�ǚ�E���3f�������)��j� p��ZnLzHX��@�J�c࣊��27�#V��"�j��u��db��ӌ��a�Q'\�u�(��g��E�(��� |���yr����x�[ār��2^}��ݪ;�K�ds�&�8����;���G�ʕ���]w[�]�IY��uARt� �K�җIoZ'̔�d�8�]�YF����-+��͟�fru�&�N���n�@4H�2�� z'�c쇰��0�Z}8��{Z5�����7���/Z�N1%8�����Y@_������}�1�uK�,����7puvө���M��C�\��0�l��U��)�|j:���1��C��1*y*I�M�}&��Ts�ۈsܗW�'��kzCg&�z������N�����Wă�o����eʞ(ӄ�8�G8J�CEl�푗`���IY6oa��=�,����φ[���(b��\�T�$��6[6u4hYw�D$��B�3:p�% ���yk|Ka�ܿB��R3�V[m(��dP}��l���ӟ7��N�M��G ~����������ΰ�U�!7�A��>m�RH��0���`�`b!B��`�tQ���3��N��YALD����)۸kIZ �%�ڌ����s��Ll6Nh��(� {\#�<N��?w�]��jo d�Ma0Sn��dP�D�OÈ��a Ug��,��X5t-�J����}�s�3n5�菽��������3=�ZO�O�H��W����\xe�Eʍz�zW �p��}�( -<����r�� �Rd�0� ׇ����v��W�XF}�"����c������[g� 6�C�+�wB&1�z ��c�����t��� U'�a:�K�CG��:|���p�?h������&h��q>yV`���Ts���'��ta�,�QL�le�f%!o�n�Þ�87�.���1���=�Q��Rm�PRT�@ϙ��NҔ ��>C�����+M ��u���H������ >`�)�<��J�A$������Vb5:���B�%z>��<�M�1��Ƀ2c���i���T�8��r����g��KS+���`0���ɨ�V�� �)��'��1�Dp�-s2��y�#z���e�i�~��2JK�x����"��l� �+h��1��;ѐk��W"[N�Y|�~�u��a�I����.��☦��~3��������R������9,����i��+}�&r���V4U��w5P@��[��Ld E �@�� W�*�!Bm����,I�/5D�I��G��_�P���9{"�Q'�c�sJ I�P�Ho/��;j�Q��8O[��i�?"�z_,%+=ˠ�Oc�V8R}o]��t��� ��$�;��q�+���cAW|����i��ag�tr(��Ȏ�8������O7���`�1-~Q�/ AZX&h��\Ϣ_.R)c�s�����Z8{��F@2k9���/�O�ׯV~�%��]\�{Z�t� ��c�9�^�u�af��Xּ��ݤg�a�O�0%ՈK�"E�#$6`p�?�O�$6Hf�����V������y��^�ob\���ۤH����2�bY`��|�Ӛ ]vF�2�+�7�.b>�q�?��[�]��_ƍ��Ȩ���+-�q��m�������:��@���Z��n����O�k'�".��Om=d�?%ߩ��<nh��I;�d��B�]�%�.��+��~8��P� ��YX}��� Y��v�=%k�����f��4Ą�Z�q�!�h��]�0��r�����]~x����`O�ƣ�j5S���<u����4yT��M_���Q���_�F����n�d�"���O�� ���c�פt��ǥָ�T+�������"����r���j�� �]`�c��߉b!s,�f�,Zx��;��W4C��Q�4�hi;YQ�'>�_7�X|CK�K���O��N�\��6�*)��s@�Y�$T���������z�gQ;�B������]7����x���t( �x��L;���U<��� � ���b���^`��6�>wb�����xy�����!��HӭŸ=B꧆�>՝��yU�!%��A<+��Fr����ٯ���v��< �ds���&�������U�����k9^�Ԃ�07R<������.�L��Y�c:���<.��־�u]��R�������Lߕ�>�U���q>P�T���ܑk�<�N��Ԣ@��:L�tbד��ܿ �4"s��� @iA�4���m����Ȗu�pW������A[b[��� �Z�Ud�+�`H6��]�9*����2��i���5?Jɲ���`e6u��0M7�_8��}�7j�Q[}�7���.;�W��zg.5�=�(��J������uh��J]��� ����m#�ő�:"��'=�0д�~(cƣ�E5 ���yą7}v�iV"���H��Tq{�mB�5����@Oq #�Q��ʹwX����U�)�((�O��-�-W�q$�'���Z�,�BR�����\qT�/���G�����k��%��+�����I��DT�wjq����W6Y|O>�zwqC�[�'�Y8����^���BU}��l{������;���Jt�.Թ��$��=��S��*ڽ�{��V*e�G5u��!�mD?�%S�m-��������)�z�#0���� �]1��J��v�,5.�7�������ߡ�|L�<��p�v���R`� g��'\L->䞐��h�~�݂Pm��Uaw/�x�%��6S�n|���1�<'H8�R]��k52 Ȣ6����D�� N%Owg��=��6�'�!U~���n�C��$0�~77�;8���fO�y�1g��-�h�*�x�T�g��%5�X2���ZA���b �[��|Ӯ�n6E�)$��#�X��}�a�K��ۂ��Gs����X�����`��W8��/ �����\� 7F,�;�;v����Z� >0��]<�ڂ��hv$˻W�ʅ����,�а>9̯�(��x7 }�v�y�.T�3.�B 6;���~�W����+�f}��Y HC�����eh]�ת��D�&��d�wЇk��o�v�7�p���%A�bV O
Behavioral task
behavioral1
Sample
b11e1258030bf020580d709d4c7b4981_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b11e1258030bf020580d709d4c7b4981_JaffaCakes118
-
Size
716KB
-
MD5
b11e1258030bf020580d709d4c7b4981
-
SHA1
1e6426021cf4450f61c54914b67597e4f76db673
-
SHA256
f74287f41fc715c315c9f94a654c8e72b7410ca3ffe92521ad6a03ac856dec85
-
SHA512
ea9624cf2445bef2df87cff253ded04ee93a0f94ec12c60ba9a792f6209a4319052f987ba9ad54a351ebff19a8494a539bdbd9c2b66f083853a6bfeb205614d8
-
SSDEEP
12288:++trkSPRJrwMKlcAb/4/Of3j2h5pWXPIUqCtOUOMd23iGu:+++SPRN3qbTT2Dp7oOh4ANu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b11e1258030bf020580d709d4c7b4981_JaffaCakes118
Files
-
b11e1258030bf020580d709d4c7b4981_JaffaCakes118.exe windows:4 windows x86 arch:x86
1502892ff65cdf7a201cdebddc5a2061
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord670
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 704KB - Virtual size: 700KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE