US�X�`�ī�c�8�_v�`4z�50íf���,��T�;�>d�I@�p4��0����wfu�]�"h��]:�p��Z9�5S�j(�������&���˥w���x���U#H��p������]���uL��,��z�E���0C,}��w� Wԏ{l\1��O�_�������L o2$��'�\�גRMx:z�&�y�u�z���m�#�Bk��TqNL��f��e�ː�콋B��S�w���~� yl� j��=j���.��c�X�PS"�� y�|ohEb[:��!^�ost��\x�����{����\�`^yN!r�'�} ��Ľp|���l��@Y�v���Je��]�8�z]�>���_id�����4�-]/b� *�������2s�d�k��Vk��z���u�#6�g��-���R�_�>{/:�E:ÞJ�TX���$����P���=����S}�}�o���|���Jۚ^8#ݤض̶���ud��n#;��f��]��<�^6�a�A������N�1��^q��ۙxE����K~7/�'�h�v��YP��.��/��ɝ �4���$�-V�ӄ�C��pX��B������QÁ|����5 ��4�P�4��*�H�R��<7o+�F|��b�0T5[C#�]qԃ���Hx����xx�P���e�˱�=���*�ov���w1���m�b�I���Ʉ��=S��)}�学6�<^��(sj���<똵E������V��C t�����7��z�3��q�2�~�fᙪ��Ib�mCH�ch���#ENkz��p�_�ȗ Eb���-���K}�M���T�Nţ��+5��X�GW���_c�M�Ug��f���)��Zf��y/'�Wu;?N �EQL]�R��c�K�2D��r'g�]��]��v���ݩ7�b5.<ArВ=H������N�VvW����nN���U�њ̑^B A~C�F��Xd�WΗv\��]��5��� ���lÄ<�=���)���Ż�~�C0�y���2&� �����B_��_�a ��&�s=��,p�6|F,룋r����L���(��\��=������M=�z-M�.ܒU�g��7 h�Ovnj�j�]�y���7��͔���Dv��U��U鑷-?��?���I;�;��ڍ����%��3��Y�xw ���5kH��9��=�R:��o<�5i$zv�8����� T�t;ե(nLZ��%��-�uM��ƴ}C_�s�]mYsJ+�'u���o�i�'���n��d�i��q��R��jQr�`��\g�ǯ�LL�?h ���DC�&��AM\�&���ׁe�W�,^���M%�[lM�y�{�+�39K�1�Ad���j4�/Sh���c�$#����&���d��?6��S#�i��%�ڌ!��Y&e�]��}�������k4�,g�4���D蜒8d�f���X~���]pa%N(��xv ��B��e��k��0��Kʾh|03:$��Ry�xS�w95M��d���ҾA�6M)�`�!��1b ���?dI��߉R�+ l��Hg�C(��M��W�[?�fA���Zl�-�2?�[�0������wK��2t �(>:��7�D�o��!V���'�r6�Ss�ȫm����*����J*¥ v���[�m%�ऄh-,E�-�j�ee���K�uE�>����Ҥ]���d��%TulZ{e ��������r��]&(N�l���$���+{&G��G�m�R�.�=�X}N��"�_'6��Ph��*D�Y:b��n�L�I��荥��`j�{D]Y+�",$���zoO��ߕ8z����ғ��*�����|j�l�W@�x����u�=[��^���YV��|�[7Z�q�A��-]e$$�^h�'q���I�f�#YLL�_�K ���Q�������Xa�d���[5*�����S�!$Ӭ�� ���Ƕ��v?٭s$2�Bbi��N� 6�z�IL� Q���ry�iaPV��7�cu{?�-�� &]9U��v�Rl�Nv3��W�ܻ��R�)��"����9�/ڊ���HyJF�z��۲%���w�G*���U��]��$Ā ���}�i?�R@\�t�h)4¡�x��Mnptp��j4��o)�v���ć9/ �D�U��J�U�5T��JKeka�0H��7ed������N�.�fBBz4u�x�C˧�����`�[_d-�"p#�]!�9���b clPד��?}��\��Ȉda��f�F��W�����O�8<L���셲��O�� ��D�T."��08d���Y`LE���j|�!��Gin:�g3���jE��m�2=; �@;�M9�U���_Qg���SH�A+���H�@����Jcd>��_������[�ƞ�W|O��J�E�W��&�M��P���yO5���:-v�Jb��`��l�3L�(x�������@l��<�N�bi�U}k�P�-W�̑O��9�Q8*D�Mj5���^B��� hdw,@(�R¸�g-=�o&�'��ā7���X���He4|��穚(ȤŹ�������hX��^T��l~�CӠ�c�e��U�k�е�����ڊ�+��"E�u3��ت�LOƬ-����[�y$��t���H��g�J������u����5{�W�IYi���V�ܻ��k �o���T��sQI��>(�����ɋ�ḷa$ Ms� �t��/�ϊ��W-���������>wj>����w�_/�^4 ��G�1�]VO������6�n]Ȋ�B���w\-N����Qfn+��s*}U� o���ݞ'�̹���(��"!���{�F���`�°�����m�CT�I�i���!�T2�u�|�C`�/��)���!�z��*�%n����x����6�j�2��GCh鴫�]��g&<q�P�ah9�$�h�ꁘX��u�@ҧr�Q�M�������ך���E�@w��s���sA־ܹۿ)�O������b�n�Q1�ڒ?!���xW����Ԩ�W?���]�aR��+�q��u�P�h����V+�������_*G5����J��
Behavioral task
behavioral1
Sample
bf5ab05286f4e49f81cc0a082a7f0843_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
bf5ab05286f4e49f81cc0a082a7f0843_JaffaCakes118
-
Size
236KB
-
MD5
bf5ab05286f4e49f81cc0a082a7f0843
-
SHA1
92779d3c3756cf32e22478ac1a4d627d38c186c5
-
SHA256
d4d80440a4263125c23082881feb690263567a22a30686f1aafd3da04e4e8e50
-
SHA512
c84bd1adb4c904c89ad0ffeaa0f7d8a55e0cc82802f654799269c2f51f733b5275c92ac56c24b9eed29af2b29f3776a71a0c2148b59b978296412e249b6e6f24
-
SSDEEP
6144:TU3UgZ92WgpdOeD68L/qrGNEmCh0fQ65ke0hXKuA:oD32WklQGCmr465hOXKu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf5ab05286f4e49f81cc0a082a7f0843_JaffaCakes118
Files
-
bf5ab05286f4e49f81cc0a082a7f0843_JaffaCakes118.exe windows:4 windows x86 arch:x86
21af20e3ec4308e92106ff4136b7791c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryLock
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 220KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE