����N4n�7-g?����?.=���{"C��� X-�2�ru�N��!�S���P�ꓠ �E���Vq����D4��b3}�E�G'9[�k�O�Ʋ�aw��������<N~ޘڞ�|��=�4��_z {�"��8��`���5g��� �{�����/縟r/�ǖ�a���^��0$�x��r�����fF:[]��m��7֖,��go���;�� a�����b��D��\�8U�#u<���C�V��FW�%���Ƴf˔����V*<��cI�'Rq�j��<��ʈ£?���i��)� �s�7|���� f ��]6��t*�g���d��(�-K�{8I�'n���8e��و9q�9���j/�%�l ���G��Pa�̦s[n��KC$��B�����Wg��f�nX�=F�з�RN����C�arX�˸�S�Q������=���V�\�!����w����U�3�Z*���B�H� Lf��+|�O����u�.�YcW���=e�{Ѓ����ԕ87r�"��\���G4�$�T>1+����g2ԟ*�ka��4������~䫔#�j(�+T$��(���Iŷ�(EJx��8aDI�/��%J�Y�-�^ko�������k*Ox��WV�q3p�h�� ��^a��9��W�Ds[��9������ ������E:ބ�qy8�Mثr�sU�o��F`�I����2��nCg�!���Ĝ �:��u1��g����(���[T�v�.x�,ƫ�n2h�X~�@�aLu�XL�沦����m�-u�3<u�� �7�ł}S�@R�$Q�E�m���y��|Pc����RY���;d�hC���5�JO��Fcq8����7�[��$��G�����YD�����CC����QQ�M��na���P^g�=�2i�r��������h���X��go��I�ke�I�o�WUC�zg IM�f���2�_ Ѝ�Lx�,����t��|RF��y�X�lp�f�Uuh�h�DaЧd�;��WuS"onX^c�V�N����e�3���� �ё�X�y�Ke�����_���K|JA��ٗG��ʞ���R4�-K�����1k�zu���߾I4�J]����6��0�mhz�GTptU��9s~J�U=� w�3+��h�I7��ѕ����Bs���-X� 2О��u�QFZW�t����=��Qљr,���,�+�8���(�4F^���խ9���usۊ9E~̙�"K� ����������w�O������`|y�G��M�Y����;d�}Ļ��iI"Wpّ�˚S��!� Vji��/u�2)q�}4($�F��>�,����%�˅(�������*�`M�FO ��2-i4X�QR�9�א���S�t���F�/r#��jt я�^�Ӱ��DzcFu��9���Wg�jw�\��4��$�J?x$N���L��,�f������������n�A�6M2у/n��*!Q6��iу�[P�S��s/k�x��<z��ي�c�3�(�@��u-�J�ݒp@���0�_�J YO�`ƈzU�:�N�� ���q�C�U}5ڗ ^��qN�)�Yߏ�W�5�=K)ZO����S���K�&^%�kmG�4�Mgt����X��$�,�ejW~4��U1z�V�)��csZ����~��P����}/�0}��xE�p3p��ܶ�ױ'���#�0MjNw����?�pHq/&Mw��,��7D>�W+�W�iƭ�ӈ̫�H�y�� e� �3����>� "g�?����pEP Z�Q'������-��`.�f��?`jD��=�\����N�.j��{*7���l�\�ޚ�*K��ʝ}UU�d��s R�2�D�^�t0�z��~� ����^;����&L�K�4�n����流�T��۠��?�� ���&�E�H�"ӻĶqG)��-�J�)f�d膛��� k��F�~�5�ղ�u��e�k!���lD�OWA8�� >)�A@�%���0��p�(�5)mU:1�b9kx�z2��Jͩ��q$!�g��hh� ���s�%!�]X�S�\�o�>��4�\%���ڟn���%ɝ�K{E8�<���V�+_3SIa�s�-W��˜Cy�Gӏ�i�<��kh�Î&kWQ���.!���j��]G�~*�"��!�a6��b������dؔaH0�A�J}A�HPR����,�J@�*L��f�c�]n@^!��b�z����M���G#(52�O�&ɝ����#�Ex�Yj4�������v�Sd�� ��!b��}�T���Xy��w���0�������9\����|PL�t./ ����$����=Zg��6�G�7T`�~��}ٟ�����ls��O9��*����5�����Ř<����(�i/4��s�}D��{��_C�]e��cl�M��e ��CGu$��a̋8��Z�����*��R�jNq�������(�N 穜��W��Q�Db�M��`)O&a��j�jm끂M)n��&7-᥌:��Q�H�� o�V���i�/��!`<��\nd�ƹ;f�yn�eo� n ��~xBY|ۍX��ă��{d��A��R����w+�_d���7Mu3{|.V����T��V�K����@J��갵)�|ׇ̯.U�>͆p�P�S��Mcu��$-j+����k�n|ј���P��$���(E},�=�W5f���w�ہ{���OSm��3��<�\l姎��+�-f[���6�\��? ��<����� i�I3�0��(�� gqULΘQ���@��e���8�:A��EytEl;SQ��"�.nk�(V-<!<�h���k�˲��l�T���;�]Pu&���uq�b�a!��D5yyh/;��:0o(��橁ѻZ���QzE_^^3����W]��G�$�7d� ��%�SQ'Br��l�+u�5��c$�Y�N9��(��:�bǢGaF�Z�D��M¦&*�[qm�hܶFS�3@��>��P�����*�%�i���Y�{*4��N5_e2�hNT��r/niĘ�� �7�`ɽf�������K����S����I�����<���j�b �"�J��
Behavioral task
behavioral1
Sample
be6ecea30c96ebb734a37c9d511591f0_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
be6ecea30c96ebb734a37c9d511591f0_JaffaCakes118
-
Size
716KB
-
MD5
be6ecea30c96ebb734a37c9d511591f0
-
SHA1
46ce3d24542902899b6527a0ebc4f6713f511080
-
SHA256
02d714d7d10494e36d4a0468b038700b2140a2ab36c0ab0584277d4111bdd2c4
-
SHA512
d49ad6a7089387bb454ae664d70674e7a960e58f6a79b4d753a4b64095cb629aa91eb6064c083cd639796bb5e05347e992b38a277717e93f8aacb2e736b81fa5
-
SSDEEP
12288:RQAXh3aq3+B9uXc/oEFApbTvUQ4zQPFNB+/6nkoy5UKrVDcnY5jLBcj8:SAX9aqhMApnvToQjBoUYeKponYld
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be6ecea30c96ebb734a37c9d511591f0_JaffaCakes118
Files
-
be6ecea30c96ebb734a37c9d511591f0_JaffaCakes118.exe windows:4 windows x86 arch:x86
79ea7d6dc79931c5fc0e62543db746b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_Release
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 704KB - Virtual size: 701KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE