Ѝs1d*�H�u��N�I�����ZvQ���m١�A�aP��@t���Q�W�<4��{�X���;|ʜF��V��C[?�`��QN���������Gg����"�a�c���4U�bS��� ���ia��";����^�z0���T��m���N"/���K���[�N���5�I�[N2���5��6�#����AsO'��۸��R{bۅ2n�RRAi���ʐ��!7��������X�S���}�^�$INӨ���aF���W��{c�<�����A��*���Bu�;����J����8�>���n��rp���r��L��.��3���P�����G��į0�c����|0�52� )|�Ⱥ���?'��_��e�x�$y�� ����d����1R�+C�T&��o���}�����9�~�]:BO�V@c|7�O�/����F)�����D���ǥ0���<���Ϫ�6�:2 �=0����B��2��z�`� �$��| �U[��p(罥�˚�� O�5GǍ��j���}���W:1�H�+c�:��*s�7{�m����\؇x%S��%�Z���6"0?Tj���TӬ����.�Ŕ�k��k��vj��{��Evi�XvU�Z��}��Lk&��ח�<=5/=TĔ���;�1�ofw��eE,�5.�H�*+��J�4�Z��*Vs�}�����7�����%���2l[�m�iJת�}Qo�S;�������V{���>��*h�*�+�P0ٓ�Q;�+u>BM���;ׁ�K�w��o�f *������פ-è]̄z��bLo��1 P&�3x��KY@ P�3�[t�Kx�y��h!���D7dV�oN Ф�"��8s����܋T5X, ��j�O�_t�q]���������i�s������q+�J�0���,t���}�>�u��Ǩ&���\����#g��;�<��<�_1�&\�ß&y�h$���#���r��"g�:�w�֣���Y�]Ǧi�p��{�@@��M��*�iS��'��ݨ���.��gp�g�x0XZ*��މ1/���Ez!�R��鷵��\8���!� �A*��t��&Fx~����]Z�����j���U���O:d�T��;���o��W�-*?~�$���Xϐ��4��%����T �������������qn�������Է�5�e��M=���������JĢ��#u�}��,q�e"m�TX8X�%�8I���H�f/�V��oN��w���~���3���E1T�Z���e����r�8I=�,m��&������s�Y��0�0[�H=�_A����g01��x�(�������9�� $9�=v�uuiZ�DS��d�<C��yZ9�Y ���6��=5͢��mr FFOX���� �/�b����_�д6"= 7��~�u"�u�[Ⱦs;x�����u��N�9�{@�B��K*+Y�����,����y%H�/���v9R𡳵Ih�j��A��.N���d���N��Ho���S�Hb��a�|PC}�Ƿ�e�D�# ��D��q�S��ݏ�}�E�Vjl��5ᆊb������[���V���#%�[v��[��S��H>�TQ����y2����@8��lg?�v�֓��.[h'샛zsRD�3�t�̎@L�g��<o�F��zV��N0s����w�ʪA���8*�͌�ϔz+$��(�������.��EY�'������'v�� ���!�%��~�����9\�l��\^h�C���YF�������b�i�-�ᘂ���p�%���ᅼ<17� s�G(&�I/���'E�aa^���M^")U�۹�b5��X���#Z=���2�����:9qT�M^�N�y4��KC {P����⍑���f" �*|r�"��L(P�Փ�6�;a��_)UΖ�U�Z��;#�p�|�H�۾{���ۅZ�^0�'����EFē����9�� �{�Ę̇���4R �C�����:P��-W�d�&FU�6YF�@���4Lc7�8-}�e�%���Fc�Z��\(�!���m �[5|%�#�j/�p!�_�V+�ԃ�v8ݮH� f�Y�%�s���g,�p�y�x�~С�3 q�F�.[^f�@�C��x��oQ�b�����%�p(����PQ���P�?ۼ�s���K�l]f�pT����6�k;���s(|�-��u�����l��¢���ңU� G�<�0��M���pj�)N�y:�i�i���3��~x�O&3ߺ���C,R��I� x 3�Z�#bLo�S��x8'�,C�ܻ�Y"~�p�Z �����?�LPlyx`���ؓ�(|UZB���sɠ�T�"�"��|��P���]6f%����6�wh3�5/�R�5i���q��@�A>���h�( �$��?e��-�j��$��N̋�Òy ��L���N ڌW=�!��Ф��"����V6ˮ�� �e�i�歝х_9 m���>F_�n!��|�#��zf��T�"�y[��6��ޑ���s�\���Q���IKȢ��r�P�g7�G����J:�N����a�I&�������y��'�no�ѭ��Cx��U��]+�Ьy���(����T�(��������&�__���J�&���+�ٔ`,� ڷ�f��2+��q$ͫ~�O*K_h��9�@�%��O���n�S�[�ةt����v�ᛤ��}.���� �3�Rv("n�=��K7w�)5�`C��|��s2�2P�/��]F�"����r������æ�@ے�o�K�m`����s���5D凤���Զ��.R�{%ɚ��9y)�ܣ���m�Y~����G"t�����邨�ZW�Tb��LE��0w^]�#��Se+��1�%�����[g�������͞bX\�h���xQ~��F F?��y�XY�op�����ru�TQ^E��v�m����9�������~�����������ѱi7pَ>�ˌ{���?�L����Gun�����}���79�P�Eԓ���DZ���Ot]���!:�6���(��|ٶ�:��
Behavioral task
behavioral1
Sample
b9b79afde2d7e50584d8eac1623ae45b_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
b9b79afde2d7e50584d8eac1623ae45b_JaffaCakes118
-
Size
346KB
-
MD5
b9b79afde2d7e50584d8eac1623ae45b
-
SHA1
27bef982d53430e0d90e161f55c092bd73980fc4
-
SHA256
776420687ad0ab2384787694e0800dcc66e1843516e52da269a828a0b814a4a2
-
SHA512
cbb7df69dbd42f6212437037b342164019c925f2a6243637c315358b33e691638cab0bc489fe227dc10596d13a27f40e2bedc1a4b9d4d22e7e3c5d3f1ce096d0
-
SSDEEP
6144:9rsf4bikup4v8EMBCwKj9FqN3iCQpe3u0zkOgmczwKobhpH0jQa799lTvJ:9rsfeQREMG9FqN3iCgqnhgmQw7buJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9b79afde2d7e50584d8eac1623ae45b_JaffaCakes118
Files
-
b9b79afde2d7e50584d8eac1623ae45b_JaffaCakes118.exe windows:4 windows x86 arch:x86
df5e8f74117235ea96ad96e7c26017a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
�e� 0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�e� 1 Size: 248KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�e� 2 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ