�r2�.��8�o]e ���� v��W=w;83����2��rU�R����Hu���c`�lN��9sC���g�����O�[x��[e�q�'Pw� �Q��� ��@ �˷�&(Պ ;��S��YY*`�+X�gŰ�9��Ni�]YU�~������vktr��`;�Y���j�B�-&� ŊE��%Ft2���d{�b�ES�������K��)Ţt�M7���昂0�S?w֭3� |�:����$'�k��LwZDy*��6��瑔�6٠ ���3������JU�7f�䛊��vN9ǒ�0��aY���{��.`�a�!n�S<�#�}�CR��³c\�vU�ԃM; Ԫ�r��b&�G��Ҙ�������ѩ���w���bAtM�Z> �?^�q#� #�j?:��'���eM��O����/����'� R��J+͆ #� �.���QTo�7Nȱ�Փ�����b-$Vh�E�?�%�D�@��n�]�7%H����]p]xTG�5�������9�i@���j��SV5r4�xU5_�<�D�-��Lq�M�>�P��ux��E����>�W��b�INHM;���Q��oz�?�` Y[��� k,��e�N+2��C��q�4G �2W-�2�W�UYS(�jܵ�K��>�[�a���;#��<���/���p�k�~����E���'���㚠gd3���0U(2/y�O���f�AN��W�������6X���۷���4���SK�uSR�[LSȻ 6Q� �e!��2�}��;���Cf���\(�!Ú&�!��w�R:����~B���Ϛ^e���혘��&k�'~pn:��* �i�f��F^!H�������?:Y�#gA+cj���.������-%1��S~$h��@\���|��������3a���2�G����'c%T��v�彣r�!rQ�䟇=}N�b�̬-�\��֮��_`��D���1��\Pd&��m���z�>���4�Ay�F�.�7�df���˰8�S���:�Hsp�_Ү���y�yS��t�-X�A��� []䈅' �����W p���4I:h{������gD`�����U��>!�� .B�w#���F#j���,2�zT���N��%�fь�9*�-�WQ^;���5�$:�����kF�8p�Ss�(�o ���m�[��@۩�ʉ؊,�N�^�P����ǀ��ėol*��/���857��]�O Մ�E�(��3�W�!��M�<;ך�88�:ON�9���uM��������u�dI �u��f��άĞ���P�U���ڀ ӭ$Y1��WHC/N���F�&�LI�e1�|k�/��J�l��� 6�e�u��O.��#(��-�0��YbB�c�����h���lh�b^T�@U(��عL��$��%$eU��Lt�Ĩ�l��#�Ͽl�Q����1������V��G�@�<��x�����m��g.R�5t�u�j��ϙ�2�.���g�����B;�v�1\N����&��3{�� E�M0o��Ö�ͷ�p���Befc�p��ͳ�LT��(f�xV�z����㻬de���0emEE�}V�č2���n#r�*b/�Ճ�|I�I��Θ&�r6g�(��h�⨧,�_i��6�G��\#*?����N�"ץϼ���)'�'٧G� _H;�,IX��jSy������4��L�D���� �Y��yS� Q��I���Jq���v�9��f�qq$�-Kp�jF[4�g����Pl&<ﬠb�!�R���wx=2ʻ��밭Ɉ���6���&c����+�t�,�g(�n/����s|X�h�UG�c�tb�9*\��`�.�sV36��Ц*[,�7��Xg�yU����M���P:~$�&\ �j]��^������j�E�������q�7�P̈s��ي���[�A����k���?�+8�f��zf�gN���7웾��+&_��|��.X��E�<�Tq�����,+w�l]��;��}���m�HG1��ٽ���1��F0��\}���!�+E:����mIn[����x�J��b;�UV�����8B�&~o�s̫����X<��B��K@`�����25E�⦛nDRDkz��G%9̈́�`�B�7���@��g�����6f�N��K�����+I����M�mQ�ys���z_Xi�� w˚�j��'ֆN^�pʛ?���w/4�F̭��%�P��+g0i�{�����2���� e[h�I�9��h�$�Q ��孧�r�i-�W��c��ӹ��_����~f3�аF b�P�aaFG~t�i�"��=��)��Y6������#g�&� ��D���D:%���.�@�z:�âR�B��.�� hB�\�t�M]����Xq(I�-�DO5�% 0��;c��+��j�wy�U��o?��d.8x����(��S'͵9o�{��~�V8����wĒ�Kg �p���O�,�r��xE�J�Ż��M 3���CD�[x�� ���Db�� {����� c����s�o��0���~�_E*�#�l���A��M�m���թJ���:�7�c��T�Zy�����ԯ��l��R�'���J�#�B�n��?��"�� � G�B���qQ��"��"P�s�����a�ak(:��0���v�n���Gσތ��,�����a?m?���D�I#R�[z�������v��R������BxX�Q�����eź�+{� f�"������y�T����!������a� �*m��Qҝ� {֞�̅�և�� �W>��,��w\V)$��lܶ�}�����vIÖ�]��~i�;ê��cP�%_$MX�g����~���]�k�G4"�5� ��� ǧϘ6z����/�{=�� ;f�|��8i�]:��%T��~��F{��l�Vc&N��#�k�[�`j���*H���8*N��ʼn���e���(��j�win6�D)b Ǖ�X����4n���ʰtV)�VG��r� O.C��[:�Ms"~"�a��9*/$�>:y��
Behavioral task
behavioral1
Sample
a380a8c64760dc2f7c1db90d3186891e_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
a380a8c64760dc2f7c1db90d3186891e_JaffaCakes118
-
Size
824KB
-
MD5
a380a8c64760dc2f7c1db90d3186891e
-
SHA1
51b1e115efc4f8741c947ed9160dc8b6c89c92ef
-
SHA256
5ab816a7b665da6349c47d992dda821008f0c0337623da4535af5c68d3207496
-
SHA512
b87321ad919bf63910fbd5391978fbd3ebd700ccfc8ce4c5738b5d00f9c39a7e6d89c57f574fc2cddb5320015e9e7766de64b2cd2b5ffc87dd56cc72e43a607a
-
SSDEEP
24576:C7ffZcRAc90BjpmmRUIpAtD87KDrFVzCJkGW:wf2DZmWIkD8irFVzC+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a380a8c64760dc2f7c1db90d3186891e_JaffaCakes118
Files
-
a380a8c64760dc2f7c1db90d3186891e_JaffaCakes118.exe windows:4 windows x86 arch:x86
b5a6a25ad48910612c3a815d19d761e9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 653KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 784KB - Virtual size: 781KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ