�qd6��$�r�mrgd��z����Izƣ�IR����6j�➋�%��B������fi��JїD�FG��z}�T˴�f$X��� $M�~i�sE�g�7a9���������O�=�ѵ}��[��h~!���N��V���+�Bd3x�9mY2/~�1^ �$ېc�a@��[9�fl�d��Fӯ{�;�}П�ꪣw����ߊ|lm��k?���V*z�&���8,�(M�L��{���> [3X��U��<�Sɤ��HY�����/��u��+�lɱ.El1�d�p���v@ިB~�Y�E���.^����� <�4G����j�7�%�g9+7�>����9�&�����մB��hڔ�� T�:�����݇��"U�/�P%O��w06|�p��+���]�?�6�s��C �q{^1�x��)"�C��3Z�Nd&1� ��'~�˚Od%v7��ח(�Z����W� �w�Nx��P��q���� f��^}j�V��mLH~͋�/���F��őA����t�0��}�� �׳GI;U���̅�/�P§h,3��@ZV���UP'�d�s�� ��4m������ /��C��7&��٥/�C$X�[�t&�"�,F�v��J�ؚ�6�F��&IZ��:mY����D�9H�8�=*ˈE�<�u��9+'H�}Ӕ�����QfS�vn�����}~z7��|c����8��J�_(?�'1�����i�]��}�"ǹ0TR���}�ו��eMM����"�j��F2��I_�Sb���|��.2p�_W:(R)R��̿{��I̝�l�Mw��5��P�]�Zl��Y��� ����R���#�Z����H�Y2Y���|��WKdS�s�%W�t(�ba�x��4����/�ٖ��d?%=��H9r�����尾_���A��wJ� �����X��E���!���Iyc��F�KT*5~��*~6,D�.$j��ۜ�l���B�͕yФ����~�0��#|D���,֡r�p�E�<E]�Ụݱ�̅�ls��[]c{��KO�:�/7M UtL�1���x}(-?Vj)��$���8Ӳ���H�'�Fk�S��&�3��aOE�zX�_K1�$��+�tT����B���܉��f����L�^2c��&�:�tY�-�q�6_��:$xOG� k��:��J ��p��ɔT��ZGu�O�Pf=-��x�h5>����{0�L�<��[�N�J7_RW��Q昊T�Nb�N���Ș�n):��BD����Dq�#�K���/�@s�Qf����gEˁ4��1U�sӗ9w��w�������������I9�����g�U���M+�����[���a.���0V�iB��1+�D`d��~٧���>��G���� �SE�G@���d���v8��*cq���Ō�a��k���BVi�x�9Wk�&�0EPR��7��?f���.������YN+���\઼��v:�Q��X�|�T���M�Jd�������=���1A/F�٩��e�2;eh�?k���A�!I��9E�&��Nbw���ԭ�v� ��w�4��I%_���g��/C{�E���~qR�K������^� Y�[���ޟ�"(�� oĊ�����Q�Po�&����dzR��z����������2-z�H�_h���ǽh��BTF����i%���P�x��?l#n�jyY�����qD�j鱉�0dt�\�H��M����E�����Y�~q�*�t��9H�Q*��{-g�����#�y�j��,��ėW��9���>�������5-���3�ڍ�CI�w�����4m�Fl8�B���h���� �ޮ��"���R��鈝�Jo�7��Aj.��::��=���ĉ���,��>�*�KԄ.��{����9o��#�N�U3�x��["�B'�pއ4)��k�����D =�|Z��g�n�Ft�[�@��>�t�w�ж�n����؟Hy���<�ݡ����������B�N��}��w"�8�Lx����������@4�����R����l�TV�>�Ga�i9�J�9io�����# W@��kǶr�:p㻗����f#����+p,�>��K).7�����<� D8!����+����d�����#f�u�6���7 |'S�Gো OZ�b��L���g&FZ�f��P����+9E�M*�h,�P�)@j�O�S��: �˖��`*�)[t�>D�PP����%�Y�$�Zg����*�a���2�}ۼ�5��k*��9!_1���i��UY�s>��Dk�LR�#�b�D�}�XY�u?���_�~$����M{;�]^`����U��ߘ���;@�[y�����v����y��t3H�z��q�H�J�_��*O_�m������D��%QTq[�\����N.>^+�r~O��ˆf_���.4:)�������ܯ<N��䇋0UO�F-�O�_m��1�������3t���;�t�4�ue/�RSx�� ����Y��/q붠���L�ú�U��y��ے�V��+z�B��p����*q�gW"@f�;jJ5�����F���U!xx�����YC��߆G�[���(��-�s>�8/]KW:�C�����leY��z�r����� �P[t��F������?�S*å�����!ˍ)v��̍K�N��g�x(k�!�絫r�$�b���;�������� �R<�(�T�?������ݢ�e�����b�Ӹ�X���1���7��~����?����jM�}���H��F���Ո��?��!z�*}��d҆w�&���[H���SA��`�v�x[� 6ZZ�~PE_dJU�X���[if�75�N�#I> �����ϯy���u�������$�c�H�y4>�mQ�Yb����?���l�ٌ���z��Leu����o2�N<�/���0a��f�:w�W�8ei�\��`/���D�� s�l�0[UF���������+��b�����ג�<�*ȳ7q�op�g��4�h�4����AE"f���v+�s�T���fv|��(�6��.��p�s�>%�R�2K_�i�$ ���K
Behavioral task
behavioral1
Sample
bc86970c31660b4a555cede0a865142b_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
bc86970c31660b4a555cede0a865142b_JaffaCakes118
-
Size
736KB
-
MD5
bc86970c31660b4a555cede0a865142b
-
SHA1
8af301527ef1ae827055fc5869bd6d46bd0b2074
-
SHA256
e0ba238b547d18ed81f7d7638583d18fe6f83ef7e26eb8dfe2f3b4dc1ad2dcf4
-
SHA512
a54cc84e4e972f5bbdf19cd1a0d3b16c48cc22640f6830f94d1baf0200d6928021ad365f0bbfc0d53398ae146c8e640085d4b9b5aa87169060d769afb3dbc26a
-
SSDEEP
12288:CLTCbhosgDo8in/dO/Dk5wZUH0t4aj9gAFgRNLm3H2adconKRR3ddAW2diM:CLT4FXVOLkGZK0tL9gyg632EYRR3ddKJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc86970c31660b4a555cede0a865142b_JaffaCakes118
Files
-
bc86970c31660b4a555cede0a865142b_JaffaCakes118.exe windows:4 windows x86 arch:x86
5c30ba8faef7eda7fe7c18e06e3d0e32
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord528
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 656KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 724KB - Virtual size: 721KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE