)�}/�P8�9�^ �bzfR���e��g�����>����Z�j?��;���%�&?@A�`/B���_*$�|3&���]�زMO���Z�<p�LzՕ��\�O�� Z܄ԁmU?q�&Ռ�����������0�y������� {������=Nxh���ް�X�ȡ�à�X�;����o�oHņpʂ1:���vhн��^�^两grsjww�-�~j4�/*��v��#Kd?�.l�M?�{8��wϽ����K�e�i���9�����4��>}?��2v�4m�lс�k0�aPýI2#=�4�y�y��n� ��_ W$� J�}ΰ�2]7Ҭ.`�<5��&%���B�g��N��+���s�ˌ�V�t� ��= �$�~ �fK}�tuQ%����opV+A���өt8]���m�� ���ـb��N܂����V�e����H�k/r��p���I{�5w�3�<�m��v��+6����_���F��D/ǂ���cxvSsK��%���Rd��nK��h��I������y�bTZ�$�.O�2��P�JL~U�-��J�4�b���/���I'��W1�u�j����r8����(�d��#���C�a9��,�ʼn��N;��4[�A�5�{β�K�Y��R�;���Ht�K��o�W�����ؼ$���ϰ� �o���� t�Ý;QW;��"��X��`�ꦰ�H��&Wk��"����x_��d��0�����C�#���0���R�H_'��X��+�22;�##ܑ�K!;�*����i���%��硒S�S.�( U�Ŭ�-v�(��0�e�v�#ZL_�Pb�-^��(a�˩���K�\P(���݉뿣3N��_�ˇ�X�o�"6u��`��@���ր����3R�W_{ͨ���=D� /?옕(���L�f���>����{� w)��$7fř���<$����.�&۶��}(+1q�� NG��L��PZ��o[���p�m�Hէ��+��D�C|�ڷy����}�8�_3��2(O���a��l��j��R�~ N��sO�hi)o��M�"��XV2���ʀ"�c�t /w%t��J�����?=��nH�tzc��5f�=�,G�e+��F`�%7,��ֹ�viU�A�9����N��q�q�+4�ԘEd�=L���x�S���!���U�n{V�9��������D4@!e<-�"�"��)���'S���t|A�;�v/��Lp �K�F���)��:��ʐ�y\L��_晖:w��h��-A9�iE<�u�� �J��Q|����-�Vx��)騸���{�����z���X���3�v��G7I�h)��Cw�����^�$��T3���sj�d�Gx"TP�?1]�G?X-�8���C��R��d-���4��~�f_����?�C�Z��\*y-��2$+��X����9)s(�Ȇ^ �Ҳ=`��x^+��4��;N:��B��"/�N��5=w��@���wW��L�w癠#��E�Dk^C�����<��B���H�1���43��)�l�7�pmsŭb�����i&����pH��^[C�k{A�6�A�L�������ަj� m����Pf@^^��� �����a������g���`o6b�Je �o:!�C���`E��A^� z;l��l��ڔ.��-�r��-bUKn�.g9�Z��o/?�AHAc� b�u/����7�a�8ci� MY;%Znoi?�m�ߨv�|��cn���/��P�a���g�va���:N�yR���Ǽ���ӗ������eB^��D���$�ƅ��Q�\G��֫8��ؠ��L&4,�n�g��������(��W$v|;�?��u��P� �pԙK�O�f\����XC�52Ys��bǍ;�b�w�*w���`&��4� z��[������R�UtƮE�M������8y�Ǖ0g��n,I���I�Z�o�zI��]�������g�X�;�����)��r��� f�q��2ɶ-b�����}=5ǐ�濫�0�^_�C�<�(u[ժ�� |\���߃t0ޗ<�����$W��:��� ��Ozeٯbv7����yݟ$ XL$�M��lc3g�C��q�����Mߗ�?dH4c���b#p������3.H���;9�A\Y��UY�y��[��x�����%��:��2��6e?$�n�@g? %���H�D�Rʼ5�%T��.<���D��2�1F�nD�����#'���;7�2{r:�iN6hQ���$���y��?����=�؈�M�(�����@Z ���6�S9�kf5Ҋ�T4����#��!,�X�@��tE�b��<�|`k���G�����6�u��ȟ����J�������!��͍���P.K�BY��=��T `w�����ēE�հ`��ߗ*?�����u��Ax7�X3�Aa��dϮ�ZAoP�e�S��H�N�#e��~��Uz�=��ޚi��]��I��`�p�1p'��/߅蹳b�� ��M�-��m�ԁk�Ǜkfϗ��[Oh&,�R��<K�_���-��[�؝�5�{ZV���������(��z�$1*�I7B��9�S���.{>:��8�1=Z��i��ҬB(�3KU�:~���gl����y+mb� Wg"Al��~f�Xv�����: �4i���r�i+����SG����${��>W���pk�ډ���؆�V[['� �%�-�#W��ЮZ�ī�AM�R��a�Z��e\ �8�\��O�,P�D�����0��- �U�4(51(�v��8��o��]l��8��?�g�e|� 1M`���[���CoK�����4����TXug;.ڶgV��F���].`[m�_"�D�G���A@/��t�JA��V�/���W��S�3I�H��/�X:�:�/1{�*ը�`/A��lNy��pz� n�����D���Ts�����O(� uX�KFa���$�qlD��6�LR]Ø�df���|���iG@�CG"��C�2T�� ����*�3�4v��=Ɓ�D`"�/��o�����\��X�
Behavioral task
behavioral1
Sample
b1bcb0f7ac1cd823306231e22595aa24_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
b1bcb0f7ac1cd823306231e22595aa24_JaffaCakes118
-
Size
728KB
-
MD5
b1bcb0f7ac1cd823306231e22595aa24
-
SHA1
859d9b6ba09758df8d2f5ae60081d31109ce153a
-
SHA256
dd56d669d435e0cc2c1afd2f461b4967213cbb7995bd6206998c89f9b5150c93
-
SHA512
811e7b8cd608596de5f791b239669017b9cf4d1db0067971d48edb156a8e54777d49e84d0bec466143383d14ebf5691e7b588062296bc78eef85f05143d8c4e0
-
SSDEEP
12288:JiyChGqkxZxG+rXkcmwUJkQToE4mEAVgO2VED3/yUSkFeIRRb9S1vLd8yDFhU2v:JT7XNdCjh/2O2I69WyDzv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1bcb0f7ac1cd823306231e22595aa24_JaffaCakes118
Files
-
b1bcb0f7ac1cd823306231e22595aa24_JaffaCakes118.exe windows:4 windows x86 arch:x86
376dddc8e33c4e50ce968f2506829425
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord711
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 716KB - Virtual size: 712KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE