�-UV0�e����~ԣ�M���S�lr�`Hw�1��%�}�G ,?���c�Ю�RU��U|Q�J��U6��}1�&��;B�+^�Q/�5S=d%yO�S�#�܃(+qS�v6�A��]�%p�>k�jڙ{꜎��/���j�Ӊ6�}W� X��� ���}q���}��%^��%�ZE �"��6|��4�&���������<�!C�0r�T�c�Ŗz�a]Є�Sw�����F����>��KQ|pLJ��k��˹�>�u��Ï��M����I���c�?�디�������YP�w�ys��Ц�U����4|(����e��Q�c'q��"��Y��e��T�*�@*�����; 0o�gҰqL,�F���P��'�kP���'ɀv"�غ�H� D�5�:k�&�����s�A�Eä>�P����Ӎ<�K�ʆȜ��U��Ax�/h��I��3��1�]s4s�U*�BuL0���H���uO���\<P�7Ҍ���`WD܇�I���T��g���NC"�!�'7��{�cV��s��931�iō��_��QJ]��;W�k�IBQ�=邴w<�v}�i<�V{��NS7�O��I���@~�d @U@D.�M��o _:s6��z��4�DE����r�`��k�I��$������1){IcETK�(wE r#{]�wb4J����N������EA�%�|�,c� �1 ��CbA�q6;(qյ�����y8(�R��};������E���c#7��W!���;����C_B�A�6;�{M:H�R?I��`'��U�/?�_M�:���t~���l�b��_,��w�����{S��p��3�->���M��v[eX�rv¸��B�g ���,Q� �#*ט���O<=yέ����o���e�K���%�BS���~��o?�6�U�G\�� ӝ�B��3�$��'>��4=?3 F��Q���]�k��M��%p��$�M7�])��J?$ ����Q�hj���$o|���e.�y��H��P���Pt���Cn��)��tH�!d�cΓ1��I������#2֯�W�~��L��n����zٸ����;�ڞf�s��x�}b)�DBP:H�SL7���S�mặ�������]|��O�� P�eL�˸�"��&�joVU!�yr��u�����/�}��IIdX�x>�D�����Xi�䞶D\O�qk�R]���� �-/_��Y��&���)���<5�2;�;Vr����r��H=���@[��BϺ^��G^xۡ���|I1Ѳˋ���'"׃/�샠����̒gz�1 !���g��&<��;���^��-C�6�����O=L��^ϛ�IL��3o?���wؕp|R���0�#��pBv�1C�#�(j�`�Ӻ�� �/����!'*.�`��b>���i�����P�짼BkfT.!��KK+�Ű�I�d�M^�|��0������9���g�kR��x����M���Ͳ�������� � t�b��� �o?����ٯ�l���v�G5�����B;�͓�n�W������5�s����������.�M���M�וm���� ��'�L|�e�C|�C�sER��WYJڍ�08��H�����2憊6�.�V ��u_s�3���`Zl�}��b�;ዠ��3A;�Z�nU���vM����6�K "�O��a�^B> (�vVn���ӳF����s�@Ԣ7`t��q���E����f_�s���&�&��'�³�]9�>X��=��Rb����y䒯#�L�y��QA6�|@-{B�Y�Dp�a�d�&��̱��\�=N_���U��f�<�b�œ�nv�ת)����٣�&�ӊ���,�Qt8D�zEq�����`k�_���H�$^y�Ba[�TԌ�7H/!z�!����k"�!+�I���;T�G��*�f��h�B7+�³,ak@;�U��u?������Vܛ���a���ɂ6m���Ak����W>k�f�ߪtT��6�>!f�8�,���I�����QsSI^����>���X��1K�ZD�`1ym�SЩ%���U������!��P0����.�CK���g>j*���j��>� ����:4�q�Oc����u��cz摇%Β�tZ�� ʰ4�k��"՞@?���`��&|>Βs��9.ib���j{�ƴ�f0�����a�]�{�$��� |��'��R�f��Hା� xN�.�'=EJ�d� aP�KO�bo� � ���!�����`v:q�i�z�k�QU��3gg����u��;�� F�\�I�j��T��t�:�YD�a��9�NY�^̄���L�4"�4� ��H���cS��.:x(��n�p�Ł�t�O�a��7�ۧ8<2�݇I��g �@ 8��'��&1"�I �4���j��V��Q$\N]�W�8�f�v-.g�A�c��Xc��P�5��X��Huٽ�S����tpseG�h��J�?6�>�a��M{���� fk��7L���(�ܮ]<��%P�Rh����]��Z*¾����h@�"�IV�XNQ�� �8`�� "EÔ��Q%枍��L��s}%"�*��?�:�~w�wh�L|9�tj'�����C��.Aa ���Pq���w�B ��<Rg��4H����ʛR:�N{r �6�_���I��S���X�H&�ag���UN�]3 ����=,��X7YW?m�<D��ns6z��T�/��o0�����4����DƪN2J��u�w7��:�������XH��F���U��y�� ���_��~n5��.�����!wͶ\yv�f���q�9�o��/]�b�|�6�L��q��U ����Y� �1�����e!UW���p�D�H����cH���;��0f����q�3��b�ۃV�7zUV\��>-7������G(��|wf+�U��n�[; ����'��Xw����������1 '�岢�߷܅h��T��:�0�����xͳ0I�$g�m EZ��BQ�Qj�E���s�:%>!#��[0G��/���=t�5t��� uv�������7ģ�)���q��
Behavioral task
behavioral1
Sample
b9752dda8d8e6fe53722b0fcc5e51fa7_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
b9752dda8d8e6fe53722b0fcc5e51fa7_JaffaCakes118
-
Size
97KB
-
MD5
b9752dda8d8e6fe53722b0fcc5e51fa7
-
SHA1
4b665f5b7dae13790a29a58f6d5b99701fe55ba7
-
SHA256
97456567c122c08c7b92a2b0f723b9910604c22ad1498b8b6e6a357f16f586bb
-
SHA512
7c8dbb326444de073f0ca3e805240afe08c11d9d6de4a68f568991efd4a3846d22f5cb146311ae0c1637165b150fec4f932c5b1e90dc36067ee4e8b80bef001e
-
SSDEEP
1536:+R09IRkl7BipIMEJhB596sW6BpUXP6SRP4jvfLkxbjAkGcf/gw5sB11xSye0bn6y:+6YmQqpbBI/4jvOJ9sB111eh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9752dda8d8e6fe53722b0fcc5e51fa7_JaffaCakes118
Files
-
b9752dda8d8e6fe53722b0fcc5e51fa7_JaffaCakes118.exe windows:4 windows x86 arch:x86
82455cbc864ca5e7b0e2709180c6c877
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ntdll
NtQueryVirtualMemory
user32
wsprintfA
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE