��,��*t�)T$�����@e��6F3m%��I�d����v��c�L�I�|�]�#�V��zЅߵ��~��,�O�>��?���Ff�$+�ԟuի�h�����EHl���>��d<7���d�ఙ �?(�$BJ�烻���]��X�V�_!�_`��`���(3|�$?�af�:5ڗ/��&�Zg�����mKqSJQ�`�&b��#�?��c���������NG�l�_�h���F�e[�W{(���8���/��Ka�s�H�S�=����YhG�-a��.��+� �3��$�$��[ �����]���F ���Rӯa�3�?vQ��#��/�1b-��I�VYV�KU,m��OZ�vk����`���e�¸��o�Y+�$0r��Q�(K��/{�:�Y��;��$���B贪�l�A��w/��������ä�Y�3S�h�"v+��-�+,���St[�Y. �#�r��^�P�%�M�S��[+K��)ycfyꤴ E�+X?��Zq��t#hV*�I��y��� 2LJ������]@�9����@�J�]�Td� ��R>��9�$V� �[�:���Rc��7ߌ0Y�EJ�hgb�^F�(s?�2���=b(r��8c� ����l���O�-k��dJ_��J��)�^r�����C��ɆDR� ���WS�D������!CL�h$Fr�1�t�d�NϤ��g�Bj�����Jj�=P��i ?nl�~]]��mR�t}�� �/���d�ɋ��'ڼ7;� \T�?�i�HxA���\��n*�R��OZL���:#S�ȀSǖ��&b��:���T|ڜ)� ����H�ժ�j�f�C�����3�i� �ǭ��U�P9<�)3^P![�%A/��#Fv�E�ʨm�-�H�[ F(������}��%ʅJ�a���9@ֵ��gN��#C�4@�!F:�˞��g�#A��6c5S�,D�(��]�9 ��hz���Z�(�����+%_ǁ@�����$�cX�v� i}��}S*���8ɳ>����)o[,�����8 D�G�������d7���rvy�*rrk�80i��'���@-���(�C��;@��s�nݵӉNfUwi���H�]�Iv����OԡH�����_Ț%bP8��ÍS�خb��l�Q�k G��]"1��0�Mޱ$`�� �Bf�m���u��'�w���[A�����˝��l���lB��^y=Fm�U ���c�O9>���L��� �7�����v"�ϖoK�u�����zb�ŋ׳<E�y߬����N\�Uˉ!����S-��;ge���i��Z� "�7L�M�#�.7C��q4��Fx5�^����%Ѧ��YSMe�+݁~��uS�a�0�gKb.��ժb&�w���B�^��3V�>h��Z�*O�;�i��||���zU.�<�������D��56�rt�:"z��(2�S��y�ƭ�J)0"�wp�1��e�j!,��ڞ�Hu^_ϧ*.�H��,�v1*qh�kcq=X�f7�Xv�H ��� �9��<�bnL��\�p������&�@|��u4�V�����������=w�|�wٽ�$���O�ߕ��v�yt�J|yi/�Qܞ��N{�j�����Y�j(�y��;��6YSh!D��g�qk�w��!z���>�#fن��D�0} �<v��fl�����7��/�!}!U���۟J푴Ѿ�����?�:�q��[���R*D<���;"el�I���:��}me(j{6j��U��7۔��g�^�!�QA`tC7UA-Lp��̆����%�� Ү����u��-�pV��3E�����BDG��&=�� ����ZƳm�$��S��%�*EX��n�+�����w�Ź0��e������x4�Z���Of�P��+����KG�x�ɢPMb8�ضA������z��^���q^����##�c�8��a(�����uK�E�m�خ..d�P���I�w��m�e܁Nj��/�[�FR���.��Dz!_��OmK�ڍe��=�h�4˸땞�k3���]���)J��� ����5�t�J":��Wˬ������>�� �š�ɽ��,�����@��T=nH�q�WD�|J7-P�u䋆=�'�j�,k:m�G�V�}:/�����3��|W):�����֔�P��h���fq:A��p�Z��j��/�|��q�2����[ֺȲU�3�q��˃� _�ύk�Z��C��!=�P�Iw��@�ƚ�+����l᧦0��,��@6�t����*�#���m1�Ғ� �V�����B�d�O�� �SNg�Y�(���E�A�d�I}��H�e�3���@�ɇf@D#Tpf4�*�*����� eC֎�ٓ{�����.��s�'��a_C�u���»J��r�J ���@�����pA |#R��>�]H���U��AǰQ����]�qխ�K:����/kW�'��K����g&�y�ᗛ*�'ބR��RР�� ��q�Ao��}�V��xu�r���ڻ�jF|8B?G�> ��>a�������+X���~Z��#F��W4��oPk��)Y�[�� "�ְ8Q��f���&-��5�J0��<S 4�}Yv[�Օd�*�&�/��_ @,$�Wv�����|-d�jO)���ipOce@S�1���S'�`�U�h�`4��¸� �6Ci)8���`����o�jV���\�"��Y?��ڠi-�����mծf ��"����o����:K�b/��G ���z�|�p]iZPm��}+��=�6�Ee����Q�!�M.w�n|][^w\8.;���|��3�~���E��>1�m�P�/�ZgɨU! wޛqƚ�y<�y}�2�����^��*�(C���sJ�9��Z�k�n��)�`���%��ɩ*:�N��0�h�?_���>�_��$��!�o��E�� ��~��a��*s�a��f�����H.�Q_�֞ꋳ_i���͘Z� :������z����k����9,�g�7V|x:�5h�
Behavioral task
behavioral1
Sample
aa85c5027fe777c5c12fa1c16aff0210_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
aa85c5027fe777c5c12fa1c16aff0210_JaffaCakes118
-
Size
512KB
-
MD5
aa85c5027fe777c5c12fa1c16aff0210
-
SHA1
81afa510ed81f0e31f3953fa98cb5305255670ca
-
SHA256
71ef76edc87ab414827314587610ebc04d0295bf6532e95d2c82cc3133ee79a0
-
SHA512
514c26be34c1facaeb8a51017559e1e1f8d9a7fe22f5293d43c73b644cbca8ce9ccd4548104d3a3921c03db5636067da1fb1915357204092b7f1567143fb77c2
-
SSDEEP
1536:iQ2tyEafzbkTjaZRScSvJFLa3Fo1cuurNZ9pV3PXhy7arukekaOxLYqwCnNDxa:32Gfzb9ZRoRha3FdF3ZPYuiUnxMqN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa85c5027fe777c5c12fa1c16aff0210_JaffaCakes118
Files
-
aa85c5027fe777c5c12fa1c16aff0210_JaffaCakes118.exe windows:4 windows x86 arch:x86
cc2ce27f781b3772d57a542d8ed3d7fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
comdlg32
GetFileTitleA
advapi32
StartServiceCtrlDispatcherA
mfc42
ord815
msvcrt
atoi
urlmon
URLDownloadToFileA
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 96KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ