̐'�<6zԄ��k!(h8�K�1���������L�wq�cL��F%���ʳ�|���ю8��m����t t��0SrC����gC���(\���g)�_J�C�8��o�z��%�p0 �*��uzm���>��C��R����yx��RX��X�ctg]�~'/,DV����s�j��f�Sةp��,�n��?S��QyI�����<X�ʼHav�C�H�:!u�g����j.O���r��fլ�R�Kyjw�x�&ɹ�n�ʮgh�9����1�����R�%� 5�<�>k�r5p���;؊MT�"S�=_�E#�k$�5���"`�-�����N;�=�\D��u�+�+��:��j�Ř�2O(�s�3P�M���;����o�L��qb7'���5�ݳ �%�\3[a�PW�ń�d�ѕ���[q?��%�(;�'�<���;�(�ѳ��CP��U�"��*H��'Te~�$���N���1JA`.��Jb+k)u0'y�XF���U�j�b :#b��*z��)���v�DKäݤ��7Ns�좗�����-�ޙ~??�U���9���B�%�ZWQ���P�x���-o���J�?�"t��2��/�����)�� ��z��MDs;��:�o�, o�������cC��z<@^�.F3����T��'Q�{��H�I`n^�w����7(P֮��*e� ��Z��W�y��!�0�1���(]F�mLV��M]�=g��Yl?B\=x�1E��1��4�&����|�~��'X��ط��rͮ&F/'l{����"!������j�l�l�̒|�zO���7�KRC� ��a ����t>cK��"�;lv�j�K����/����Zħ�~q�K9�j�L��ײ��\X}��!���/��27��/Y�Pɢ�t�6Lv������P���Ύ���r��R�8n�XVZ�y0c�6�/���r�P�#���6���h����y+�߁X����V}��T20�����͌������!���������֫p���i������(c���[Nl8>�7 �s� ��_��\�m|�?_Iv��\�O��q�3��oؠ����A���~��*����m�N s�gK��,������"��a@+��*;��X)r6;��v|�����O���0��f�wτ����w"f=M����<l�`@������Ah�Q6,f�Ֆђ=/, ��uÿZ�A�F����/�{;���"��3+5����kv=N��n�����P���{R�a6�s���F�}�yk�f����&P��Ullc0��#*�"�(L{Q�f���s �����;N�-�QfB�w�;�~�9�S��,`lX�G�;B��:x4���as;�z����b������2����cϋP���@�E�,���x�E���'dwcrߵj���Tm�Y>1H?������,��w�&$aJ�F�fuI.�5"s 0� Z��iL�Q��x���I��" ]Вy�@�&��4�DyȜ�Nћ����0P����\��o�wE��[Ɇ(��^:SL��]x��i:)g�56��hcߠA��[>.�gD%$��Nr��ڻ+�~��vd�.��<�Ep�hC��[��}16����-�ρ�N��j�?k��!mxy �yy�R����u�e�GeG�I�H&���2��2!���!��ڗ�曄�y&:@&P9O!�LUsVN�*o%�h�ӯ��Ȏ0)����1�L����qcO��M5$x��\��ߞ������j=gl��s��cT����I,����7��],Vz�v�0����0�_/N�=0��sM�^�w{x��Ҡ�6���'8��`�j�M�愹d�d�v2(�x��fD�Qu�H�q�_g͊dj-V�cs��E�:9P���K��r&dd�((�Gby��ײ��ߣ[~-����-��I��:ぴ�F*}�c8�I��".����!H�����]X���,��`:�Ԁ���$�A�9^ؾ:��MB�����z-����$����15}E�K�>���E�0/��s,��",���]T[�b�<�q2;��i1���ij\�|w'T��<�6|ug����К)�g��� /el�&>u�oۺ��U*��@�.�t�@}c��� >7�D�����q�\�Y�ڻ�$��8�/�l���U6���u�dW<�#Y��7LV��Mr�@DB�����]�ǀ��LM�s��4�����:�+^&R�^藦\��U<A��%�ɽcj�s[�O�%�-oC���A7Tz��o2H���!�)%��MRט��P��q��k/\�y�k��=��5��"U��ז��U�{��>��Y�/)3{8)�>�X��M�ÌV�x��y�6���(��/J��v&KHi��m�Vy��73�$z�[��gR�dZ�� :�Fk�d�O�w��.�7�Zw�F�~� �;����Rl9�8|�#��RZ+?s���ϡ�]��\es�{�����E�������!HI�3@Z���3m��9p6��k H�J7H���dT�]a���,_���i�:��v�*D�-V��u�"���P�Dʆ�����lW�Y��Fp�Tk�ʴ\����P�d��ՃJ���z��C���d)�Uf�y����u�2�e�X��I}X���$(�`�A�|�}��I� ��V\��ض�ɨnB��z��xzE��%��3�&���]�j��s���\�<�Ȟ{�M��G��H����� �)�W�C�PCr�>~7��s���C�����E@����W����J/*�2]L���k��?\�a%�ѐz�I����Kx̵���:^����A�Ir�)����Bu7�/H3q�$��Ls�z�[W ����@EPl�3��ޕ���A�*r��`�TO��d�yo��;|�CI2%$����'v���,CP�K�GӬ��7���cL�&<k�-H����W�����Sy�s�'�u���(�ɘD=�Z>�� �r=b�DfR�18N��~|^dj��-�|�j�Xg�D�����Na�ݘ�D���W�A����Y�0[H,G��|�9�WOJ�U4�w���\I����Ƨ�AV��՟;����lrw�
Behavioral task
behavioral1
Sample
c0e65cba81783bc34d3599c0b21ba24a_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c0e65cba81783bc34d3599c0b21ba24a_JaffaCakes118
-
Size
1.2MB
-
MD5
c0e65cba81783bc34d3599c0b21ba24a
-
SHA1
a6639fdb2c637f67cff1e8f79c8b97049bb9fc1f
-
SHA256
4d90dd6c08d9a4029fbd65b4dc87af82af1c733d4fd1f684bf49e285b8ef78f8
-
SHA512
ac6e6b601b525efd4f67eea472045cbb04f426087e22180dfe39b2b2aaf511b653adf9853758d46913d5b0c9eb3332743a0b5005867de55b8efa232c35ef10d2
-
SSDEEP
24576:L1HVUadKCEARQFBJz9pIfHK83HQP4PchbckWfCXAdLyjs3dkFsDg1/O:5magWQdzbmKgHQPzYkA1yjcmWeO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0e65cba81783bc34d3599c0b21ba24a_JaffaCakes118
Files
-
c0e65cba81783bc34d3599c0b21ba24a_JaffaCakes118.exe windows:5 windows x86 arch:x86
9e0e7aeb0e05d36abf00456840b2e2f7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegSetValueExA
kernel32
GetComputerNameA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
atexit
ntdll
strlen
user32
CreateWindowExA
wininet
InternetConnectW
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE