�P�=� y��� ��[��408�� �m>�L���,���Z� ��q�p�mݖ� �j�S��qg.��Nbl���3<��B>n�fm�[������l~�Z� ��T$��Q+��_��p�2���Lw7xV7�^��Oe�~��VB�Q31|��0�[�J˙%O�M m k��A�y��j��n��z��X���]ږPM)M����p��p*Xv����߁�BF���tWw������i=��7mO���*��Q�4��ؠ{��M��IN��EN(�^��/*�� ^Ue��\c�ӊ�~N3N~���������B�қ�G�.���iѡQg;J��Ą�wuH��!|�_r$���jo���E��b�>Ԃ�5��(&W��{?/`�t���<=�ht m��"�g :(��#��z���ڥPq"ۭi�$�zA�%��iз!�\�Q�y'���U�GJZ�r$zS���nM�oQ������M)�a����Y?%U��DT��2 � �4��Ɍ��ÚA�j���8$�s-�/~���g�q�E����M|b�j�g8�hZ��b#E�í�h��PU���]����dx�V/<^ض�M���f�&�=*�B�W7��~�]A���^2;���y�����ۓD��H���DQ�!+��s��?���GE8��l4I��lG>]!�A��N>o����r�w K�U��xN&��<mE�Zm�����,%�^���%=����5�f��?����}3C(��h�/D�P�㡂o��c�˵�3Ģ ����Dm��_����t���1snp�w{P��b�ـWz*�0ئ���e(�έ���×���^1DF�>A<�:"��n�1W,HH�H��h�k��գ�d�[�#C����Y������y���ۺ7�UT|���w�8ir8��'o/�����{��9>l2Ɇ��F\a��鞜,���h�q�QN��<�DH�{w/�0@p�n&���g��Œ����B�*��oӡP`b@�CT�\��~� L�b*4��MO��⊦;�teNK:�ᥔ 2��h*��{���l4A*�_����!Um��$6�Q��!����u����<c�1F51g|}�����TA�<�ZI_�S��7��� ��jsZ�P 5pbQj�7��&��s��]�"�<W"�S��g���[���f�t~q���H�Eڧ6�6L|��@4��hE�<�X�O�䑠�r�X��2���N���k�"��J����_�E��cu�Q#���R�x������o�ʂ��t?�ǫm �")d>�MF�`���5+ۿ�Ԋ\)��!&��g�x��U],߮�%�-?+�<�2o�3q�1q�ٗ�!Gvz�oμa(���#�ʪ����+��]�2�%�h�^� �<J���R��^�|F(�r~2J��|��/\�Vd\����b����*{�P8�ha�H����{�?�#��v4�ז�$2��玭gV�e���d����Oaz�,�t3�<��bܛ��8w=<�"29�䌁M��B*&�v�3�9}��&D��ڽ7=�~ӺZW�wT͌S4䯫�"i6~:�}n�s�%��|}'Xl���)�{|0F��e0;��7� �"�sot~T&�K�s���^���f�ݬ�d��P�R�u_�H"�����o��ڱ/�G�i �kO������B� @���~���B2�щ1݃�N˞�' �ٮ;=�������H��bf5��v;Zu$&s�������U�x�L\�N�">�ס��X��t��S[�{{vG�u��\-S�K{K~J�t̝Ɨ���#a�Fr��v�rj�����7fl���=���WQ�S���) IF��.s���q����<�ϡ����?6�3Y� d�.gȎ�%�c�h㻱\?��g]"l�����X/�E٦���~��9�l��C<Ʊ���.dJ"��}`���1b���D��2��0���(���HG���ܱ,n-8��jO�s�4D��*/~w��~y�+ҺT��\���9�S� �`c�����Mʈ$�=�G���+I��@���+� ?OS�N�/��a�,|�����!^�p���3l�7i��dA�'5l;�f�3����Z�i�(rWeSŞ;����ۯ�b�������h|�� K��[Y�2[G�!�/Q{�+�����)�=?/�-!��?z���10�uD����> �3���da�\�q���\�j�F&r\�U�0F,#�hR�d��l�HB��aLT��o��[�5��������h��ڠ+�Yy�~M�Ծ�a�8;�"��`vMQ�F��vQaab�f!Hy��<��o#����G*r��J�q�~����癥jZi̗kܞ��k�g/ʻ2ɭ����G 4����z>t�'V���l�4X:� �hFL�e��ݷ���a��R�����6��v�,��˱:&���e�q����X�:k :���]h��%%�r)j�Ϗ&���Y�{��*�Sd)�i�e0���V�#��јԊ�'n����d����"t��{���\=b23�� �3P��)�_��%_e�9株]��e���N��}kms@���ExD4�/��Nʿ,�q�/�}6����םEQ�N�Wc�}�=���w�GJ�"�L7��4|y&�������ud&*O�A��FMv@F��8_Tj�#���[_��&�����v�k؞D1�Iw0m�r1.���M�Zow `�������B���g��ۉUi}-����!��xBp0[��6{����}6k��tc; 7S��&n�d�3������ؼ����;Փ��د�;n�����C��y���i�+X@�W�'](��)�ޛ;����z�������x���D�h^ؑ& på�X��ʗ�!�����������g�ց�cT|m΅�Q���xI� Dg��r3�C�r$z���]3"��1KlϟEz0_��� �.�3����F�ɇ�h,Ηt��;2M��������>�HcU��Fڝe�P��;�K�PZ]��z �?:6�0`au}Ϟ��eJ�6��0�#�S����#s��c'�Gdqvj"��el� ���x�}��0
Behavioral task
behavioral1
Sample
8eb912c1fd4777a6b673f203827f69ce_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
8eb912c1fd4777a6b673f203827f69ce_JaffaCakes118
-
Size
1.3MB
-
MD5
8eb912c1fd4777a6b673f203827f69ce
-
SHA1
ce3e585807424265c2b306891176e02e061fd2e0
-
SHA256
59124d1b64925ddf928f347969f761c58ce416ec4849c1f1da914d6ff163e999
-
SHA512
fa9b8a16c46c694645e9bb10a2d5774225b7f556e65742269d1e09d058c5fdb2a47bcaaefa0c61733a9f4e3e045d903dcda9a0c69a3d8e98060932bd163b23a9
-
SSDEEP
24576:XrGP001OKMqB4ig1mWVnmzXwppRfRu6kK1emDB/AqG6bcrBLSLWt6vnzq:XrGiUByVywp/R391XVhuOL3z
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8eb912c1fd4777a6b673f203827f69ce_JaffaCakes118
Files
-
8eb912c1fd4777a6b673f203827f69ce_JaffaCakes118.exe windows:4 windows x86 arch:x86
7261ab4d8dee7ca50a612fba0f964f43
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallWindowProcA
gdi32
RoundRect
winmm
waveOutWrite
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ord17
ws2_32
WSAAsyncSelect
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 889KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ