�5q��'7�3�ǡ{�h�-���,w��r��ʗ��G��jJ8� ��3�����C!YV:͵˼M���LEja��=�)��W/��O���܌�ۋk��E�Y�r\��������FEԮYs�ki��;Ao�a��J.`�����q2��_�����NV��n��d���L�X������2�F�'7���j5Ry%�_�m Y��:�Z��{��X��Y�~f0~/Z�R�`z@�L�ͣ1�6^�Ш �,u�,�O�P�8��$�O�R{%��K�F~K6[�Q��&�K귢J�����-�4��~8?l� ���3��H/rd�-��tE��\�٘�S"L�B����� �݆@P�ɏ�<\��'�����<S'�����e��ϝ��E���|Y�����U)߂L��K���P8�[#u���/�. ��UГ��6;S��jB��L����pVA�/�*�X�i�f���v�F�Im ��щ�j�鑻��}�Bз��Mtj4 H1�v���N�-u\��h�O%�w���|�r)��<���r5���������?�Ic)� �����\b����2��n��[��şY?�"�㻔�Nɩ[G� y <�C�� Z"�V�1k�[��3�)^��(�`5*�"��5C��0�r�Bn��<�Ah8�m���50]�H�f�M0��'���]2����U���}︠����_������Tp9��)w9x���.�_��C�-n��"F� )Ҵ%� ?;�'!p+��Q�-��$2����2���M;�<����3>lN1�,��|:����V�-l7W|�_�"qՉ�R��$�UjL�-2���9g�ѯ��ٰ�^ؼ�8U�DxC���fp+���~���#c�� �B.t� \r����s����'��a�|�9�t.�����R0��x�����mȵޭ��6�ی�[�&@k�Dh������z�� ��w ��H�W!�c/ÒR]5`��C��YE�U�?� �݃[��E*>Y�NI�I���`��o���1�ݯ<>�>B>Ga���p��VjAR��S��,��#N���Q��S��� ���*x����<|��4�a�=�a���o��}Я3�9 ef�s�C� -)$T��g�S�c�Fѫ�^rWU��-R2P��<)��aH�qܷf{G��:���xw�c�ٜr %eo��xH�P��<�b�ʿ8K��<�� �X�ű��H����{}�-�ٍ��)ܻ�@5�f�B� ~8��y�&w�ML��X���ӎ�Dže�Q�>]��@#��̶y��&*�_W*��Ku6��@6\���|�~���kA���˕��^.���hGH���o/2�[�S�J�k0� �}gR��Z��� F?O�)#=� ��Mf��,5v ���u%[p�=k�dҷ�3i��_�XU;V\���H:V4Q�{�-rz��RPo�h�2 �����^�|�6�ʔk�~�P ����%m��L'�eGQp�l.�Zکb �Ŵ��!ݫ�"�jr:H8i5[+����й�8�+��=���d,z�8k����4Pb�������c�������0˟D܄E�O�E4��KZ���m�r���uk�ds�yZ�s�^)gh�v}�>��ً�#�p� G�#����|��<뜸n��T��o��/ri���$f�,�(��5��ҌM~H��������ִV����r֧�a ��i����M6���l"��5l��Fkn}�\@~D���Ǯ�q�0�c",��mYD���P&��|�p� 5��N�/���4��W��;�o�(g1���~�{yƳg[�����`�_,J�/�2�=��dh 4�����%~�h���3��I*�͂�Bw��}9TJs_"2��Lnf+��_�J�Qr��˫W�-���GOP�卫ˆ�'�#G\�mH�O1�wϫQ��������C�-���t�� ~�u�_��?�Uo����E)F.�i }�"ڙ���+S�I�� n{<|h���� ���n|�ߴ)5�N9��Y����<V�����(�On4�]�L�����#�%���}��6Q��%w"k�E��,�tS�٤4��?u��a�?gV;��~�n���v$U2����(�XU�h�\�̯�m���hӺh��6�������Rf[�n����s���nKM�.���;^@��M�qi���:��ī����#3<=y7 �x������u��� �k:a>�B�x'��%�(�z=���uHY2�m��#%H����a�2!�2���M�aD9��=��A<����O|2D�YZ[1f�{��<�=C�,�oK�g�6'�����5*H�W7��.cΪi��1���Abs�[(�Ц���`�����ЗnFD������ix�c��_�t�ԫ&��L>D^���6���7n�R�f�{!Fՠ��7�@(�/1q�F#3p~t��[lh�苙�GPeY�L�B��̴����O�O������Q6������sZq��,6R����+������E=k�Fu�=�vmktx���Rq�f7�;�(�c*�]��5�)����$!��F�_wz\�7@��84L\���X�����%qg.�b��o���63��j�+�&�01�7hJEج�5��QoΌ���Q�H����*�\�--���ZA�q��G����1Ԇ-���/�����L��l�Ht1UMY6�o��U�S~`���7������W�0c���`���5�̉�̳�`ɤ/���]���U��/�4�%'�_NOp�S���;o��G-�I�¥�&M��w�>)�~c)E�L�.��qM�b�Ycr�QFħ'Ŭ��7@=�=�b���3w���\I�tE��n*��An�4�=^q����Qh�vՌ��5�%��ۃ���+�O�h4pV���i�;�g�X�w�x%�GX�f��Bo��^aN�y�77ox��=UA!)쀐 �\��3%GpV�'c}/�>;|���rq;��%���k��}��i���#v�&��мT^.�*85�q��J����Hc �$�̜��s��]I$"���g�g,s�Ȗ��A�y���5����۽�a/d��:�=�,�����y�����q���
Behavioral task
behavioral1
Sample
b661bcffd4b3274fe6dccd72e33c6b1b_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
b661bcffd4b3274fe6dccd72e33c6b1b_JaffaCakes118
-
Size
728KB
-
MD5
b661bcffd4b3274fe6dccd72e33c6b1b
-
SHA1
64cd49499285bc1445dd63bb8c0f5b6e6e33ec2e
-
SHA256
83cc1015aab28466dd60836f40208d96e86a783101f5cfc40cd239e2d6052b49
-
SHA512
92c56e18a440102bc53cbe195ee082f195ec92a29ffce2e6340d0e54f9eea18eb999be11e7c6022a2cb21c6bcda9b6c4e363b63e13e2ba6d83042a4025eea35a
-
SSDEEP
12288:GHgPrkUf2WRONN4h8HqPNbsr+eA/8VxRopYbI9eDFgOK2zEIBfbadGHDPt62HO3:GUfuSONN46Hsir5A/Ezop85HEIQs62Hu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b661bcffd4b3274fe6dccd72e33c6b1b_JaffaCakes118
Files
-
b661bcffd4b3274fe6dccd72e33c6b1b_JaffaCakes118.exe windows:4 windows x86 arch:x86
af97b72704c716e5b9494e7fc0614f9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord100
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 680KB - Virtual size: 679KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE