������8��ك���Ywn&YSb����a�|�2(��� a��=�t�;�J0�Dn�ڇ��{|^����ukmK���0�����-�.����A��u���U�,�TD8!R,����V���%����p��Ph�_�� ���lt��MS����җ�t����Y@��� ~j�ˑaV|��m�k����=�뎊z- yk�H�m��H�����@�4�S}=���w��迄��h�Pi|�;,?�7c���n�:��^_qc�п}~� >�iv�p^��+���:N�@u$������{G�zb�D2.�/���z傼p̰%�ʒtfK5y�H���B>�*��'��ք��yJ����D�g{�%�ܑD�~�b����P1A���h+�x�����_4��>����r|��@_N�궐�U/�"٭h.�/!�"��t�ܭt<��魢�ָ��%L����,x ����CFW��C�5*��S��DV`���?k[Բ"�^�р]�?q[�������H�z7xxX1�9� �2�N�!��9Qk�\�;n<� ����k�l_S� 9G�;�J��\*�g�%t�`|=t����a֘L��5аI4������!Vw��NW�t3��[�F�q�頧���o�i��$�c.Ά����G� 3C�-K&0'��}�9��Wt�cͰ�B�9u���m3"�~��*������W���-�Jf� �y�H��-I��l����8 ~X�T�,h��W��w�C�.�hH��/��#(�^HN㯖�z�P>����:֧��y�E6a��d�.�*�hɄ�*���9�t�&J��X�%�ibc!����̓.�B�Z��P��=����s����"jpLpH��Jj`g��.�<R�a<��JB������c�)*k��l=27�82��S�\�ޛ�ށ�&��%q��練d��B�X����Q���9m�M������`+R`��"��������º��J�;��:�X��I@���]�&�~�ƅo�~z� ����f���A��$=G��Zm���r&�'���f��c2�))p#�n���g�<��5��,���E�U1�ϴj漛�"����v���lT;J ���^�]��vpÔ�����o�]Mt��-� A}����Q��ޚ.5�8��"��U��z�]��u@O����U=��2'b���\�;����2�a����He�.o{I&�Q�p���;��(FV��b&EsȨ����t�,�?$#_i��{�\�������Z��'� ��²� ~��O�_���R1� ����E0�A�.PC�0�i����n���a�*�t��'&��8q'������>,2}y_��ٹ�� �aH�b1sd{��C��D�<^5?!�/��M= �k럨�������L�xm�pa"dV߈����t��T^�<k&�H�,xk�E�y ��:,�oY:��;�����N a�������� &nYL�D ���vx<� u@���S���쎁�=��[a�4= ��,*Xma_%��c��Uo�&fD'���#U��:�2�F\$r�g_�j�A>7�v�i4O��)02ښ�E(|��_���q[�l��V�=m�T�%LP�W�QPMw���=K�9x�O_Ql���uUGc|W}?��w4��Yo.`YU3�5)E��`�Hi��P8��S}����ؾɋ��h�n�=��O[%�p�-���b����d�%�n������`�s�,Tu�%!����"74�3�DwIU�� �&u�=Hqa¤V�c��ۧ�<L��èR�0�" �c1$�w^���G��ˏg��~�I��h^A�E�~�74ޥ����<1l�,��6�z�'3�ϕזxdm��5"T铄X���&DJYw���TO�7 ̃������X����CRL�|SM��`Rg��ΡNi"/t�ej�P�.\�z�8?T����V��?�8�/��M7�54%sQx�xw<?u s�Ț1��Z~��~�V��Æz��b�[I/���F� ��U°��͕����Ϊ���J<Fr�%��k<4��h��&�E\�^����c��N�3����4�i�`�����v�����Q�<�w:])R|��-t�g���7(�̈́��Ә�p�^�G�Iy��$|ޭIM�O��}�Fv/hnH͏�P/��e|��E,�`}�S+���ϩ���(-Xur��R��g����Z»X_�([�|�bX�I1�8�N��y�`iE�����p�����sj����[�KP3"���23h�{sn&�e�T�ߋ�GriI�>J��Ε�{Z���@�6M� �'���lA��Z�����a�43��7�9,���qĬ`.��w������11�0�$�C��0�w���u�����-o}T7^�k`K��b&�N��Tμj?�Z�A�,!3o�`�&4v�KT��"n!����㽁�3 �����8l��%q!���9��{�K�'���?C ���Q�5�K�J���|v��1-~p� ��/�c'dC���Y���C�ۻ�ݔ����t�S�ik#��f�9W��E�[U�ԑ�4N�䨕7H��17�(�]�����~��O��K����O4�,����� ���P��)ĕW�dg�T����,�!H2>r]�[f�n��M���������soW����m7���.����jI'�ޱx����Y�)Q1٣��i�]@�1�g�<�N���V�"g�c �:�"��n,2��9x>��`�<d�l���.�n�O~�0��γ�2�>����?�s����Ǯ���fH�O�Y������I�D)�1z��AD��p|���"�.>�) �91C��[��:6��V��M�����}�����B�#�zt�s��#P)F��E�RBn >�l'R�p�95{���JW6O�m?�_�� Ze�X���km�r:/��i�3����T �QM��H�LHM��Z'���(duW���ٷ,˷��E�d2W���we���j~�X^G�of!|8�$O�3� Ob8��#��&Y̮6C>B
Behavioral task
behavioral1
Sample
93cd462091fe524e4806a76c66582d2f_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
93cd462091fe524e4806a76c66582d2f_JaffaCakes118
-
Size
3.8MB
-
MD5
93cd462091fe524e4806a76c66582d2f
-
SHA1
0b53242f6f46ffd27891818db8ec7e8c9e501d3c
-
SHA256
927b7259df63fa220f42762e8e179694fc25f5547b8266ec5b4a81d2e802636d
-
SHA512
e8f12beb4956803005a77cb3b2f297322d0e2d918eb7eb428a9130793aef9758a86db33d081244d1c3dad34735e1f7ea495a1061bbc11b3a70b027431ae1d2d8
-
SSDEEP
98304:6UWN8HpnT7Ie1SKoW4b6Y7V/1dctKJTC84kko9F0T:E8HpnBI5h1h4kkov
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 93cd462091fe524e4806a76c66582d2f_JaffaCakes118
Files
-
93cd462091fe524e4806a76c66582d2f_JaffaCakes118.exe windows:4 windows x86 arch:x86
efbcdaf255aa8d9ade239d99d12ad196
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
psapi
GetModuleFileNameExA
kernel32
GetStartupInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
shell32
ShellExecuteExW
Exports
Exports
Sections
.text Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE