��H�����t�8��In:7W<c��T�%�(@ٔba?�6�����K�����s��S��cC��&�0�/v>T�ԩ���M��p��c# !f��|�^֡������@u{ ] ��6]3RH����C�j�%F�<�Eq������E�%�uf;�Y�*�-R�;�و"yM ���[����7�)�&��Xkg�a×Y�S�B��.~�ģ���\�z��MH&x�|�'�ESFx �|kY?�&Z�kw�O?R�퀵�=j�)A�NZ<��X�;�@9�i"_��(|�v��N?���1{Aw�> ˹A�H�g1�߹�gڇ'f��!]�:�ӳ��{�s g���v� �`f��b��F-��:e*�A�ng���-����\u�����'�����;�{�UI��qsoo�.3ۍ&�ѥ����'s+��KSa&���@�ө��t"���o�J?�w,��nm�PY�f��&��(�,�ˡ ��0�q1��� �ȤO��?�p��������:�a�!�/8rj�b�M��)s˶q��f�>}��1��џn�6�:���Ff<��aà�\����]�_��k�- \��4G#뭕��#S���٘�ո��p7�>�O�`�1<�ߧ+(�yf��Vwi�\�\b7�%��U#��A�@80.O�/�������ݬ�jP��Չ��&�b<Z�j�`�+����~J�M0,w�ϓ6��o�h�ë�+���G�Og���6IW��H W�@�U���Ob(5S�r��9��eT�ʩ"s����'����6�^�C�����`�-��E�����n�Y���8SR�s����r.��f�ž��#����������0�F`Ѱ��Zլ��@E�]�� l�E�G#^��Gvu�ur��>4L;��yK�"s ��He����Y�>�����B��-�TB:�����z"��D��Кm���wq����J�IQ���we��6��|�����,/�-��i=�Έ �dk~h�؞I_o���=���|�����Z��w�n�7�l�����(����e�l��(�ֹ-���[=�<f�f����w@�2p>R�ݙ��C�ײhV;B���r48���]e��ji���A&PO�|^�1����33P]��a�zؗF4��0��dL~���ad]k�����0�1�~m��"�Lz�g�UC c�/�zjʹF�b����Hq\����n;k~�`�;E��^l�����l{��%�f|X'�s02N�gT������KR:�`����?W�m��S� -j�uk���1_[�rgaZ]4�����]���O`i[�����������"�{������� n���'�Ĕ��}�ɒ���fkl9ں��&�M�Ĥ�=R�pX�!������גLUAIH!�}��>�"���\�p�;r����x���Z P/CR �E1�g8Ҍ ����Pv��ޠV�ћ � ������zO�3x�)�1��k<�q>U�M�Dv��۠$��z���:VHc�o!�M���ᭈK�e��U�-=��Ry�\~��yŪ��*>���ɣzIDR9��Ȇr(����yeA^�A%E/,b�u�<[-���iċ����v�O�~�=�_�J��z֡�i{��>�`ɝ:����H�v� �KJ��3��8�N��ٽT�M�&�u��~nEse&���*�Q�hs�! C�oP��NhN ���^��g��4�����/��z�3�'�%�J~;���*���F��>�kf�{�Uu?�<E̳M��a~��)�[ū lE���B0���� N����#��`O��* ^fF��x2A�$���<m��}kB����J�%=���=�ݺDҢ�A�X��|%fI�?�A�B\��R3q��F�t3c��^y�-����*@��e��ʆ���M���o~{�9ا,�w'n�D30��Hz'�@�'��S�5�^:���-��&��2汅z��*:���FY ��$sC�A�@@_E�@��{�-J� \�{K��̇QL$E��,�L�h*������I��a- *�xr ��_�PBd'�w�>�姖����ꬂDb��U�W>���i���u{n3��c+��N���� �����!���J ���/�����¹aRGV��};�"p������u����rF�& EwJ�Tb�8�qU(�)% ���au������h����P�N��x�9�m} _��nB9�rӂ=�HA%��||Н2F9c��G�Ls���ʰT"��H�W��2�Zcx}���3�����ϛ���t����<ޟ��>MdA�Q�2�?ܚ^@�?��?t���Xh\f�㥆-)��Ɓ�7,�ڇM�2��zq�� 3��ܢ����B��*��R鴆��i�w��k��Y��?z)�<�p��n�����)�H=,������Vְ���f� C��ζ@��6:�M��քC#�/��>�����>�ݡg8V�P]��ݡ��N���.������� ��*+���4�Mn2�da �"d��T\[E\��Ρ(��v�p�}��2(�z����1S!FVו�,0 #������"�53G���w���j�ުk"����Gp�t�.d���p�zP��s8iZD�� �d��v���[O]��rH�T �Ѿ |1J�O��`���C��˩*`E, �н��Hl�-��x�OH"�|�UW�?�(����ԡ����MX�?!�.1��Q��:��"������������agmE� � ���Ih�p��s����[�<���{�"�A�;|ϳ��MD�ԁׂ�D��������)��)� ���*ӲF��Z �%`\�DH��oͯ�5=��¨o�1Y�5�T3{�y��X�,k�W���L;�aO�-�~���#)�N7"����YD�G��F�S�m��<�mOWQ�'����u?l�����)[������+|��Ud0��^O�m;�xgb����m��!>�S��U���Sv0��J1�zV���ٱΤ�s��챱4k�������+���Ⱦ�R��>�[���8���.zZ�yo��V� G�*����j{H8�K2�/'�8���������~�蘋t�V)c�Y�
Behavioral task
behavioral1
Sample
a0bf90bd53258d020a1221cf40c1093e_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
a0bf90bd53258d020a1221cf40c1093e_JaffaCakes118
-
Size
1.0MB
-
MD5
a0bf90bd53258d020a1221cf40c1093e
-
SHA1
b5b4b260fa7a7c4a83026e35e655897e18ab1ac9
-
SHA256
a2c376da1741f8a891be2156342fb35fc9116f5188a623740aabed5bfffe9702
-
SHA512
e7ee7540ee9ea27d15456048d3d103938accc10aa020d2c338b757e1b2461504d80fb92a73ae6bdb19b7b6f028b965630ec33c8704f4af4fd65792e677228c43
-
SSDEEP
24576:JQtkOKHD5G4fDSvJHK2i6oWhkIRff8YileJwSz4UT+Yy:JyTKjrrGHK2boKkU8YilOHMUT+Yy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0bf90bd53258d020a1221cf40c1093e_JaffaCakes118
Files
-
a0bf90bd53258d020a1221cf40c1093e_JaffaCakes118.exe windows:4 windows x86 arch:x86
345b70f58cbbb20a1acb7fdc1e70ebb0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
accept
kernel32
GetStringTypeW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRectEmpty
gdi32
StartPage
msimg32
TransparentBlt
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
SHGetMalloc
ole32
OleFlushClipboard
oleaut32
OleCreateFontIndirect
comctl32
ImageList_Draw
oledlg
ord8
comdlg32
ChooseFontA
Exports
Exports
Sections
.text Size: - Virtual size: 663KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 354KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 308KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 374KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 968KB - Virtual size: 967KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE