��jm��e��FsCѨ��p� �?�F�MJ(_��.�&������؊i�����K�H����T ����$d�& �KB²�Ukv�K� 9�@bfh1\�u�lZ)A�Fa���k���d���GL����x�r� J�fC@sE~e$�����x����)�p��8���O�|.9��.�Au{UaA��|�n��a��=���q�=06�K�g�:�c����d��f�D���Yi�ǰCg�a��}n�OT(%�}ؒ����pG�}�����Ő���D1�z�]!��"!��W4-T0ݔb�����<}��(E���q��'OXSU����v�=�l��A�0�=v������a��R�LR��Z�'��1��n ^1�F*)X3|k]�?�Zs��Y�[�?����g��p�Y�`��ߍ���f=[�@ƺ�>wM�X�+�\ti�o�xR��d�9]�I�������#au�������,d9 �k��T�U�9���Y$��3�+��X ��<K���,]0�R���#3)A0U�yA,��$�����?����PV;�4���$S���;��~������'ݔUb�2p����oe{�b�E�N&t���Y�?na?���Ņ�fg�W:'�/��nGا(?E&�eH�8c�አ��N;��Z�iL�GE(����Q��x�)������x�) Pu��CbE�c��J�I�"�P����ϕ)���h�}Zi���Ams�8q��Nu���`����x�Y�]���TE��v����:�-k=峎�B��2 ֜�i�ʐZ,,!���IW[|��tU%$�P4lR~�r��/��HK��yS�0� �jz����kԨ��ޡ�#�� �7�S���Q��-ttV �۬T8�.���i�9I*r�������[�-��];��y��z������H͠�2X���S�ŘȐ[��K�I1��e +�G~ڽ�SGu�]�������۱d�V����.3��g��v�D%V<�2��Z������2��S29���/�O�".蟫-��6�7�G�#����r�x����k�h� i 0P� ƈ� �hyM�aG�ޜ���s�/'��ՆW�v�c�~�B�����j�sB�C����pU�jE�fi{������I��Aa��q$MUsސx�qd�ߡ�`�R弾be�^G_���8�6����Q��+�G���(w�n��d��H��#��)\rY:������L{�������%�'&6~�II���sͥ��Xn��t�fO����<��&������H����M-�V/}h�N�%`��䲣Ѷ;�(b���yn�O˥�3@w%+J�b$d���.�#��8���|�� ����֩"�����rR�S���_�%��Ȫ&���e�����3}�<F�ࢳ0��둄����Ѱ�i R �͛�o��������5��<�C@&һ����)��2鄝��k��*"��&�1��Px8���d�C.CF�6�Ѵ!JJ?���tb���T�J��GLhޝ]f���"���ď(Z��>CWRC��VM��(�� �� X5�Q��!�HbY pn'��V��H#� �C�SY�n ����`#\rn�&�%�ݱ2���}ys�4�L%!��'pಾ �!B��^��{�A�c���X� >�����ay��rPz��%�ݎӰ� 3���R��g�Q1�?B��u�g$`��Sc~�o�w˜��<O��~y��~�Vu�&Ǽ�P���c��0w�>mz+u�Wu �m����tae���*���fR1�!�@�� �u�����N0eE�8�-�q��.\���Bhd��Γ���'��ο� ��0���j4���62P)ܱn?�:��SD~�q��K~0�oװ��C�ͫ��+@�t��?�$�\�d(ѻW{g��c������Lڦ��S{6Xɜ��e�Ba'Xɰ_�q^����Y8h��o����h'[.G֕��+d����3<��- {�W���$2ͮp�_3[��A+���p��l����m&�(�j7��9g��^f�*_1���[+ǯy���x��Zj�"֮�5�>�n6`���WM��;N�������l�uc���� �� 'w���d˳x��PZѝv^y������Gr���F[���AAo[���0��ȵQ��Y|yr�XG ��� ���4����т�����m��?7o�3� �>T�����o6�n8����M���&)�%���f�v�F� =����e)Ovps���C$/�-Xɖ P髷�a87��[��vn ��儐L�n�~��\c���u�� i�J�����Pj� Z�=��g[�;Ug�3�J�ʎ���(}{�X�x/�ח��^s�zK<��2j䗡%E��L(��DXw������O��!� �Kg������9R~��sj0�{s�g�T�v� �<���U������� f��$���qX��4>�J���Dj &AZ.o���YS�� �'��b�>���a�9[�`}��:C����)S+�N��b�ǣg7�K�E&�,��̝F����(�@��j�۶����4�0�_��<��7�zr/ /���?�`�G{/��kQ�y Qw�t���1�\mٔ�v��t�� m���{P�0���CDB��,0B�7T�C�z�*��e��A����͒�A]O�*�f�b:��vŀ�&�<#HKVt���MQ���恌 U�</�5�0���9�/��x�L#(�������� �ec�g�MMA���F�ɜ��n���3���1���&!���/�i����k��-!������da47&��`b^U �G�.�p����X�+K�� oX�@1���ʡ���Ŵ�K�a��§wV�u��ϊ�Α\h��b&��K���J���)�|� ��n"%�S-�`PHu�W`��/�t�TE���D���)�|�3���4��rg�;@zz��PLC*(b��'T������kIA[9�D�+�Ú</fG�23~Oa����b��#&>04l�A���4=�R���_�)�����mV%���r��8�F��E=��Ƴ�������n� vC�/��O��k���Ms_2�������>5�¶��
Behavioral task
behavioral1
Sample
a29743ab9b9066edffea49ec97b6b787_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
a29743ab9b9066edffea49ec97b6b787_JaffaCakes118
-
Size
836KB
-
MD5
a29743ab9b9066edffea49ec97b6b787
-
SHA1
2200317c96ee237ec225003091013cb9b24f49ed
-
SHA256
823ebcec659de94324270a3aecd79eaf20c0ba523d32272c6ec9d928b053eea4
-
SHA512
d82beb53497bcc2589348accfdf9dcd7b669b12bee4eece54f9d1869c97f4b585e6f2a29420bf3d76a3786f9907546cf130be9f462183fe5728642522721dcf1
-
SSDEEP
24576:DlLA05o7RbJWSV8fv8MiSDITfYuG4y4Jx:DlLAmYRb4iIv8lSDITfY/4tJx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a29743ab9b9066edffea49ec97b6b787_JaffaCakes118
Files
-
a29743ab9b9066edffea49ec97b6b787_JaffaCakes118.exe windows:4 windows x86 arch:x86
2c17677d74924b3a97191f06bac1d282
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeResource
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfW
MessageBoxA
shell32
ShellExecuteW
Exports
Exports
Sections
.text Size: - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 613KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 833KB - Virtual size: 833KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ