j�C�@�:U�u�� V���C6�_�9���$K,e`_�#�x˷U��a������G+!�lj��Y��ޯVs�!���W��Ҹ4ƞ��7�����@��C�2?CҲ�K6��4 ��L3�!s/���11K1r����fo�{�^�R��k<}�n?��w2����?��=��[�����S����`�f1�47{�M�k�K]T���>���}�.�����?86 �`a�������4d�9�������R����$G�2��I���P��{��@�x�����%��p���g��AJ�5�wL>�n#��xc�zSX$a��yZ�]Nq�y$YT���r�wH�c����Mh(7{EBQK���0�Y��t>gij�ؘ������a��I��)�ƶ4�d� �� n�IyT]Qy�ʨ��Y�-���Oτ���V4�DRߛ^$S��i!�lT!�m�et@�/9T�Q�_��R�XS&n�W;��]���PӤ�)|�R�7Ң<����O��2by��_�u'Ӥ�k��O�3��A�1����I�a�4{0��;�S�;b��+�$���|j5e Պe�3�����zLZg�J0BŅ�%��s�.�ؠ#��p���h{�^��(�;�}v&� 7�yPK������lP��Xǚ� ����Q���p�dM�!��/��0q��l?e(r�D�-�+G+Q�ج�Ѫ�ک�h0���� �j��HG'˹��K����+��O`I�1��� [�rF��S7_�^[���S���g6��QǔaNߴ��UGCraq����|x�w�n�]�Y�jn+��h� ��`vc �)6��j�4k���Kt�5��u���!�+�^���!�H��sl/pي���/5t����k%�sb�R7�dŒ�j ��� ���!�G�]vÃ룢h��重gؗd�[@f���%��P�ʭ�s���g�ny����q!���k5k3�r�N_z��W��g�re�����Y��+��J�LlDZ�^1'�����9Q��ܗg9�Krl����.ut�lb�1͜{�;���O')=hZ_r��\����KrPO���/i��D0\��Q��LRt,�m���|�E��/ /��ic@�&15�YdG���#�r(�䝋������S�k�Zύ`�=]���*C-�iV:��}���zʳx�P����b� ��"e1�gP-���(4@�xb�#AxƯO���5�����6��9D�Ue�0h�v�ݪ��Pc��3�R�����z"֡}P��;j�h�TI�E�2�y��I_��7����N��C��ũ`�|j�i%Sm�;�F�ک�z�*�u�10� �����C֓Jڏ(%̣"2]�b�%���&�L 2��lkL��VH�'P���/��&��� Ne�����} z�_?�gW��>6�˽�x�-�T��?I�+���鑟���s'��mB_vs����8"�P�s3#r��PeCCCA�i�e�H��M�`%;�[� ����)�Es����9ו�p<j�����H2G���Y;ݾ�iW*�~u*"�uo^3��4+����_�MK!����"���p�A�ﮮ9$|�ar�l=xp�� � s�']o8����AK�����ɝ�m!���qcuȣ�x�y�����6��a�1��r2� H&���b!ӏ0*�>}�����_���O�aV�{+�7��;"�i����ρ5G��o��[v<���xr_��N�ϦW!P�+��m�Q�~Q��S5�e��(�cy���g?^���|9aZ#W(g�t�W�{iVG��;���`Q��g�Z̢�w^���V;K"��ԃ;yOL���2�,}7��2& ��gR\;#F����a�Ui�V��������AkX�V�ų��� 35�o̗�,�-+���o��kW�)+��w��7���i 8���G^%B�[qf�Fd��F����5kU��M� ]��?���&T����p镕������Ŀ#8��PI�sk���ؿ"���B�}�$1S�A]` .hƖcX��{�*�]�f}��c`i܆Yo�"��[��9Q���&����˂+�E�=��j ����e rd8�a�
Behavioral task
behavioral1
Sample
8d46749b1a9386d4a3962ad18eb55612_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
8d46749b1a9386d4a3962ad18eb55612_JaffaCakes118
-
Size
128KB
-
MD5
8d46749b1a9386d4a3962ad18eb55612
-
SHA1
ba4265c44c64a51924057a3bf67d2c42780d8618
-
SHA256
5e06361eefaf260120ffb175b97b5eeedca3269f1caad9ea3caa5f293871dddd
-
SHA512
bbb7046eda254039a564c3ee010832dcdb4c3e9e2eba0ff4d39680646111ba55231c28b68d276f52a12feb7dbd47fe7c324aa851ade61bd901ff73d30546f8b0
-
SSDEEP
3072:GqDPAR8D3mKeCa2/FZfObhm168tewQoA166B1Jf:GOPAR8DWZCPkI6yyoA86B1Jf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d46749b1a9386d4a3962ad18eb55612_JaffaCakes118
Files
-
8d46749b1a9386d4a3962ad18eb55612_JaffaCakes118.exe windows:4 windows x86 arch:x86
d24669cc89e054bf8e58f33ab2990870
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
__getmainargs
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ