��_�\eR������x�i_��P�"����ulqqe�d���b$�H tJ�+ك8�[u����J[E�����`*��Y@%.�Ku�q��,{�xqX"�R�wd�:sz�\����T�{|Nrs��sF�SD&��O�~R�T8��>i���إ�k#����F�_{m(H���f�W�,}��SR��u�ƨ���r�\��_��8������YL��ǤU�%�w���9$ހE %��V�ia����F���w�'XaBSJ����7��!yT���Pz�L��Wp?4C�[Ю)�(|(�� �-B@���`��ޡ"�-W��p $~�K1�d����u��Ht�#���1p�Zu2k|\�s��1�#�BՊ<4�ݬ�R��[k>����0-�,�{_XK�-���軴Aq��&�}�]�[� y1r�~�.E�.p ��c/.�u,~Ep[h�P�\��]r8�D�d�L;��44ΎV�o��njX�V2ƥ�t���� ]ZOA7qe�GN�(��[Oi�Ϡ*g�Xz�Ŗ��UN_wJ��A>c8����6������[S�@�r{�\V�rE6Ԙ�����`�Ѐ�E���|9'����ł�J����`�j�Jp6����-j�;�jqgn��P�3�U�:�r������<5��xLa�� !��M���\�H�_m�R<Z�pZqr�rX��wq=d���)���.�DT��d'� �W�m�öo꼍�� F����;��"/�bwʮ���@��� ���7ߊ�������];���;<�������j �\�(���z�2�|>���KDGT�Й�z۪�٩�|���۳pm��j�^(����u2l�{@G���#"�"��5ʓ���mL�ﴔd©b@%� .��:��nyi"�����܃�I��h3�7qM���"zn)3��a���< .��]����zvj�te�����0��DN�#S�k��Pf,w�Y4*������wFdj�a��Ws-O`eEg�̗��.�2:��Rca������ :���7�v��e� �+�H'J0k�'�lU�݉&X��u*נ��Ʃ�97_�1��X��|I������aK�Z3�ȗ��u���r���̧_�o��D���?Ƞ]Klhf ��uv孢�z} ������L��ο �5��L'0�A������7�&�nJ5́i��Y�o�� ��B�G�C p��*%�2���H�i$Z��V����u%���:��qK���# ��#�'� ��#�մ�Ҭ3҇�)�Z/)2�b0U��픎2Ma-�"l�ZƬ�QР�o<�x��-J����v��\w��R��Y1+.b��S?{��҃���|���V��O�j�L�����xF���x��5���v��?�ψH<l����s��lhGQ�A����P*;��<����)���Pϻ*�h4��6�as_�`I��������t��قD$D|���%��y�0�����[(L�L��#�~�t�!���}m݅�$��*,-om��m$�m7+�j���bQ�,Be�����ck]�\E@�9֚��F�DX��H6T�A�tV� v_��N)�V���ey�L��X�f����ƅ�3 ���9x�E�� <-]u�*4c"��O�*�1��m�kXB�=.#��`� v�|���++�fØ�Ɣˤ�Yo�e`ǮִV����P��'�Q $3����x�+d1�@Bw1�����مg���FKm 8�M8i!���bk滊�� INT��9����+[�c�ȑ3 H��`�빯D��eM�ߝ)��v���+�:C�����E _A�>)��̈�=���:��� c���/xF��̑������_���&��n���nԠ |���IDo)��*M)��oa<���O����,���� tF=+��&���°[E:בg�=��a�#��8@k 1LY:����a!�#��%���O ��u<�Ͼ��o�)��)�"�D~N��#V]9�'pe���إj�>i*y�o��*ύX�*i^�z9�,�#A3�5O����G#u�5 ��gӇ�[��$|J��}�U=h��!.�J��$��l؋uK$m9�����h�I�O���J `*J��n�� jN4/n��}�[�Z)�ۈ:��:L!jJm�Ew�"5��M?�$H@��2����,����b�lo���Υ�6^)�U�'�WI ���9ǭ_���[��E�Gk�浇�g��Ao��d�r��9B��-ԗ��=6�]x�(���x�����[�hX�x\�����.�x%���ͻ�d�|�Q>P���ܢ�F��VA�U�K�h�E�ݶD�n����R��?OT~��j�fj���)�$���l�<BU[^)������ǐX�.*�����5�i��_�t�e,�MZ��1<佃=W�*g{&Oj�j B~f��ĺ�,ԋ�uy�qF��!.UA�c��-@Y�l2��[0��;f\�TO�tjѬt�iZ:Hx�8��V&��>��#E�$����#7*����x�:�+���#� �]q��ۯԣ��z�=���}�Ё�}E��\>��4��l��"�ܝA/bާ/M�mc���K{��|&�{���aR����Esۇ�X��({�����5��q��5��k��j: )������Yg�Kw�k�T^�� �?>AM���!M�M��N/�uHki��2&�b��gg��QVt>K�XΨ�o�g/��D�I�:���P��g�c`g(���������dJ��[L;eo�W����W[B)�5w��n&&�����������Kʼ�ʜ�`�5Z���������6|��c���m��zo�둁�y�Oߛ����"v�����60�z����O��cF�O���H����9{�P�<�W~��?�]�1��9��ZR���OT����!�Ma���&�P��u�T �,� <�R��!�Z%M��X閱�d�u � ��4 sΉ.X푉�"����:MČ'��b��� �r��ONX�{Muo��7�� 1�J2yo� rD� Ѿ�N�G ���qD�J����R���u���ֶ-��4ٖ~`�XV��d0����2Z�*:]12yi����&����
Behavioral task
behavioral1
Sample
ad28498783188794fb9381ed1694047e_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
ad28498783188794fb9381ed1694047e_JaffaCakes118
-
Size
312KB
-
MD5
ad28498783188794fb9381ed1694047e
-
SHA1
21e95e551a051258eba98a25048702d6382d0667
-
SHA256
5e53afae1e4981d2243ae031550cb82fcc6be2c02f8f5a4ab0ae3e1447f9a784
-
SHA512
b4a5d0c8949859080d56e2886ead719b40fd9bb95827803fa515e3bfd0f9f22232d95b7a73a95fcf38b55f55006d3a36f39a9904625a955f4e98b08cc965e170
-
SSDEEP
3072:ShiKVH9b4SYBKLR+MZRapwFZe/W/eioTSDLjzndQjeSXmBgbkPSqJUHh6JEE9M3E:ZmdcPMTFZe/HKDzS2BHUBwJMk+l0Zg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad28498783188794fb9381ed1694047e_JaffaCakes118
Files
-
ad28498783188794fb9381ed1694047e_JaffaCakes118.exe windows:4 windows x86 arch:x86
c2aec7dc87c5779c89041be0d636486d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarDup
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 300KB - Virtual size: 296KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE