T�����k_slI� �=ֿ^�����:��F�*�5�=���ej�×+a�����"2?�]Z����삐c�A�����^�}��?�����1X��4�� �^�����z�G[ߤ-� J�@�˶F��a.����$�myeNf� V����7{O��^���BF9��)�STZq�b�-AE�Ei�e<{�A._(��]}Zÿ�gc�� �Pr�xX�1���Z����1EK��š��@��3E���1"��d �����j%iM�р���Ȫ�Ǭ���m�{��.p��@9f�?�3��q:�b���jJ�enB��6�ȳ���� R�|(%RM9��U�p��fp6YP�i�8\�Sz�������S�%� ���^�T��o�/���y�t[�}m���������`skX�d���ܞ�f�1���� 8`�n�z4���;�#nP��LUo�O�n�_���^��'��V﨔�����'���s1���D����il"А����;n ba���8[+��|���P�ʻdQ ~Ʃ"�`�S��3��4�2R~@�T�Kh�G���rh����y_�c�orh??�I�;�ߜ��6�`�NBTI�)Q���-�܄&�$I]L�m���L��j�r ����#�WNr��;5Fl��i�d�S�%�q[]z��D����ʹ,XВ���{;�j�����+�QVwN`+1�. �컊"̯������~Q����~�;yb�K��x/���t��qQ)ѠƗ\��)Z�`͕k�z�B`��22 �>�X�S�@�K< %6��FmX_�@�5ǎ��4 XS�ff���m�M��$WճBF?r()���am�$��uL&q���i,�My4�k��q�Ѻ�MR}LD|;+?Q=��'b;gr9���x��Y̷�+bL�c32(����˃uͷ���o�nk����/�^2\��xcTٛJs���ҏ#i��~��=v���Dv@mg�� �����%�s�7e� p���\��03�h@��/A�G�G*��u"E�ڰG��U`�oT{v��oC^Z4=�U�@t�����:.ĵ+Y9��� ��,{��0��5�J&?d<%s�+�Q&�9��L�$�mx3�p�?�F��'��n6vLt�������+�R��|�Z���-��p�y�O�c!39W�W"��/�S����-\U7� 80�,Kf��ú�Y����a)˨�ߥ�Je�Sn��_Q/�e�*%1�bFw��7{/3%���KA�#�.�/����6+y��\�fS %ӆOx�A�7�3o�^G��豂PN����j�絲M����'��~�1萰�^N�0B���kP�0�+�"B��B��q0��>�:�Y����E QY�F��9#��L�i!���Q��/J�A wX��X]�� ��>�Ξ-��D����I ��.����N����23Wb�����l�cXT=�S� �=�\� �l�cH�Nve!$U��zQb�t��S'�û��j��%�䐍ۡ�����+Gm�$w�UΟL��sс"f��Ŕ��[兩�-0֑,y ��`ӥ$ť�(y#�rr�E'rhp����Oh�����ox����f:7�2�Y�l;�?�H��E�9a@=q��rDY�?5u�d�d4��x�w�P�B�hX�����MƇ�p�{0����%3�XG:�0|��@ ����O�����2������A+Y����/@����6b�-f���G�aL�E��M1��`�t�/JnZ˥ L<��v�[�w��r��?$TBJ3aZo;>�jrK��"�o~���0��_�?�������^�:�ϫP�w2�Gns�����������1����W������lc�c;�,��V́�ϳ��/zt��-�p��H��c����3�)Ӗ2����Պ�0�����d��%����<�홒�� ���d51Y����aU��ꥏ�U�s �aR��o�N����y�i�vd@R�nf*j�|�����:��r�5ǧ1]X�!L��F�gޔ!"ڎe5��K���9��>h��e���Ix�����\9�"=�k���&��V��,U(��+NY�z8�K0��}Gc!�cw���}'�פIh��32~��bnȹ�W�#�@���ώYP�}N;�_>>���@�5"�� Q�e!Eqˢ��u�$�4.�N�;�ߡ:�*�l�4�~�2�� 1�K�w����(���e�*�ف[���j+x��U7�N�ww��~�G������`��h;mgP��_��i��6&�Dt���?ݍ^ڟ8[�a$�Q0h �������S:u��W�CIOh�I�E`�X��� aM%o�C��G�f#��� ���7D�|x�㨉/�ih}����r ���ɛmm��;RA�W�@+s���|��x�br�-��bJг,c���"*��`��(���;xS0@�<�`�=�As���X7UJ� �QKk�y��j���IB���{�{*vpuNwU@}�����e|;�Y�'B�܋�e��Y�c�h�;B���X8-�5@�[�����y�4��~��]�D������K~�l�b�>S�m` �e���ed3�$��鴵3cg�ݟ�/��{i�~Am�G2Wr�~g5�rRƯ���q$Ίщ_ྰ�@l�ߕW��V �>����j`DOFznK����y���:?e�VOj{=8kȲK��Bxn�#C��a�$��$�̛Є��e����-�-�!Q��)p�ת�]��5�X|2��FAmSeFEc����l���VcTR3�N4�R�������qN\{�CLo��]!�V3�a�9s*��Y_m �P'�9�Tz�G�H{)�!$�41Qx9��\��(����D4�!N'gy��)N����-�|��%�=�G��>���;28�z����CX��u����!��l�)�&��p�'Υ�Ӧ�֦IB����߷k܍��%���z������i��&I'�VUF~ ���p�(�4q�u"���� ��fڲ��J�hJI�o[�Id-uA��˸[ z�M�j��O��v�W�8�g�����o��7Π/r�V)En����
Behavioral task
behavioral1
Sample
b8129887fe20e6149165cdac8153493b_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
b8129887fe20e6149165cdac8153493b_JaffaCakes118
-
Size
732KB
-
MD5
b8129887fe20e6149165cdac8153493b
-
SHA1
b639edc2018b857eb5f3befe0c62222e025f2b9b
-
SHA256
924f16e6086af2d16f0121e44b54c47efa6ad45118fd8add112679efe4c88807
-
SHA512
261af16f64b478cedb326ba6d4e38698a576ff76f9f50aafd3b59c7e0fe4268b370704fb87eea2a1cc767add5702dbbfb80030b2cc2e017949ae9571a3252b5c
-
SSDEEP
12288:SsssLZTWXkrjQXfOgvS53rywp8wKuqNFVoE0EpvOR3TS1wyRR:SsHLdSk3QPO8SBW88w1qCE6T5eR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8129887fe20e6149165cdac8153493b_JaffaCakes118
Files
-
b8129887fe20e6149165cdac8153493b_JaffaCakes118.exe windows:4 windows x86 arch:x86
59037b7c010c360a4862d476cedcd682
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord685
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 684KB - Virtual size: 683KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE