���e!���m��5���?�*�g���B��^���B�R;u�����o/���5���6;(e,����Q�X��UC,?��0�䁉�����ިS�hk�%�� ��V�-���y!�?٦���X˓q��L;`c��9y5�&�� �۬\ɥ�mC�"r�� i���S[��z�U����F��ZcOE)訔�ٳ�=��Ӵl�C]��~�����I�/��j#��S���j��s(��g,uWkzVF�5`$����Tn�Y�?Bߔ�>MN�K�Ri�Ⱦ\,c� j�)�G�h��1GF\Q�5��T�?���_1� ���Z��R��` ��M�r2�Q�#ɭ� �*I������e5d�7��$q]\� ώʀ�W���Y��ܸ��a�+*���t�@OK ���8�* ��@/��*�:F'`��?�M�[�:vt��#f��AJSb �R�U�s�ҷ%��n�QT(5#��bKR��Z5T����d���&��Њ�Vt��6�̥�����Ӱ�!G}.�=���v����m��Q��r�|x�Rf�W��-}:1� �t^J��Z D�V �s'��"���ԡ5Zy" ��U����|p�(n�@��zؒ��ֵ�0�+��Y��뢽�>�d���^�Cd�[(�va�����3*;|�Gwm�[w�S�l�ι��T�-�L���S6�ɤ���<�+�zQ ��jTL0�+�l�:I刚ҕh;�t� �$e���'"È,�=��V�����r��h��4�!��FQJw����=���>|��� �4�?ys�����f��/4*"�H�Fv������'�� ��L��O��:����������[L �np#�l�Bc�2��=�d�B����B���Ʌg=����K��0~#z}�$g>O���U��1��K}�`I�u{!�b��.�W���eʠЃ�O+��w4:ehp�$*��L=�K��5�;�E�]����4Z��{��NSs�*A���q�Y�Vd���] Z�}#E�v�Z�w,C��1��z����� w�4�TD��8q�MKg�3q`ש�˛51+����ɢ������-1��!����Da��Xj��;zۤzmR����mLxtQ�|ya���_zS$5�ݍ1�X�ő���U�ǽ��c�����j��I�jJť��������L�z����j��R�>ז�!sI6������=�V�i���~���"���y��E�ֹgI��Y� �D�5�զ�b�*�k�Ӧ�r��A��˭a��۞T�*�4�6���Y�Iw�ʑ��+~&*h�s%�����'�c�Q�?A���@���<�6��� �=�+�Z�;/���p��z���-��S�o��r���;�bb��i0]2F��(�"�7���P�q;���n<B�L�����/c����:�J* b��Cd��a9��n�Y%��ڮ���[,Q��pt�M^4���7\��y+;�!g"G>Ai�$msNUz�u���s��y2����? ���)sBT����u��#�yE�7��G����5ei����b�-����ϰ\yR�?մM��Eb�!!%�0���fH�sy��J)X`��Ĥ8�#�������lWI����q���Z�L��m��Q�q9[-���߱���9`G��CZD�D�Rf���tѵ�_�?�?FG�(Yjg���:C#ua�t��Q�o�yD��t8��%0jPZ0��Z�r��$&F�����y&˪8f�Z��k��bD�3X!W>�(�.;�������w*�[�Н��"�k=�Te�|��p�A1>`����� ��]$��&�#y{��e1����+�w����_oB���B���g.�1(�E�ڇ��6_�x��{��L#* `ȶJ����ۮ����Eu�#�ЂZԠ�LO�1�Y����V㾭��{�8@� . ��>5���C�S��@��I��0�Z�}�QNk��A��#P-��1���S��z���>KNoq����b�c����3ܴ%-�R��nQƅe.��H�`�(�5-�'[�^L���N.@��O������L�ܯ�?GXx"B�5�8r"��"zcKm� ���1l�Q�m��A6 ��������+�ֵh�7��:{lU���)���ї���bܧ��S�f ��?�[s� ���f7����%����8�/1S���ɬ���#�&H���N�����$|v�:HW=.����^Ik�3��F�e��J�7�����Q}�G�2\�%�z�2�X����2 m�Y �g3|��i��f�����c���d��QBv%�u��w:A�R�(m+�'��@#�|�`IQ{�j��-�}d���O�d=�Z��AZlӐ���d�����ZP,�_�#w�4��� �Ε�ڲz�C�a��ڈ��؉�黸[�9��/ʰ��}��ެ��� �L�l�����8�!���g����`�[DT��(�싨4� ��ť��v4V��� Ƚ����h=�G���qS������}P��oߏg�S��]#ϭ��-���m����p��T�8��@�Łqu�veYRR��qW%��2(Ж4E�u��jj�V:��By��������_�35������-e(9$2��8Ĩ�R�9� ��էZ� ɲt|��~�����@�,�Q�@�Q��=<��K6��#�Oeݏ56ˉ}3��BsHn�����������_t�^��o�/�4A�ٍ@���r��\0p��<�eh��<�(��ԯ/���� �����A$�|�3SvD?�;xCP�[�mq$r��i%�uO�{� ���~�� 7���:a�K-�~�uH�0:�6�Ŀ�( �Ug�uKS��������cxHah���\�k}�=n+X5OH��Z4��#w�z��%������@ӱp��K��?��j,M���ci{n3��.@���٢.�:.��&Ekda3�`˝� �~�� 5ˋ��6H�R~�BeXKpj��x�I�cJYܦVKI���D)���P.*��T���&�V9��Y�F�B!9���� ��rE�R��_o'S�]�d\YZl����&ĺ,��D��^~zJ� �p)��
Behavioral task
behavioral1
Sample
9442d9e90f053a9269ebb9c07365c784_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
9442d9e90f053a9269ebb9c07365c784_JaffaCakes118
-
Size
728KB
-
MD5
9442d9e90f053a9269ebb9c07365c784
-
SHA1
0c37177af690c62b382818a3a9d070b1c2421159
-
SHA256
b74def68451fae3a983e9ff510dd17380107ea5c07aeb96f1efff925ff2fc011
-
SHA512
d10d292e1efeff1391fc809e8f8bd97ec60207369abbdd0635e36107aba35cd3a9075e79eaea65cd7bf38a4a9d3991a9ea8ab36951eea4f821803151b5ddfbfa
-
SSDEEP
12288:jEi45JOl/p8G6X4Yl38AqoP/W/aN8buZRcuy7Qb3y9FX6OdGh/1yY/jGH+Sc8:4i4I/p8G6X4W38yP/Uw8c2qM1GWY6HnP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9442d9e90f053a9269ebb9c07365c784_JaffaCakes118
Files
-
9442d9e90f053a9269ebb9c07365c784_JaffaCakes118.exe windows:4 windows x86 arch:x86
aa2023af729a28e2f0380307022a466c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord714
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 716KB - Virtual size: 712KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE