��t������#��P��H�2��1��%dz0����[�;����c��!���[�t#� ��n�:4�c����X�C��˹^C;��r�����?�pB��S|Su)�����4T��q�g�AR�<���W��:��?���,�At<��%���w���?��������d�\|�y��q6�k_{����� ������ ����=6��FV����72|���J�� ��0�<O���!�]Yؙ�?�'k=�J*!z���9mٌ��V�ft������ \�4R���&�$$)E?�ۤ��x �������#��!INӁ��� 6�d��$�Q�m;eh��rG9�� �J��׳�kdv�r$伅�}����a�*@ep����|~W[9<N��{�N����X� � |�R������J���C�oQ/-��)U�D��U]���aW���F� �#��!�Lv�#�>�H1A�����7�=�� ���Qj�2��ԥ����MS� ?g���O]���#t�M;C�m���#������F���ڌ�i���B5e��z܍p�����j�� ���N�ut�+�*���&d� �����OOȡ4���&Iɡ�7�^a�j������'xLb��DT��͝�D�LFV��M.��`�5i�jN�j���G��XOU�,|*' ���)�.�C�'������*��q�9�1���i��#S*����B����o��6�&㇆T�f=�U5����5�\C��y��_�fz"[���!G�*O���#�J6����J�Z��A��'��]Vq�Ӣ��__�x�UO���z���E.����c!��`�ܪ֪J�dDž�$<��o4c��Q{�*�9 ��]'� �Fo�7+�*Q��R!Y[�P�^`;)��65}�����O*0�C�a�D�M�i:��6\O)�v����KO�̭��)^�W�:ml���x���b�ʩ�o9}��C��s��5���I6�B�+-Ù�vq:�T��zY�v0����c��������р&��r�x�NE� �C���u��MLz�����{�p~��Y�?3 ���H�=h\�C���d0�V��VW�O�_{���! ��l �:���F!���/����kD�z��&�g݆ ?��=����b�%TdD��l<�����E�F�K�����h�ޛpG��qP8�� ���DN�G%���,���e��欶���D�jn���[����l%�^���U�����!����Q�2Py��bVd&4���:q)�oU(��+w�����(\�����ɥ��?l����at:��mڧO���ٶ[J�b�6�?�Y�%f��D6�<���wz��zU�y�qegJ��_�Nغ,{�qa�$�-j/�p����N�m]�|ٛ]R'`��̣Fh�ؗ�&�P.�V�p<,BU�O��.ҟ.���b3j���45�H~70�~��q���f��9��h 5;v��K���͎�w�dzǦ�2�]TLt&�@��Œ�P�o��|� ����}��XphV*W��+��ݲ�ַ�ɽz�F�a�|[�����0�+��G~�9=��^�N_��,bi\2�I��X�n6D���������J�Yl�BE����������V�n}��/��R0�ZU�k�N6�Ȋ��.���M�8�+#���lO94e"Qnt�0�t7�?B#_]s�C�U���^�H<o&8��nv`���s"QLL��ӆm�}Q��Z� +��9T�?[Ld��2���ش�ZzY�i v�����!����`!�v�tI�3���V��_ZN3�dW�D��A�T���m��ɭ����dړ� W���Nm��M�N���� "�N�I�! nt�l���l�Y�MY�Pa�c\�u�S~q�`V_k�c� ��uEy��⌔���!�~��P-�Be��\���v�ښ(A67;�p�DjX!w�{�1a�ziJTN�a^�����G�~��3�y� ���r���a���Lp�#Pp��$!��S�L���S�cOÊ�{�X,^�B\��������2�&iLɳ�J�k���B����;Zꑼ!Mi�����[����)y��3������Aռ���\ζ���\��_K��Uަ��m��w��KM�aDiv!�QC�sZ4���`�^]Y��K)ԫ>/2���7&�N�t��M��hq]�#��\`ub]�9@v��� 5��ɟ��Ũ��jTk�VYC�B�m ԫ�cc~++���O8F�� ��� weE� �;�����`Et_����c�:}i$�^��eT홶���h2J|C��P���i�� �u���Z���f�6�����e�=�XL�<���/����?&��K���JdMH|�..(\�� ��|^�1궖�c�&��zG���&��*Te<�R<*�ߗ��W��x�0�?1��j���U���7�pt���ώ�P�4D��O2s����B���G�A��1~ӋB?A����bi�89�p�6i������S�Jx�^�����r� �'!���0�؋3��;PX��S~��Yx�i�y=�r#��k��*se`7�n�(J��K��ͫh�<{U����bO�[蟷/>h�c9��on[�ILa��R�0?�9`��SE��M)��"��H��}�BS������ ��m]�Ը�H������TY����Z��-�E���X�#��b�|$�o��]������CJ%����n��)���]�Ƨ���N{���_�q��x�l���h��a[J� ��xj!�J��,霅�zђ/r�[É�Z� �Le�s��C�[@ �����{HR!B SÍ�wW��u�O��]��OP�Q��z/��G����F�j��֛����[���MRN�������9U���;�F��J�ժ4'8u+a��G�$O�^W�������k(r0��O�*�X�m���}�}�����������_������|���.�:����N��X܃��₼�|�ī���i�J��)W+�Ē�<)4ʑ��j����o�ڼ�0JG8_�g)��`}U8��V���_���j,i��3�ճ�08�cU.T
Behavioral task
behavioral1
Sample
bdc74e8c96bb8aa335339154ca9a2998_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
bdc74e8c96bb8aa335339154ca9a2998_JaffaCakes118
-
Size
240KB
-
MD5
bdc74e8c96bb8aa335339154ca9a2998
-
SHA1
069eb41c2e54f4f531a0091b55152a38fd26a299
-
SHA256
456587141db8779ac262c2c0e10a7c351a4acebe07ba2283a05a0a3a70d06564
-
SHA512
f7ef1fcae6d0ad211f433ef0a20148913908973a27bab39fd0530a43faa73f58830f4d4a9af9faed9d4f84942c7f604714a545b3df5328766e676c904b61cc89
-
SSDEEP
3072:dMp4i+eOQDFNZTnaLR9UzRgB6XsZ+FX8mRkbuKpH3kqsfqqKv2uhhNw:SCeXDrZ+tgOEcsFXri9kqs1buhHw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bdc74e8c96bb8aa335339154ca9a2998_JaffaCakes118
Files
-
bdc74e8c96bb8aa335339154ca9a2998_JaffaCakes118.exe windows:4 windows x86 arch:x86
cc4234db3d5445f1896e66d2610a9e1b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFreeStr
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE