Y�H���5\ť��`1q�z��9�{Jh}V�.Y�~@�l��mxbUi� �u�Co�K֥_F<�t�94����@K�Q��� �������Z���y��%Ќ��{���U��L�^�d>�h� .g�D��H;7�<��-��'�?�s"�s�Z����;��Q��M����]����<�w��1d��'�-h�4)���R�X��%iʁ xH�������~��� R҃-���Yi4_��Y`��[ȝ`6��/�]8�!Zb,����ݎ/ѩ�&���|�Iu7L��{+��� wv�µ`��4��=��BI\�=E���0��� *'���ܷE��Uo彰�O�}>Y���ܒf5��B�NDa��p�AB�� "v����F4�+E�uK��$�bn8SRq����,[�Q�~�����*��z��\)g��ի0�w�k*c�2�e� 6�×ѧ��^�r=��+�\�T��;���y�+B1�0eN`��z���!W��j�l�}vҌ:?��]1�����{ы4QI�ya� W��x,p)�Ki���h�Q�!|v��CD�e��������a��Y����5@��~B[|n��� �D�Qd�u7%��im�l�8�wA���T=*�F��^�>E����Yg�6��6�x�P�x{�(���W�Y���f��+<MJ�� 90�q�G����q9@��>܁=v-�p�r�JNƨ��|z�b��˔�Du8�э�ڳ�N�)�n��� Smt�������I,����r�����*[�z�_Ё�?��7��x|<%�[zP.���%xO�@X�j�A��uERd[;F�+��\��m��ˏ����2K �����Y Y�2���^=`���T��K�� �漲3� 2r���)c�)���=O�%}u���U�_V�����LI?ԎڀQ�i�8X�[I��B�����<�����odRH�����Ğ[�5��!�\h?W�s��ڥqE"0i��W�R,|H����$��?���V�|�-Q���-hQA:��>���*��"��TE0��<-j_�>���/D5l��5�ĸ�n�F��:<-���H|�@4���}�o��l0�o���b8�5攤J@T�.@M 4;!��A�2g �����4U����bi�S�KR�/��]{rirC"\+��p�?YS0��!���3����r�?�̷�O䟞!o�W�v Ҟ��n5�r:�� ����1��NG�z� ��&�C��B� ����W1����E����#���䷺�~���s�����Apl%,�{�oω�1�Sͬ��vv��o*r��!�����Ց��+ԯ{��ޜ7�6]�M�BM�RS�� �g��:�� ���;��=uacX`I�%�lv��a�s ^k1R�g�?�9����J_Q�Ϙ��wy:� B���o~���������/��Ow��qUb�Fc0U��W*,���Q���!�Q���B�$>+�?�P&� ��F�����vft_���3ޯ��+�1���-u��\�?HG�I��̸��$*.;y �Wb�,���N��U�Z[~�����/`��.��*�P�=��(0&�v4��kfpZy\B|�L�v�IH��a���M�jS��_��gWI��Өz^L�#� w �4��H��낻?�������_���}��y���/��/m��~�(;C�$��6^�?�@3s������"1PN;z�v���ݧv8���w��^2SM@[��~m��홧�$/���KCb��?������,Uy~wƤ��]X����TN$����������ߑ?��ZT���M�� �F]�K��Ӧ��pT/3 q�56�po,E}��;-�w|N�s�����jB��nCU�Q����s�?�˻"��ɒ�v#�AV�[5�:y�g��ȎC��yjU�,���zWF�������k0���9e ?�+��6+���3x՛�I���8��w�~���#|n������V-A^��^�%FA�W\��'<HVԽ����O�.�J��1��a�Nΰm�9�9(vJ�~�{# �Q�]�JN.���Q?�K�/~�='k����͟j��/3Ĭ�io<);�����z��a&s9��{]e���W{$�ҏ a������[7ol0W�"%3{"�}=��b[!ӎO� )Fs�,w�F�S��tg�:�w$�W�G���H�~ļ�����a�����Ϧ�~[!���.˜ 3F4�ƦEB"C�X^�K�lǡ)R��V ]���W�\p���B���C����c����������NFaf��sH�=���?���=�bR����!"�����[T�$����q��7w���:K~4H�Ƿ�͌/ҩ %�t�ݶ ��E�������@�:��� ���������"���t��0�����c�<�l�d�jz�_�An�A��t���Su��u����\����WMS��C�Ӥ)��e5�5y���[2d3��$\�~�����<X[�t�w͖�������҈��'�{����^��F>{p/���}����A�x.�爞-��:���*tΊe¶J�6 ��Yyåb�M�7�B2�u��@����e4!2�qyhH��q���JV�StXҘ :���ī縺�� A ���xᓈ�8����Ի>�CS%�Jg���p68�c�0����!���m��hZ"�[��\��;:�E9˳�+a��/^@���Eqac s׃�}]�yi�� �oz��䴬��ΧD�o���I��AO�#�k���C�b����X�i�Ж[���$Ji��0F���q ��C�o*0Z^Z�c�sE�9�'��O�5w�կgT��>�ʫ�fj���/�>���8ȡK��hCwG�';v-gy�̾���Z���N�@��;�r/)�5d�%&��*��s/ʴ�Ҏ>�R�����~���:���2���.���Äb�НHڹS�c-��r \\mf*o�#0}����G'�[{hg� !�"k��9C+����c�D�+5xg���#��A�o`�VR_nnS!DG,��X���6ꋶ�I��U7��^����Hg�� �l��C�ܮy���{���X�-
Behavioral task
behavioral1
Sample
afe6bcbf1d6845ba77cdea3f26c25b7c_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
afe6bcbf1d6845ba77cdea3f26c25b7c_JaffaCakes118
-
Size
248KB
-
MD5
afe6bcbf1d6845ba77cdea3f26c25b7c
-
SHA1
7c3f4edefd5dff7258028bc2f419687e50abbf57
-
SHA256
f88060e05fa95cbd6700d8c704f0371a01782d4308945f9d7e0edb42c6fb2415
-
SHA512
c333e794ca7bc7a34f92e03ea141e6a078ba889fb2e71444f59689f6383bfd247c37f6ea149d531f3cbfd0d1e6d6c3f33db1d7cabef9304ee2bef253b40c3290
-
SSDEEP
3072:KltvU4br652nIho6erBjMQydZtg0WyePTi1QxlO/N+eWj9oVLaOja7NWRjgG3uzz:iNbrZksBwqrDOKnO/wenjSAepMCT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource afe6bcbf1d6845ba77cdea3f26c25b7c_JaffaCakes118
Files
-
afe6bcbf1d6845ba77cdea3f26c25b7c_JaffaCakes118.exe windows:4 windows x86 arch:x86
313181f4bc1668e980805e24afb8ae6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord535
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 212KB - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE