9�~��q(g/vEo@�6p��m�z%�&�����h�h���p�T�՝�5����&y�vl��w�7w�a±n!] ���Y����=` W^�ĉ�r�O�d��=��x�ԣdu����V6 ��[ �D]���v���1%�z����Ej@f:���Z�߫�����_�a�������?b������� #�%N�w�2�o����dT4V��H���4ȱ�8��r���9⤩р�0.���x!��:�v����}��_��[����֓7{Z1@+�Z�y���E��)\�%�+[J�� ��QM%kR�({S>{��ff�G����Ƌs��v���:��0�n�n����?��p@�tp��>ᒆ- �,z,�x��L�O�R�r�fL���9� ��*���f�ķ�zg�H���<�L�s}��z~������M;t&pλP�E����%2 �[��c���!�w�{��_p�qb�]5W£�a�o�z~�����9�1|F����R���K��ٖ��(Z�Ab����#��$��q���)RH5d����b��]���?�G�yZ�)�5]Uwp� )U�u��I�[��������Xl}�t�����N�@�%88,#�ܴ��>7U��ߐ�;����Ĝr�z�Mo.'��N���/��u|�QZ�Z�� �Ah�̄E�����y�N�Ϯ��ൎ��L��g�DM��g��hX�������s�ܲ�3ק�ϼ��#��Rc��g���&e�˼�lP�`�bO(ȇ������KrpDb�IU�G��5Gd�DQ�� �SHŭ��/�>����%�J��gG��=�~����e��zh����o���/��b�q���%���˔�=����-�$+���qu3-�z4�a�Җ���$��us�-CR$�5�bDaF�Y-�2�����DN-��Q�Ê`�&�ӖŃJ���jr_����;��8����G��J$��J�i���ݩ�(��w3���\�8���h���7%9Y����hhGX��?�3�RD�$�ܟ��?+)o��}Ts h̗d@��E����i��l��ڜ��+�oe�{� ͊��A�[a������˯,t�����d��%���E�Ƌ�G��s��ĭ�������|>�~4�U ��l�� �f�� ��:ql]����w1�2v�Un�n��� ��jȟl��� /� ��Vf�HdF6f�Ev`g���-�X'�-����̽���4us�� ]��z����*���@%�@ra�8�'q�r�ZI��n���II�����m��0� �Y�����Fz�r�{@�k�t0k��sVzN6��%�s8�BJ��29� ���`n ���E��q���%�;z�-�b"���sN+��c���\AǍ�e�IM��Vdw���g��J��֛������>�ꇁ��d�N6���x��"7=�ҌA{�9k��`ktC�x� )��m�Ϥ2 �30��-��v����?��&O�U�^m>�fN^Rs�býS����V-�@����Y�K�2�an:��`���8�/�Z� �!��Z��X}䬹�)>E6�OL"V�s3��u��=��q?`�;X�E��L��h~��+]F�pU��5;#��U�=!��.a'vJ��f�����W;��lZ������H�q�x��[%(]d���?8�&�ћ��� �v��5�����O�C(�8��@:�WR�ԉw�M��9@AM�OLrr�'�I�jGm;� Mb-\�6F/wu��ζy8¢����T�i�2aY���ru�/�Хլ i�m��R0V�`Է�'�����)9��o�}W���/^�`�Ԕ��o��D Z��a��F���@�)}\��:���փ�����p$�=�^��;y}���#�Do!\AEj��d5����t�b2$�ˏ�6���3��gX_�>��R���k>מ�+��5��pzI��t[�d�bZ���xm�i�_6�vbVAՊU�وDr(�vi����y��������Ey��$b�N.�����-��V퓲�L��u���X�� 8���@V.�a>��j���`dz���/ �y)���Q��\?�:���M�<�k Z���忔����}����4��ELP]z��ꀽ��ܱ�13WX�g�DaǾ[��$�s��*�أ�-��0] �j��x_��c2�����J�}4�i�JT�5� ��%&^�8��pb�U�C3�s@���J/��N�������W�*�@�]&�xײ���I���w��=X�-�Wy������q+�hJ��*�؈�������.&WD�ge;A���s��x�-1W;���Y��$���p��j�@��b�9*��o��C�!Vt�Dz���4{7�>*��H�I�E1h�T1�����͉~����!���d#��ZzL��ڹ[�ȷ���d�:?{dq�NK��GbUtR7��ݟ<�v��*�������C��Q���<���m��H�HdӼ�!d_�.��� ;h���T=x]��x7,�q���o��3=��:B�ѱ>��ݪ�-�m����[�&�Q�6�n �2�ח�ZͲ)u'`c����ӍAʅ���UM�q�����G�?���� ��"Y��2���S�����<�$w��Ը��T <F=�Na�1�s��Y*�]�{�ι`ns1�+'�e:F��������F��"ϕc �I��/��}���+�6n�yW4p�� ��^��g|2b���_@v��',��ۦ���Z�5��RK�Z����-Y�g��J]n�0w�mm���0bڤ�;�J�)�I�F=�ul�9GK��eFGT����lf��&�+�}���#F�)Ί����*V�QN�҂?w����N����5���^>��z�D\M������]9x�zgA�kvK�h�zR��D�0��َ�����E>�)��w�#idC(\�HZ~�{���2�ō�yv=�pt8�wZ���b[�����׆E��2���8�Τ�A�|�u�Q�7Eޕ�~�Q�K���_35픙V�;ّb���\`�����~�� rb2m�-ֶV����X�B�;��4��f���,���@��]�^EdWyfro����{�4RTK�r���7�
Behavioral task
behavioral1
Sample
a0c7cec8bd61eb3cc967bc7180873b8a_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
a0c7cec8bd61eb3cc967bc7180873b8a_JaffaCakes118
-
Size
704KB
-
MD5
a0c7cec8bd61eb3cc967bc7180873b8a
-
SHA1
326fbe6d06f5832d9ea9f3e54e1f281db4ec2216
-
SHA256
772944a819dd6458252dd54bbc48f0013c81b9aa6e9c495961259d72b30cd299
-
SHA512
4c6f2dd54e062b6013218a1710ef96163338300d0b7586ee55a1d862817c6fbd68c908567e6385d77efa5f7b7ad9026e763ddbc855b89ffc2dfadc01ecf657da
-
SSDEEP
12288:Q16Zf0rOdX5Y8ofVt2v5Tsh//3WGvEPPdoAIGmGiewTKl8BYzuzhc31r:Q1mf0KdXIKBTsN/34mBGIKl8BPcZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0c7cec8bd61eb3cc967bc7180873b8a_JaffaCakes118
Files
-
a0c7cec8bd61eb3cc967bc7180873b8a_JaffaCakes118.exe windows:4 windows x86 arch:x86
376dddc8e33c4e50ce968f2506829425
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord711
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 645KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 692KB - Virtual size: 688KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE