OA��0�/��Y��:�˺�'����'#`q�f8-"EWA;-�_���A���U�#S���_3kIJ*[�Y���^n���qz�D�7�[�9����Y�˺����L��·��I����,���8F�[3�U�X�%L�5F w��Hz�N��5�O_����w��(�9;��O!�������Y�'6�����6��F��r�[�I��:�t�Iq�a8O�, �rqPd?�乷�8"+���u]Ǔ���ތ�0;$��]�d��D�,���ع=?�M��YcX,>�Y|(r?:s��켽��6��M��C����ۈ���u�?u�E"f��)ԫ~��A�e�b0&R���"]���u���U�GB9b`�5R�/�����&�����3��cfvͮh���5����0��.��Oo�+���:���=�c�x`��H�≕�J��?���!�b �u?nB����J��l�|l�T�[�����Z?4�T�xۣ�Vt_e#������%�48y��r7�kGNJ8eA����YѸ�f�]�Rl6ܱ������R9���b�^~��U�T�TQ�bOqq�S&�1b�:1H�H�M�&\;9q'��$6߮<�J@��n�0�z��C�&օe<׀���wn/���6�ϾvpRUu��[���4g�=�St7�-�������s+4I����#��ߊ骫מ;�u��5谟��]��쎰��r���x|�xH�)tzG�H�庒D��on.$��*��HF���qO�b��������n$G��˔G��a{�-i?��'U��-�FK2 ,E;]���' ),>��E����{' ~5��:����J�8:�\LB���9᧩�E����������� E���>[��y��XR���9��!S��7��6`��'l\o=nr�^V�`�Tg�;��a� ��c��(�en�O.ɞx%��Ñ#���C�c��a���n ���@j��p��omM۷C2�&��t��_}�Ed%@� ���ڨ �n�U�L��%����m5g9�`N��`/�4wH�~2.��D>ewN�������Ұ]`�=�~9[� ��)A�g�D�|"1ֆw�i6Owm����\���|��*>r��U��{��p9��Q.z��'v��W�}����۫f��ѻ��d�����dtӯ�I�;T��Q�\����D��T#@��"����w˫u< �3s��M��$��lm 8O& �z�X��-�4�� q<�Y�4���).�T~�Ɛ����P����������C�R�Z�!R��wq5#�+���Zq�A�A>�3�F%�����JTV5;��G�)�1�����(��Pi�oP���������AMQ��en $��(բ�ep��m��-���H5�n�[W1H�p"�ǿ\�}�Ӗ@��N��:� ��E�E;�hT����~*�����M�'�D����u�7[{y�������T�����'�߯����HNLO� ���`H�L�¨�~B+˘�>�EІO!߱����:���o�X�V��,:�����C%����P�K��7�DJ0H%���S�S�u� ���-L �uRl_n��ӱ�C��xM4��b���iY;��S�� ���#/�d�fb;R��L��B�V=�o��j=2ښ�-��F����JXy���g�\8@;y�!� yO�R��v�N`�3�x,1�Aا' |w\~#�P��q|H��N�i^�l��tt�[OR�y�:�74f`S�W��^ � �U�_é3<淯���+�tO*0�[����NP�����)Y�����-��Q���S���P7�@-8�r|�9k� +��r��S�K�@?����U\�& W �#�j�>ȭ5|kFB��#cJ��P�J�rS�d��p��WSB�{��"X�c�"�%��Je��blSX��{��c~�]�q S3M4�h�S��N�f-r��e�<��bQ�E�B,Y�k��b�јL�[s��~�(2_�e���Yx����y�����C�@�w+eŦ?�I�耒.ő'gI������n�4��߯��D�C�Û74�!����@�:��}�S�!�-ڊ�|�<9%��Ni�?������� �=���]b�����%��|ɴ��T�n#$u��H,��h��OOH��֜�T�?c:�6��C��+g��gܡ�S�>1/� �͌P6)Xz����)#�B�1�9�=�]����R�M���~K��6�8\L4i^k�E�D�V�aW�����%~h�!����0'(�|T���y�3��;���6�E@Q��r��R����Ȥ�� ���Úh0 ��r=���s�\]�䜀9q��+��ض��T���)����&TH�7��\l�҅��>Q�����V=�ΓD��Lq��� $���Ќ�c�-���Z�V/9U�Uk��ma:�@��!� �ZR߮���)�`o��[�?�����j4�[���?���aVjc�1+}Y��������=)s�f�?�V��g�7�ԇ��u'�p�?�s-;n���J(������ %1خ< ���Jo�*�L�Tl���!ךƬ���4c�5B�<9�7i!�C�6Հ�B$#a�aS�ey*�������P�9PS�+��|�(\���d��ShN���58d�������{��Ӝ��z������3�a����c�EgU��ҋ،�n^Dq�~�,:����,�������*D������r ������x�q�f�M{�[��mO������������H _.����2���iK$�N�j!�˥)��*���o���|�,,�^���ƞzE�u�.#�n�]P�����@ܯ�y���T���,�����$��I:�-LB���)Ǣ���n��) sQ��b z��cI~�z�[���s�ٓYg���E��k٨kJҧc�\D�1�ch��5��Go��] ���}�Kp����Vʱ`IOm6s$Akp ,g�Oe�*�Õ-v]�pHB��Hc�Q�ϋ��=���Y���Zr�`;�ۉ�9y�m�����.� �!��.���R`Jo+!#�n�K��S��ը8����I=� ��6����F��J�
Behavioral task
behavioral1
Sample
a80395cea41c4c6ce5ce906532548027_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
a80395cea41c4c6ce5ce906532548027_JaffaCakes118
-
Size
676KB
-
MD5
a80395cea41c4c6ce5ce906532548027
-
SHA1
0558623faa11eab8598e5270065fc255eec6a5f9
-
SHA256
aecb35f9688504d6f8d829a9af1ea41eddbbcea4d4cde991d67e537304a41e61
-
SHA512
645eb418daf391dad83f4f9920030fd4ef69284ea847d62ba713efc16c0897febf052b0eeffa30354c61a028d2b20f90146891359c9114a99e859bc99ff6391c
-
SSDEEP
12288:0YiGoEDRsMP1A4qkaRvC0pFNGUgwwz0r66xZQgX2r0Cqw0oNfq5GosVzJ:0S2CPqkalC0ZmzyCgGKw0qy5ch
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a80395cea41c4c6ce5ce906532548027_JaffaCakes118
Files
-
a80395cea41c4c6ce5ce906532548027_JaffaCakes118.exe windows:4 windows x86 arch:x86
9efd83d566c7ea327d2075a068bc1d9f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord617
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 435KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 660KB - Virtual size: 656KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE