�r;�yz�i�9����ϐ|v{�_��8&����:&��JK���[�Y�@�jQpփ$��DG���k����f�|3c�)�B���vA?�.OnȰ>-̲I_��\���V�p3��_��P��3�]j�6�{}B&��l�s�h�&����S��1�f����������z[4�,�W��cQS�c�!]�P������5���?ў�y�w��aQ��gv�1�)��@��Sx��K ���{oN�`V ŏ�K�/�q&��7Z?ޣW��{th�^o����M��afǁ��C��_�ۻ���t_A��3ā0�op�W�.�4��� �)�1�B �MP�*�kǛ]7�p@2��#��^;p7>�-�}Nz$N(�6Y�~c!��њ�\i����pq��Blލ��W;�m/@V��Kэ2�q���I@@~S��>R��\��p���J�l�u�6|ٳ ���7@������z�~H-�%[)rG{v]��79�Z�[^� ����T����%�]5��'�V�qU�2�m\��B�w�^B���R7��)h �u cۖ3��2�������(�?�P���D�αNQ���;И��7�7�f뾰LAb-?c�EΊ*k�����^$�T����Y���?$��(�i�E����2�QP�����P��N�篨�n��KJGJ!;��o9e��Jj%��X~�'kBe���8w�����j�̚aC9�"��d�Vh�tF*��#���E�\���ӤZf&����X��� ��b��R�'M+��]h�xAg�n%�n�,�U�n|����h�n��h�a��:ƹ���#O���]�H�t�ea"�V��#t<�W 4x�� �#������ �xQ�r��p�x$�c�=�4ѐy��j���5D�k��D�'�����S+�55�ڃ��g�����Z3��-�s�BMHiH ѓ'���Z���:f���67=[��K�_Y\�졙�`��y3��� � (}/6�b�n%�L,q��`��R���b��r�=�D�$)*ӏ�9l�����0�PjP���~ c>>y"p���i<ª��rq�:���hg�r-�]�2(�e�А$[%���;��I����!D?�)iB�u��@L>�=n��]F�|b��[����L����I U���ɕ�W���A�*&캤/���Ե���'�bD�ql�V'�~�GwH7����0�R���ou�O�H֑�Y�������$w��_��8\<J=e��{^E=��h|���&�]�:�1�4Sz�0����z���:�BQ�`g�S��I��x}�� ,K� ++o�ڰ1i���� ���]� ��{B��&!�����8�y�;",�{k�-l˥��Hn�d�i�9G��S_�Dgg?;�/����0�D���IQ]R��{}p�a�i�m3�MI�4�zH�"�2��t��ab謈��ҠiN��j�[�['�il��x[u>jڞ̗]�6T-)�$0��>�G�7��Nhp��Ǎ��Ҙ�V9��� V�a��E) Y.]a��R�"����v�I%'��v�pcEj���Fl�E��#��I"L���H��TW!��>��%VS�=1�����K��L,,�vt�H�sm��R�VO6���-*Tt��mzzG$+)@�?�u�[��{&�4S���5S.(��vC�-� c�Ԯű��C�����餈�J��f���ל�We����LJ��PKA�E����v��s̵�b��wᑦf�$�,�Y����\����#��4����S{8��d���M�l'yʵ�,��؊�|�HӢ��L5.��-Dz���~��ъ���H�Ý�8j���>�-���"qyNQWR�cv S�˗��@�ڦ~e�g�Jm3����5��IYo��¤�ބ�O�Tj�#k0>�U�픳��2��6� ���d�Z��'�C�Y��7��ۖ�zk�^��!��.Ⱦ�fF��7I���Y�����Q����`��ˬ�B��dx�z+U�/��ǹS�9�� 7؉��Z���jS�n���������� hK���t�����,D�\�'�饌KI����o'�29)�#Ύ��[��7G�7ppI��$�Az[��z�rz���E�C҃p�����\^�X'�H<��KE0] ������8Tf_"܇r��e7�h�[A���'8%d�|���n�@�$�@ほ?��/(q?��6��rr�������V�v�W%{�)"�۠��BgG�K���BFj��)�F ���L�)�[�Rw�xt�:ޔ���º�e�����E���/�#Ėe��\����" �S�*彖�@Yi���Psx��]����'Tߌ���� ��VU���kh��YNS�i�������w�+7N�c3�=��h�x0;�n��3�1t�.��j�Oh`ƺCȢ��e|O��d�vz�= �=�<7�ne2t�Z�x�b��������T�~,���d��T����ߘ���B6��p�:F�5��`������C�V�PN�M��Z'CG݄Q�s��_�pt��^�H�P��6O���xJ�bLCvP(R��)���2/��w��u������>��'�s��u���級W9������oO8��tk0v����G;f/S����srr�̆<8�����p�[�Z`��M�͐��q���Se��gqh��VKX��G��\h'�D��b&��~m�/�҅D�[F�ʯ�C�u�Fv�;P�*-[��w|�v�<�l��w+����P�$Og�=h-���z��X,�bB���T⹖�?� ��?]ѓ�5�8I8YѪT߷i��\Wa��/T���9e���Q��*���˯�{��l��z5�L�.G�� 8-+���?��W.��Mms��&�_b,+����8;�U`����>�n�&=TuS��k�[B�YD��v~�� <ek^�m�4r�ˆ19A�A��u��H �L� ���� �{��/j?�w� G�z�����3.̈�F���=��$��o��w��=u�H]���������g�yR7x}�dq�ݽ?ą6�m<@��Ѵ���Zyn"��2?�E����
Behavioral task
behavioral1
Sample
ba0a1227ffdc612af72e7504e0d51ea1_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
ba0a1227ffdc612af72e7504e0d51ea1_JaffaCakes118
-
Size
124KB
-
MD5
ba0a1227ffdc612af72e7504e0d51ea1
-
SHA1
3d8c88fbfe20e13665d1806f8a3e19a100276e77
-
SHA256
19f56bdf00921d68337a7a496a8cf1af82198ff1df3a7eb834f7c17a3e4a5227
-
SHA512
fce490623c5918b1a0aecbc94116047b23f1c3ab58f1a43e15b7927e987271d5e2458098e0769b9a1d10f0589551ea1b71e87fe0d48bb12024fe0258ce3aa071
-
SSDEEP
3072:hqVqrjk/4eCCmOe/ACpWDd1pbzXPvFleb5NnaJM:huq3k/KCmOLDxLPvFleTc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba0a1227ffdc612af72e7504e0d51ea1_JaffaCakes118
Files
-
ba0a1227ffdc612af72e7504e0d51ea1_JaffaCakes118.exe windows:4 windows x86 arch:x86
c84da386a07dd11a2cab562a5844f88e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateSemaphoreA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
??1type_info@@UAE@XZ
comctl32
InitCommonControlsEx
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 104KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ