\{F���F!�%f���|Cߓ�g��B�r�b+V�GqNcъV�N�G�DԵTT��^�?3ND��k��4��Lf� ��z���wH"!!�{lA /)֊|/{��d�"U���^2c5�AE!��n�mD6��!�A|/� VkQ�{��rCٖ�l�Y��A@������n��S�����3z�ᝐ����6�a�Q�tH�X���k:���=�ӻt�R1���D�u�����de�7蒫�����#(�}���T��t���i�Ax �������B6lX¬[_��2 ���;��EX{@F����,�[�P�xv�]p��c~�37P�t�(O�#�f�2��!���T�z���e��ʜrɨ�����\�Pk֘y����m�����IJ�� ����oG���`��-�/�b��P����o�A]��ȓ4��Z�=h������#��f�nSO�Ƚ��}��Uz$��=c�io!�ZF�j�-�̉?;���e��z�<p���l�������zwɥ#�-1�b�Q=��zΝ���#0�L��}���%�C��U��'hl�?Ai'��wч�d� T��H���/}���4j�Ѿ/F}�I;�&1(!�M��bX��{�\z��������f��z�������R�� J�x�R!���ٯ�r__QD>f��YQYp?�7���/��r$:�q�b%_[8n������Gmj�G���f�#p�Ô��[Sy}����5�W�i]O�ź���\�`���r���+�|�(\���9}aH�;���2�IɜPə=�̝���A����n���%GWxU���V���Z1Θ�7��$�$+�6ή�%I�pLFy��._����K�,�ʌ!~,���N�����,�M�祱�U�!v�n��o�]�Ot��d�����_�K0�G9Ə3E�I1É*��WE�@��6���U�r2 1��! j�eOj�Q�p��7r�-{'/*�NЎ)����� ���/�ɎK�� ���?�y��v�.%ѥ�tC_��r��t1[�.X����W4P�h<�V<�Aw#����:�uYf1ĺ�&���]�lG�vk; ��$r3is��WV��x�����r�&��2~I@@�f��,ӽ+O��)^Ɵt#��zGX�h�*7�t�k���o)��w�A��2�-��UL�����Bvv�0ęBk�[ʲ�U�G�5����ĥ�������, 2t������7��^��o=]Ns�j��#{�E�IIm�;X(�p��^"Z>��~/��}|���X�uAs�[��N)g��P���w�O[a�G��^r��6��zF�!��l�����L�D��7�H���wPɆBk�N���r�TM���kjo��*�'Y� j�T�L��|�� �b�� ���c�%�bDу��i�N�C�kw�ź�=}�N���Ϸ8������E!�<1H"���u���hD��۸��&�kS�a(�v8����;�C�p�,$g�*u��]����*J���)��D���v[2%M0�sfVz7�eKFڝ-`bh��2A���������(ME��4y���{��Z�=���e6f)a$E�XÍ4aH��#m@N�"k6�İ��]aHun���}��f,����\�h��2���w���'&ۛC�%E������$EE�+"%��"��:�rs���M�$D8Q��h0�sM:=��82�<�&����`�� �#���.�Yawr�db�p�6S�!�"̓�R8�ܯF����^d��'m�?t�ͤɍ#��@�����Z����4�:B>-��N�����3ט[R��l��݆��[��O(ʑ)>W�]�8 �G�S���OU���]��V�Y|Jg�k؉�;��E���S�w��6�sR�4�rY�p�4 F~�`�[�#�D�-xkE���yh6���S�kum+��M���̶C�a.���v e������6%�Ͱ�nY�������-��~[�M;� @�_�(1ʣd�� 3�I�+;��a0���;� Z�aT3�VL�_��9��q�2�uk�Aلk�s ��(l@�&�+V{K؞����=�:�d��|�*�Q,��כ:4 �$�i���#%��=�=�{�j��x���~�{�0od�*���/�2b{]���u��Wm0ZY_�Z��e����_G5� �7���kx�߈�������#է�s�h�8'�=��S�˝G �%[�o��ڙ��N��p�����iٓԃ����2M�u:��1���m�V�J�)�Ȑ�&���~� u,�9�]k(;�~���!c�~�4���"V�O�XlJq� D���Ic����.�����>!C_dЭ�NG{n���e� "�ɺ%����2��{�����u"I�ȱ��)�Bi+֓���@��g�(j��??6�5�,����Ϭ��95���ų��(�,|��C��`4���~wqO�ʄ`��_̠PZ(.��Z�ݕ&`�)γp�ڋ!ps\�� �|$=��պ?��]K��g!�R�+\�X0�3D{�I�A���uwɞ�K��4ϲa+���-d�A�N)�$Jщf��Kl��ޛ%m" qWު�)|y��kg@�>�h|/?�;,�QYw�Y��S�LhY:���Ny�qHn��"��Rt�u�q����$������TS�T3R�"ծ�O�2y�njoMo}|y8He�O���)�ׂ`�� l�X'�X��M��0�ENR�� �=�e�@ӾN �$�O��đ��H{��ظ�?��a���]N��f�^R����Jx��Pc#K-dR`�w"GZ�r��������r�$}�r[��C$�� ܑvB�& �{��5Z 0OG3��_�z�n/�!8̳C3�b�-2���Z��~f�/Q��R�C���Rg����V�=����G$���6�/Dl�������+>ҽ�������juo)�!��-���cշZ{��kA�.jbg�^�!'A��L���&������mY�0.C-] �\].� �d���0�A��17D�Bϖ�x�(��]��� â�]iPD,�(�u��`�B�����t�ִz;=��
Behavioral task
behavioral1
Sample
8e8a379df6b2ee8f2bb2c4cd0bf4ce02_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
8e8a379df6b2ee8f2bb2c4cd0bf4ce02_JaffaCakes118
-
Size
720KB
-
MD5
8e8a379df6b2ee8f2bb2c4cd0bf4ce02
-
SHA1
99b20e7beccbc89f0eb97e88b01c9aec422e06d5
-
SHA256
07328551bc94417aeb430199c700acda12747cdcba145ccd6d8bc42e3946886a
-
SHA512
5f7c19a394f3a4b954df737b26e33f759c5c490364aa53aa6c9c7db07ac909db3886d481b49ddc9a0e8130b74b1841c0a259d2f7ab13f70d405e5a592ad30718
-
SSDEEP
12288:QX0gW+ATX+DVcPH0QzunQeOyYfZSHj18v1p7Kvt4+R+ck68xcZE2Ok3qOYnl:vOATX6LDQrIB8rW4+Pr2W2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e8a379df6b2ee8f2bb2c4cd0bf4ce02_JaffaCakes118
Files
-
8e8a379df6b2ee8f2bb2c4cd0bf4ce02_JaffaCakes118.exe windows:4 windows x86 arch:x86
c0634448132b64d3f5e5330b7f11bd3f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
DllFunctionCall
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE