����]�=ZӬX��mC�$��G6���K�j���P�5]i�p֔m������o�����M�4�cs��3v)e|��,��{y��%�얉OdK���ɺҺ�RܶЁ�b�/J( �\��&c��c�鈞���W��=�0C�×0����������eY�UO��%L8ˎP��ײP�W;�c�(+�uMX+��?~Z�BpN=�@���Q�'] �}L�2�fC+��r��ʠ��ן�\A�U'_pK�3�(D��(�T�#LJ� �-Z���Zy)�࿎>�~��� ��F����9%t3���q3�:�3�h'���l�?�zs$��%GډvGツ�K�*c.��!�' 8 �`��'MF�T�^B97�|'}1�����Q˛<����n�_�KM������I�<�luN���`EL֔(+�Q�;끕YO�k!�&��i�Y9��#bW�^��g��� 4ѣ��CWq��iW~^NI�փ ���̕�4@�| s��B�jc�Y��ȼx�A��}���`��5O`��NN���z�n�۟څ����x)����1��2ב])ly�`�Y�&|��%���@r.y4O_a��5CF��������f0���Ƥ��k��ϡ ��88��t��8��]�r�+�?��s��9W���6�?��D���So�?0�U�7�,�'/-~$8���}�k�`����FZ�Cm0���p�O��8�e��nܴ[������A��\]8`����&���#D(g��|��y��@lj\_�]�ְ#���E��~u�}Z���5c�E��Z���M����uZ���Q��Jgx��9��ʱA��cU_�)3ʹ��+%��}Y:1��_h2!o�袛��<���!ZA�Ȓ�N"P֢A��Ѯ��w�h/3���i �k�4IE�b�FEh��������Š �E���4�'x����P�S!��@%�k��vX�H��wcj�M�}"�nn74��|(��P��C���a�'�~BLE#ˉwM5����/�(v�#}�e��4v����+�@� y��0� D����;���̯: �8Ơ��"Q�Ȱ���08] +�٨=\'�B����t'ҍ�ܸ��|��2�Τ�CT@�(��c @) `[X�W�f��S���g?m|�8�h��L��!�j�u��ϥ�)�ɥ�� ؊A�J^��_��/�������@T�(�g��ZU� ���z�FM��),/'I�sjn��&��G��yp�L]��t����Ƥ;ۣ��\��Z�a����]7m�E�!� c���?���}����<-w<q���1�g����>�n6�Y�X:�����KTX`� >�iEH��N;��}��Xs�<��r,����S�m\8��ć���HY�G���w}��W&W}�H��-"��)$=K���f��`$�����Jz�Qo� �<f���Gԩ�z݅�����Ѓ;�1w�!�������6�TW 7:$����q�t�g�<�� ���@Xȋ�����4�6a�-����=�T?2+�i|={�2��=`y��L\�-敐�9TPQlaA b���N�_@p����vU�ώ!���_�5�VM= &(��z�P�ժ�vF m'Eܱ����7E��Oy�B}�T�I�����l�^�P�аc��*�/��o�ja��\vRɠ�5�y�h�>ʩImǟ��"��ŀJ���<_5I������*���i���;�ӈW|2�Mzʊ�M�l/G�3=4�&<c��@bp[z�V���A �6���"�| Iz��������'J�ug�.�}� z��4A������N�u�-�Ek�O,;V4���hy*�Nm��� �S����3zR��R\Ջ}�\~��z��'4���P˭��#�M4�Oc��{ܨvù\x�.<k>*V%r�`PQ���'����0f���pG�D9��j�-��f>��;�/U T:=�W��ņiz0�<��C���*������@���z��|k�q��,e~"�^���YI%��ۚ� ky|t�Y �K�����ӌ�b@��� P����Q���]����k�Y-��^ʑ��7Ѹ̡pI~��u��!�'�IҌ�mH�"x���������ź�kv7Nsc�\�|R^�T�-w��Ge��MJ|A��n�o��,��U4M�2E���n��s�H���$R>�c���=8�q�*��^���u|��}? ��:�Q���������n�p��+$A��u<n���� rHM]������Ͱ�]߹.�8��~�2ŔY���>AҺV�r���7d缀��+�} ���H1h\��H�ܑ���[ۛ*K$|��p����iXI�L�s��?�^v�H�t�,�G�S�r��������P<C$�WAR�c(� ջ5nJ�a#h`��%�ݘ�U{CGU�7L���uٙ���d��/����G�S.�TaY�;`�)�P�Ե��5�q �"��Kr,8�y����?o�{;��dP�u������s�+�=5,��"�A3ko���cB�$�r�f�zś%��3W�ʅ�Ja2@W�y��(J�z�d���ݨGڛV:=1��<�d���w�[dB�^�>��5 �n���`L#��d�yC�X�1Oݔ�s�òCP"�ΨDAs24t��7���"�[�ȃھ�/����.*"B�H���7*I���AT���C������ ���w�1!��%L��$@�6�~���C����v�>7Oa�F�:!�ɍx�*�%_���^N����T=�#����h�:W��s��q��/Xy]}�bII���n�o��ӣ�c��z�'d�Z[H*n%�߉��$��v˕v~:�,U���]�M ��U��|q�^�����k���ɪ���� r}�NO�1��(�<S�yr� k4z%�i������S� ��5u��:�����HOxdn4�z�kd��[�D���\���U�;�����Sk�3��l$�=��/��x_��Vn��� �����T~E/���a\���\�,����q'vk_��,��иb�����g@�=�Fy�8<,���n���bLl��}��j18(Ct����Y��b����
Behavioral task
behavioral1
Sample
c14e40641e45080e58b7d08aedce683c_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
c14e40641e45080e58b7d08aedce683c_JaffaCakes118
-
Size
732KB
-
MD5
c14e40641e45080e58b7d08aedce683c
-
SHA1
ae1a1ba2efd0513f45d1f9aaefcbeb4f86ef87de
-
SHA256
a46b83c95d513187e1fc78084edc82b2682a7c6460d455249feb791c0a829544
-
SHA512
05d1b66780e7902af7b69f69f5f352eeb1a6eb5ea1fdf1365ac5d6a48cdda0a49c14484e20edc78a43938799001d397dd075fdbd5d5c542ea54fc5e169e15042
-
SSDEEP
12288:FvDw4BzVp2/MKXpxZkaQhv7GkVDEkMb75S71SQHvYaVRZ9/SXXeq:Zs49ViMKXpx2awvgDFS71SQHwaDZBiu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c14e40641e45080e58b7d08aedce683c_JaffaCakes118
Files
-
c14e40641e45080e58b7d08aedce683c_JaffaCakes118.exe windows:4 windows x86 arch:x86
376dddc8e33c4e50ce968f2506829425
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord711
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 720KB - Virtual size: 717KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE