��֚lS+��x2�'<�Cw���ȰQ/Xƨ�dL����¾h��n�@�9��so)��l��-�dq��GV2Q�)%|/W��:��E���Z�Y�[��o�-�=�.^8�mFՠ�D�j��¿L���[�A�]�IA@ �EO.�`Q�}��0FJ��!�9�Vg!�;S�ο/�-f�Y���_�����������5��I����3�^�6�����`Wtcs%Pz�`�R*!����^����u��#9'��)��N���G?Ybv�>�=u��y�! Q��������r^>��ȇ�3���\'-���-���l_���Ӗ$���(:o�t�,��q ��^��8��@y3N5����� \�� Z�O ����[z�vs �A�k�p���Cl�ގ���Ǒ��R]�(� ���^ח����w��y��@�����7\��2�� {7)C(C�F4�3�S��?,O��㍩_O��uj�^�I�h� �6�-�V�|8�6�eqa8,VG)�[zÏ��2��멹&#�;�N]����5%��?�ː&َ$��q��v&�eU�d� s��!]<�<��6M�����J��a�|f�b��%��^Ý+ ��tcG� O��,��%i�M$#^1k^����h�2B��Y3Jx,����w���`�DAe���x����n'�������"�����H�"i�k�O�.�,T�e;�9�d�%�`�G;�ݿ�;H����_��j���������7����|:���5M��uPh߹zKe�_���(���2�f3n���vJ�{>���C=iYR�n��s����BDbjhy�,��+��I��/P�so�������.�"8;2��-j!��il/;�~&��@W�Y��hFµ�������j���OݴvY��2q�/FԂ7~���� ������q1����K��T�� �q���>T�E�q�d4-��� � �����'�L.|ب�>�hz ?]������@�|���?�v�%;� ������8�u����hL�7/.�0���^�8��ٶ?=�,��v�/����5z{W�B�Yz v��$�s��k���%4E��%�~$F�8֗LIc;CQh� ,�&��j�&�����������Z![�w�,�I����o�����4�b�ĝ��A��F#������h�Y���w0`q���'2Z��>���q7���� ��B�q�b|��d�˖��*���`N�������/4c�Z��9m�� �=�E !���̕�L��V뀋%u1��Y��n��]�m��B��SXF;�e<���0�=�SO�b��ؕ��� �S��tY�#\�/��#��Rc�g<�@v��ł_ /7C��Ԯ�U�j.�@!�Y?�F���� oYf���)j����4{��8��pF�7R�pñ_�k�d)�yA6��[m-V�$����ogF ~��7��:��Uϸ��ʩF�(�|ފF��H����������"u� v���r��ѪBk�E����E�A��H{c��Ɨ\tV�S���O �`Ƿ���FH��J�*3P��K]�U�n&�0���������X�Z��*:O�i}��z��������O�g�5��]�FA�����ga�?9�����U25v��������~�zzX���M��ނI�u�ºH��n͍�%fդ����Nr��b����ūFv�v��aY�#�q*ٷB꣑��[�b�\�9a��b���n����Sxl~�ۘ�sk����0=ե� A�x�/� �Fu��Nw�dYzw�����)�E����v ό�-بe�g��i���{�vhJV�����4|��k�l]ɍW�$��N���|�+�d(w�_����|�7Fٸ!����õ����Q9������B��^j�%������3��#��Ej�6�����'�]S~+wԍ���M���U�Ȩ29�$������C+)��Q�V S5M-�����, ��?�h �>ÁI�A�����>$��L���n���P0�k�l2�:_J8Pv�[ }�,��EM� (�Td�����%�p�!�<d:XR[���]�d�P�k��t\�H� 4����3���PR����#�����uT����$[^q䏝�]|�k#,�D[ x�����L���{�;S�y�߷�D]?u�j��5��+ ��;�Q�r� g �`+_<�B��$�B�C�a�2uK��+^���%�O�L�CRe�oi�=�?������]s�~w}��řl��k���m8>!�2���gׁrn7f��Y`���itR8ص �U���e���� �7r�gB�������>ERTz��)�O�:���� q��-4���Vr��� ���f��p{U��ۉ��P��d3�W���6]t� ��6�;o��`�D�3|�W�J)�>�ϯ�,Mz8ڙ�W�j���4��(�ڈj_��W^,����cĀ���[0<��J���g��.]���Cs�>�ԭ���0�D���{"Z.:h�(�h����i�����n����A�qȮ�dۃ0�.�|Q78J"qQ�x/w���s�&1 �N��EO#V��؈T9!�A�E ��ڀ���##e�UX�n��na+��y�~�>�7䧕�5��� � ��eN�R�o���� ��Z���Wu<4���kFќ��Es���T69o1fnm"Ӷ���]8�%���@ �p/��Hn?(����[_�ybD�*u��'*��P��8cvjH|g���s�t��3�n��.t �)�������V��b@ �6Rօ7H�φ��N��~'2�o�����r4�4�/�C|#}�"j{4)H�Ff|�o��1��F-���L���`���Zc8")m���M�%�|�ȣ_Ë�M���}f��Q Gz��kR�t'$���U�둙N1 �>�`{����;����\�Q ���.�����X�^�@c"����ߑr8~���|�,����T#���W��Y���"�V�d4H��lm�0���m���&��l�l�#�~'(�E A02�iw��剀�OJ���w?�P( �*����M�"}�q2��K�Z=�Jt�FxL�0g�J\
Behavioral task
behavioral1
Sample
c7e94b68a8919236beeb2d6cbb684f39_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
c7e94b68a8919236beeb2d6cbb684f39_JaffaCakes118
-
Size
724KB
-
MD5
c7e94b68a8919236beeb2d6cbb684f39
-
SHA1
13b8879268f0cc0662bda581e9bd887b725ad1d0
-
SHA256
9587bfe4578afb98661a7d2bdda021e1602a9dcff585ada42ef657747e657a16
-
SHA512
e5fd1a1ef84687f3db58c7d5a7982d18f68d143a521dd76e5ec57bd3570cfdd2268a80e069f7f44371c91289e55462f472e1b18662bd32b6408fc8477f3d99ff
-
SSDEEP
12288:iVSeNElzYV7GABh+H653+dvtkhkvITy5/+IHhw2epuiunS+CqFVMcHHasx:icsElzYYABh+awd3vI+RB/epuijqccaa
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7e94b68a8919236beeb2d6cbb684f39_JaffaCakes118
Files
-
c7e94b68a8919236beeb2d6cbb684f39_JaffaCakes118.exe windows:4 windows x86 arch:x86
9a08fe8aa916a42fa2b3f95042fa7ea3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord614
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 712KB - Virtual size: 711KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE