��i=ߜOb>i�;��e��b��c�-*r �Y-G�8'�'�5މ\UOlkr]�t�Z��r�{9�||�=�<��m�B��7��~�h������;��ЧK$��̯�+3�E��"�5��v�� �;IH����I���/�ל�c�Mj��s2�"k�E�e�%�V%�,�i�u:ƀ�6�~V�}Ƥ���O E�����2� $.���}- -�E�ol�E�A����7�us}뗦SY(�W�@ l�"Z3�.Dͽ��U:�ҭ�)�/=�M�}���L��o�R���D�<L�b�SM�ڵ�S6,E$:�z�'-`�U9�r�T�[;0��ۄp���d"KL��R���dʫn��_4��xy�AuJ$7�)FN�����"$�W9��a��)��&2�d+E+�/��ʫ`���+�S(��l~p���>������?n�2%��y@?�Q�Cj���Q�>U�� #��Ԗ�8�4�FF�9 /a�<c7 6o�4�\�"�\n���u9� {��k�/��tw��Ꮳ9_MHI�z�=};#��%�x���}�L�l�l� ͘�b�u=4$�R�M�nr�w�~ ���Ҭ��X6�ț-v@�� s>�ԅ���QSغ�<]/�os�� ��u6�A�Є�1��`z�x!҈����~��X���`3�<E�Jk.J~�<{�<E|�" �� �w������(������갆Ϫ{��щ*��c�M��mb ���Ь|;��c�����+�S,]O;Ke��2(��z�k�`���?�D�{��j�1�RT����s�E "U����?R����B��'�Q_ ��V�W�� 0sx����eT�P�IW�z=��a��UV�Hi8}��`�F�|+�ĥ�jbh��v9<�X�F��"�i��u)� �������J��"�>�%�eڌF��%u�9)L�2�s���\�/|+5��|���;�H����`7C�A���}_��2M�O!%è�W�+�+jwo�W�� �E�fm�����J qF���j�j9n��,q���C��:�:�As��,OGOаSV���&��oR�H��p�oK���ؤc3��Y��\� -."�h*Y!.�Ra\7Q���"������B/�+�9��ƒ�Lh����j�Ԑ_� ��3����#>�2l�c���u�u_ȅ}.(�U�4�6rV}�5/���K�eQ�z��Eu��$��DZ/�t��?y���Y8��^Е-��?ᄮ���6A� `�䘏E�W���?`4<n����be� �tg��$��3r�� ��kRLZ���I�]R�v���]Ѹ���xM)OuP�W��8���f��n�r+�dJ-�Y���Z��+P~%����nF���b��gO@�GQ����^�N�=s� ��:XA����{�5J �i~���4�h�E/2�w�Ǹ��~��i�z�x����{�;�3�����0[m�Ke������ү���"��w�oġ�ٕ"5�_�J�^m�65�vx�Q%M�ӖT��%r�豄���.�'W�j�j���2m�5�����ʕ%t��`x�W��>9?�u��2�CnMfw�%�m8�}����B��6,�kG������� ���M�?��� Õd��"^<&,k���K�,�1ߚ��"݆��4K��)#��o7<=�n��t�G�p/�p�P|rz�� ]��]�7<&��Bb2*�v#�FZ*�����(��{��6�k�wr��E�a�q�K���ss]=&�43���.�� ��V�z%����&�e�a��)�'}��U���z��]�Qd6X]37�r�.�����$Ä7 �T�F1�+�0v���pƕSӿϐŎӐ�"K�a'+ȿ�tULl�nhY����s[BI<Pŷ�$r��$���l��B����gkCӒ�V"R:Q{�;a<}A��1�Ӵ�3G�0�)��&�S�K�t+�#�ɳfz6 =��(s��CI������� �־\��r0�S������S�����J]�eni�}��]O!&c�0.����;Ԯ�aɠ́�YԠa��DM0T�m�K����L�YB�l&$�������!�R�>,_��l�K41x�P�H��m��fM�ϯ�`j ��,2N��~�~ ݖռ����w N̙��$ᏠJ��;̾�=�|���\N��=�4RAdZ2ˎH����~SYI~`�Bv��?�)'�"b϶��8�f(W����;&am(�v�g&��P.y�����t-��A��/y�A��$��Kf]� Hn�HS >��nt��S+�x�<���g�,L��0�Ρ�߅�c����b�Ǩ�q0fْ��|���er�A��q}�(U�े�]Sֳ?�m����Y�����h��!�Z3<�]���:��C���<-V���N� �-��&WN�����Ѝw�VN��Ӻ<-W����K=+1q���e��T�@��7e����N���� ��S1�8��j�_�V�F���g��V�o(��L�~gX��.ٵ�`����[��w����~�i��a_U�F��*?V䦫~���`*����z����|m����v��H� �hv �t��@kU���ܴU|�����kF�(�DE���k�9$�f��u�ͱG�,���'I<���Hkg ||�H�0��HR3�CV���V�����Ӥj�O���Hj���8��g����R���:i�/��ť��ي�Z�i�a-���\A��T�� ���� � � ��� f[�r��D[��H��$�\p�����ʧ� =㔣���G�)���hD��)�Uy z�-N��]^��Lݽ�'l�����>o�k���c�=�Z8s�w�x�lm����H���me D�$���T�H�gCv�m�����ab�7�1�u�;�a.G�j�^!퀰��ë��Hn�̬�,�d{N�c����:����X=�T9^�9|����gLK��^a��k�:8�9VAa�o��F.j��^�a_B3��J2�G�JW�O��{�qYAV�y�,J���B��)�V�K�p<4rlj�S,%TGL�� u�� vt���lW�-��N��qN�;�P�9��6�
Behavioral task
behavioral1
Sample
bc172eae3bbce782e5f8029e79eca33b_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
bc172eae3bbce782e5f8029e79eca33b_JaffaCakes118
-
Size
780KB
-
MD5
bc172eae3bbce782e5f8029e79eca33b
-
SHA1
eb63ae0e80d8c73182f64bd7ba9b04c53c5f5d43
-
SHA256
f2c3fa351e9911eeaf19c09cbce116e7e42f83bafdd6444b4c26fceb0e837b57
-
SHA512
cb782e780772985f82537d7a50094d1c52db5f469d5c745c7d484536cde966f0edff8ecdd7506a791b5dbd19da6535db1211f246eae0123b68fe41ca181c59fc
-
SSDEEP
24576:9uPTUiXijnIxVDZ40i/3cQIdPmBhBO6V+o9Jtxnmzq642Kt:MUiXijIxVDAcxdshMJ+JXDf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc172eae3bbce782e5f8029e79eca33b_JaffaCakes118
Files
-
bc172eae3bbce782e5f8029e79eca33b_JaffaCakes118.exe windows:4 windows x86 arch:x86
657f40f4e664ffe775e69ed3d32859ac
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
gdi32
CreateSolidBrush
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
comctl32
ImageList_GetImageInfo
shlwapi
PathFindFileNameA
oledlg
ord8
ole32
CLSIDFromProgID
oleaut32
SafeArrayGetLBound
wininet
InternetSetFilePointer
ws2_32
WSACleanup
Exports
Exports
Sections
.text Size: 224KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 320KB - Virtual size: 318KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ