" ��R=�X�L�iI���D�Ƀ|�x:IU���T���"c��A�c�Po�L�`7B53�����4�|x���u���}hEZ���D��#��YZ��2�I�q�nj�<}�sP�͆$����Ӗ�v�L�7����F?�p1q8P=%uU#4�p��!u�W����~�~��<�ug ��ͩ�-S�����ق������l>1�7^?��� �ҩ��IXP�N�1\��Pֱ,� ���c�y�XA#Oy�J@��o���Ϭ�u���~ �m�Z������%GX�-���*���cgr��������jZ�5!��3���q�IP��[���*��>F�K�6�1����Z�3 �t�Ι�����|���="�C=v�=�R(�yۘ7D��X���*K�0��K���+�������q�����?A����&/��f6"�VU��Ŭ�E�/B=M ^!^ ���%��oq��!�%ۑ؏4�2�^a�Q�k���թ�� e. cf�y�^�--3�h<�./�����ҏޢ���ZlK܆u���lX�y��m���D�a��mɍ�*ٕ��m�_�18���ɕ �uN0ǵ����pϰ�J��v�dcH'�����,zF����p���:p��1G$����&������/=�u��w�}B2�.R��!/�V��-w��-�v\ ��=PoȤܨ�n5N��D��e*T2Qyl�@�ߋE��ፓ_UQ�B�Y�߹���2�i��C1��������SW�'Mlxب�.�u�L�03Ax�ڭ�H��4�� ��di�� ��z��ZA^7�a�e'P�0w��.,�:jz� ���5�}SЀ�3`)�J���5��4��|�"����ti8����]��p/W�����p�g���;�[����a�������U�<^�p�$�xv���B�5AZ�o��^&�Y��[�t�G ~�K6!`R���@��נj���6��c��H�l�A�lQ��z�R"�Ua[(��<8p�e�sl��;�i�����Sh�s���s�A~<��R�pȰmAO�`��p�)v@�9�MbF�6jd}��&�@ܘ��x��ew㹢�J��q��m^������)u���\�G���W� J���0������4K1-o�i; L6g���C�ۛ���Vq��X^��UI�v�"2m�v�'6��X�z�z_ntZ�O̒����L�8e8X�nP�|��q�x�%X/%7^�W&�m���"ќ�*�(4�5W��(s2 ���{"�ԩb�8�W1����>����LHv]�ƛt�a�)F�D���W�����༖�����Qa�:=8,�����4� �#<����d���%s��j��__�Y��^���%� * �#v����f^Z�v����Ku�A�6k�+��m�KE�m�=�:� @+%�jNٖ�Z����������J�Z�����������cSo��H05_K�v@K@���2+ȉj���G�ߴx����ٳ�3���7�8��)\0��7�F`�[eH���J�̹>��.��j�<ܦ��]^eA,�%f��^ɓ��Omn읽��4#�|�?>�D�=�%+ҵ���,��D��sz>?�mk��b��:����M�\2K��M���QmVA���ط����id��av���<a���r�|�������]�����hS���/|����A���re/!����6t�$�rL�� ,g��s� ~'�͐���)�Aĩ�vZA��r��u�P��$�H2s ��iW��V�d[��q7%�k�UUc��*]�P�����x�Z�O~^�j�k��`�w�[��b�^��,`���n~F@��I��Ͱ ��sڢf��q+[GXaE���K�1���cn��h �:��U�i�|W���i�v��f��:���6�u�*PZ��}9�x�Ҷ��f$���5d���������1WCǨ'ZA��YT?�](=U��T�����/��o�q퀓E��IC4�Y@8�[��4�L��p2�p�Y��dc���I)5z{T��U[$Ka[�K�M�����x��oYn:A�:)���P��Q�@��()ɀ��Ut")��� -��Z274���/:��}���� &��-��C�M�T��S�3ϑ����)��Qxz�WgIq��9�����z�ĕY���; �B��r/)�h����̃���Cy�r*�v�<4[�MY����nVR4��1�)��H�W�݁ N2�������+[�.1� ��'�7���{�������kNQ��G?s=,Ws����;]�[�)g@���K�n�%�+F_�C֘�\^�v�7�(���g��T8�uO>�/�A��{S�O�R(�7��b��6�%2������+�`�LJ,7��#b��wJ���\�ߘݚlL=l�{0EJp˨#I����}���@V��?��U�o!����Q����������`"�^y#����3u�q�'��O����]���^����ꥉ�$AS�JF�D����x����|��u�>�#S �L����$.jl��H"�>���+�S�F'�������Z݄~��Q�c�Fv�%�)�;�lR�: �,����Ā���� 5b�ٻ.BQѡ#d�%��ԑ���q��`� g7t��||.F�ؔ��o��w<z���YhPW���k=i�cS&E]O���}�tX��7g\�H�sv����4�(~N�L4�s �b��l�(������m37�my��@V����Lo��ռY˯(��!��A��}�~dZ�+\�t�<��B���\��LU�O��z �'�RRy������+��SXg�ll5F��#���ml��0&M��c�����P�g^��֢#��N��v�!bSt =�GD ��Nl����]�^s ��|"%3�5�����]�Q�c�4��PI��g����j0h;bs*���@��G?0��_P�;��L�<�����&g��3��{�MQ,=ǃ����}ՈρC�3��=�w{iF�Կ��'����$���H��˧ͻ�KE�
Behavioral task
behavioral1
Sample
ba3ee89d407f3c7556f8f12bc2f4a84a_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
ba3ee89d407f3c7556f8f12bc2f4a84a_JaffaCakes118
-
Size
71KB
-
MD5
ba3ee89d407f3c7556f8f12bc2f4a84a
-
SHA1
fba8eaf9825dc153ddd9d310947d29113780876e
-
SHA256
d3d8c41b39dfcec944fd9f40943aecde4c0441ec763e37e8e41f47671e5a00d4
-
SHA512
553dcd702bdf5243240e8ac3548534fbbd7ca849a99e1cb29f1d054c9df582d9c8331491d7ee4fa9e6fb90d1764cd672ff7a747ab221bc93077f90201cb6d6cd
-
SSDEEP
1536:WCEn12sti73J83LjBa50b4YIk4c9o52V2mAig6JxZQXwkhW6htRiNnt:WN1ttK3JsngcIkP922VhAig6JxwwkhWj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba3ee89d407f3c7556f8f12bc2f4a84a_JaffaCakes118
Files
-
ba3ee89d407f3c7556f8f12bc2f4a84a_JaffaCakes118.exe windows:4 windows x86 arch:x86
2933210ca4fa335d894f546fe3853e18
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
ExitProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
CODE Size: - Virtual size: 244B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 17B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 52B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ