cf�9e��D� �O�"�'�#���e D��L�鎸�ZX���=�{�bfT��:�H�f�@�LKKR�������%��HC۩����d�<0ԚGUP���D�)Z��E�b$��P'��r3�!X^�(c�O����Sl(2������ѡ�%�v��z�˟D\���9����(�Q���)�����Gɛ f��p�`�`f�����:���Ო�]w������Mթ�N����k�S���@������"}3�=!]��;q9W����R��-؊/IY\�oQZ�R��: /���-Y���t7��������8�(�j���Er���w$�g*�G����r�Q$Q����ܭ~��cA�ȍ8c�e|I��IJX���,�rb�aa �"��:o�|9H�����C���t��IREN�<J・!Hn�:��������4IF���q��:�0�h�y"8In�뮺&��L�ư|l*�+�hx���4Ϩ\o0��F���u�i<]s<i?�:�� �.�9�d߱F> L�Dx�4ܘ��d�5�\<�9�x+-J���;�6/��i{I�:���u���׆�/ ?BP�8v��Am�ȼX����<��.��������e}���kLN̔���'̍� �����0`lTc�ڤ,ՋY�5>އ���w�z���/�L5J�g��+x,:��I�Ŋ�����)� ��>ۄ�ՒO��F-/r�mR��bi����p��sc���]�䶧����ߍ3q�p7��'�����iׂ7�l�\Ã�� ��Էc��Ƕ��XT3x�\��r˵4Kp�L��@ \��_�-T c2�qn7����ͽ&g� %���6ȭ�?���I���"%\T��=�a��� �A��yo�d 8� u��[�3ͧ�gv=7�L��3Z�;�Z��,�g6�6���a�QR� ���q���C�:$��"<5��Z�R2�P���I���1�حg9�vR����& ;G2��`�6�� �{A�-c���Ӭ��}L�V����nʂ��!w��=��P�CQ��ͤ�A��`�R�%f�'�6�2�Y��C�WQzrDV�]U�����~0��p0C�`�Ȫ�6A)��B�yQ����w���jL�����ژ��Vn^���%�i��p�R�cm��h��eF�k������_bz�IuHdA��K}�]{E��LZ� }�YP}���1O6����}�]G৻��E5�e�/�)�Ӟy�Z�9�B� r�N��v�IJʆT�IQ�ʈrd!��ys-��;&u�����v�#�┊Q�дFgF�*��9 j_����Q��h/f���=���v�����A���V�<�#�Z�ސ���m T�2v�����P��,�Ǜ+��o���`(������?E$�F �U ���o����.�\�*���b�#�]W3}5���G �ȱ�s�dv�������N!�����P�Rz�Y)t�������q=�鞡�r4L�g�\�vؤ}3#hHck��K~T3�����X=<��I���I���q>���A������{��Wލ�kۥ��"E�}��W T�I�$�^]w��c�����$�V�4��t/�ܘ_��ϴ�c��BH�1X�גɷ�b�8]� �i;{�+��+?�5cd�*2N�{*�����5t��䟷u�"�����| 7��Ȇ%"t��p��G6K-&>S9e��9I��*J~�WC��<���!���6�@|/l�����`�����v)�.ΐoixXm}�:��Ӑf��w8��� ^䏏�Wj��a��6~zD��|!Vue�3A@#��5�@U��no�KA�M�(�Y�A ���W�8��H{jD����+��V���HHZ}1�;0B����:�u5 ̃9ث�Y�|���`��L,4��c͊���{��Ҙ��'Z���KX:��{zG� ��8�z�A���F���=��+ x��� (�$٥_�+��T�-G�^|�oQ��J���4'B���+ث@��D�i��ն����Ӟ��V�p'��.d<b^���X��HL h�r���Y1��=6J�߽l���&c[.f�!�ctu�T^��bv\¯���YȮb�Z�Â{��+`T[�Jng��˷�Ť�������N���c��m���z s5��ɸM�/G�����-!�tq��^�3C� 쿙WX���3��ތ�5%n�59Q`����ͧ�����*�q���L�����`�n���7��C���SТ�9���1������^}[6@�Z�fu�'`d�1#<��yL9�g�<���*�x�-��s�ҽO� �������{��U$��O^�m�xp� 2��lw��V��W0"��%�R�p�UÊ٪Ѷ�zU��E��tD0�x�[�s�M&O�ܑ��z&G�4[G��u��$0�������xҕi3X˝�g;B��䈁�kN)�S�e����A*N!��ޤ��'�D?$�1O��n�A�Y��,�ԯܻ5��1F�|`#�n�"� �涃]����k�-H6��ѳ�����7�������>���B<��!��8ZN&���t1�Q~"���S�J�NI�Ȁ%2��PH�/����ɵ�8~�.8bjϬ�����c�ֻ<r��w�yX�2n<��J^�,U}�~D}#Z�=��rO[�ܡ��Ѽ�p�����Q����e6�����U�b����0���)�<2&s5G��݉�:�7��ɤ2ɠ?h���)�nN=���D6���6�O ȐP��zG��E/��ܥ}H��,"pTʫ� ;�{�<B�u�̺���z/���\;����-�yXz'��$�]�AA���\�F��!h�䫙��@�=P�m��o�<l1�&Rx�Y��^��`\7�|�&*S4'�^A][GA��3ژ�1�ۃ�fet�^xK�O5C\����L�.5C6�S��ˉ�t[�O_�xM�T�m��3B�`j,�~q���x#��%7�����r��L����-;����a=�R�y� ��!+2�43�?�\��[��S�%�l��*��d��Ek�f� ������xB��\�M����U-�
Behavioral task
behavioral1
Sample
a2f929a88967a49fa71c8634ae08e501_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
a2f929a88967a49fa71c8634ae08e501_JaffaCakes118
-
Size
732KB
-
MD5
a2f929a88967a49fa71c8634ae08e501
-
SHA1
3755b358bcc94d2971b1bec116b6aae187870fd3
-
SHA256
f31a6512985f360842c02adcb1651cd41f76455e932d2cdc42312e07310a020a
-
SHA512
c7ea89329e513fc0580a2e8583e3e23cb70902437f63bdaab43c35f4d053c5b0bba60e39a57095b583fa34e8ff8112f6f9ef39fb6371c48695f150dbd900141f
-
SSDEEP
12288:6Q9Ao1j3QmlNA+FE4MVjtbgYoxQAXzeqFLNv9GKRUBAZ7:6Q713QmltbS8+AXzeORv9GK2at
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2f929a88967a49fa71c8634ae08e501_JaffaCakes118
Files
-
a2f929a88967a49fa71c8634ae08e501_JaffaCakes118.exe windows:4 windows x86 arch:x86
313181f4bc1668e980805e24afb8ae6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord535
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 720KB - Virtual size: 718KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE