-� �I7y L�v�*�x�$��ǖ�7(B!렼SsY�/������IA6�5�����v6u�@s�s}��/�8!o�����1�y��dR&���|mf�bu��NPV�@�0�O��Hn�rϺ,�?U-S�\X��O5��m���~.�%���W=��E�SI"�Mb�)�P�|�dS�6Ja}I#�ҩ�Q�k��]�r6!�U��������*-v�P����E��Lz[�ȗ��&�KR�q8��E =(������d�����=�FJ�7�Rp��}+!@�h�W��eV���V�7?��ҬC{(Du�_��ʵ��W���Qəe��_�q�ϥ�k*X��ͯ�t���k��1}�`d�3���t$hxY��&Z(ѝX�3�HNJ@�⾰��h�Ί{�)�Z����0�3)����� <�\���I�X��+�k�R��+� ���#�fm�8�����x��qQ�^�X��}��1��Ԋ �Ob��;a3*�� �1BZ�8>�'|�c�����~��zo�9>�����R'�n��5��˯$N����ģ��H %|_v��$osp_Vb��zf9�s,�s'�XF(g��h�3/����ԙ�%˟l�黮 ��t���5���<J��_��ta��/�.zm����%RJ;���U�t(�#h��'(82[��ϣ��t�.���QT/�\�̏5f��(*�3���{�m���Ђ��ί�z�Ü�p�*����� M�_��!`+�`�$ۄso����*���2���|�� n�d�y���f˗6��Kl������um��8]�%H���n�t �.,�t�6���\eû&2�E��2=�+�ߘ����B^�&����7DW#���+vNꚼ��7��B�fn�-�d��<ꄡ�AM���<?�ȁ�"`7w�ً�(g ��Ն%�$%A~��k�-VqI�U7C�&��U��x�;OHC=���i#y�X֧g�_��Vc�W6�r#!6~�96�39_�U�}R/��Ȧ�Fi�=�V������a���i]y�0�t�#z<�WA�rc\����t� �y{Z EW�� q�}�����$�L�ܨ����e�:OрX*%<cf��ya�Q�,k�*�N>a߄��˺��}8��,�\�0�v؞܌[�R������1u�*����v��j;u����2�]�_ތ�)^�D&��{�k����M�'�Z��k�DNe��JKW�Y� �6��,�����c�U����1,�Eh�V���ؿs�cF {v8�j���Z &�h��'��Y��)��G��i�`�YJÏ�`�%�N6�g�������WB�j$z�� �نp���Z�\�9���O$��z4��/����O�U7����s3�/F����?ĸK�h�a��� �zXUD�¥+����u� �U��{��4������k��۪aH$�, �����ï.s6p��VVv�G�Fd��B@�N��O��|<��P�DX�ߓ>��sH�k�W83�h� |e�F�~��m���> ��R��������#9�r�q�) �=B"���k[b��"��3sץ�K��d���6|.,m������c�s���6�#���ֵnW���k��J̶:�)��(��ڏHE(�d�#�C��?pzǻ��+�u�(�aMɴ��)��!,���O�諨�u=kX�U�Ͼ�~]�>��*��M%)��IE-��H�<�Cñn�ޟi3�)�>��8�!I�Ot�y�`�����r�ښ���.{Acq�u1*.f/�s��G����ve��?��n]���V��!�"�`+!�vIlG�X9��!�Q�9.w_FseXŋ��?P>��O�t��~���U����S���+�-�y��f�|=�Ið8�\�%9�:͕b7B��B��_݂Gm�!�߁���)҇�űt�)�_,�Jb���Z�l�|G�9r'#`���� �[[u���^rT���G4��ʫ7+�qM���w�\�ݚ �&ě���<w|eP���;��X��.�ȓ��1�O��t��W?v����^�-��N*���t����k�xߖ�a�1!�(�*'w�x����}���9l�)V�bp�݇$��MP.b����=B�);L7�N�kg�����7_���|>�Orá�Rx��w���{p$y�S{��I�"tYh��|A;tP��Ů���:sE�x����wE�u�V�I�Y3�ޅ ��0)��B�tP���Q�y�< � ������s� �q�b�(��Om��i�c�!i�E-n�����<��C��G��J߆��j�Q�:$sh��lS�̙FX�W�4��+�s��V��6�jO�v�f�"�l�`��!����Q_�&,��>�wi����)��O;� �ȫ���%�`t�5��f;�Й��#@#h�FCB���mJyS �<Wf�{�������������q�W�qΡ| ���0��o �]�jͼ�qT��o�L�g�&u�s��'Z@�u��u&�W��xO���#�wR��Arn�p P ���+)�����Ac��L�������O��Q:{��w6.VoV��Z��3���8�ū���ri����+�� �)�w4 h�����/�b� �(�G�{�G�o�="�gxs�0B\S9��ۏZ'����(t��<It� �����H�%���#A C� ÊQ���}�h�3 n>;��o�|s�RG���*4˝����0b�C3n��T��h��tik���� �dL�\���o�9�ߕ�..9�ˉ�vg��`��fş&������f��P���C�㮙���ꧻ���8�|h�+s�����[�R�Y�������@��3���=w0����.�Ζ\���~V�����N�� 26W�Ѩ�}�����gH���A��_��d= ��I��3�M>V��3C�V�O�P�y�\�d�ꛚ�#���l?���0`��s���e� ���A<@���i)F��T��jN�#�h*�`r�n�n�;�s^9���.q5Ƌ(`5��_{�t0��� hy�-̼9����T��M(�4D`g �U+�+�} ��~aku�z��n&��\�8XQ0�
Behavioral task
behavioral1
Sample
a358396dfff1362b9b8fab0bfbe090c6_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
a358396dfff1362b9b8fab0bfbe090c6_JaffaCakes118
-
Size
708KB
-
MD5
a358396dfff1362b9b8fab0bfbe090c6
-
SHA1
df11ab0a4b689af4a44cb86a475054217bed3404
-
SHA256
a213d1d6e68072583e8ab2cc0eb78e71f47bdff836fb58c12a930b80fbfa3373
-
SHA512
db4f13c802f6bb6df0d0be588de3773e88f0c302d5aea543ce5c7ce7905342f992535ac407130e7f39089b2b5728c520bb4fd40a087e4c1ad33b42f47037fed0
-
SSDEEP
12288:dO0xQ2iZwQsiGfNIxnCDLvR9tkkrFmYDl0Ib1XtaV5j:dS28wQpp0DLvJZjDWIbPY9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a358396dfff1362b9b8fab0bfbe090c6_JaffaCakes118
Files
-
a358396dfff1362b9b8fab0bfbe090c6_JaffaCakes118.exe windows:4 windows x86 arch:x86
82922cc468979f0c2bd36ef7601ab33b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord578
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 660KB - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE