-[�%�A�z㳻���x6��Y0�1�a���d�1?��l�s��W�r� �WT�Z�Ñw)&啞�fR���I�t�L\��wfE��*7��+b�T�$)����|�L�mr6� ����<G�I8Fj��!O����9X����\��gt������%<~�w5��&�eV�<݂�����+.�):�6�r#Ȃ�D�)�A�����C��'L0B�/~��h#�]ƻ�S������a��[h�7c��"\�_��.� Uc�C 9$Ԧ] ���#o$n�Bs��@=��P�����o ��a�A�Գtf�o��BF�#lLc ֕ Z�Hk�%_��s4��[iJ/44�A��33&�q�8�̜�<k�������yE�mR�6�S�����xO���3V���}G��ؘH'd��G�6�̮���J6HT�6��oCW���;v=�����%ӈ�����O�9Z�R\D�x�'��/D�o�5��e�*s8~gBC�IS� �m��J�QW�)9��ak��m.�k����H���!(O�9I0?7�Ѷ�7��$�I]%�1�:*;�nz�̶*uj�����U�j� ]Zq7�s�\�����,+Hj���P����/Ŗ�1m�V�S?jD���D��砞U��j:_E��3����T�rq��7\y[�-6�X��۱z} �{����Ɗ���:/�b������e.}"$q1+rg�Gd���)�.�Ċ�q0=̡M]A������nL0�_�lL��kRc���z=��i~m�m$ ��v���I�^��@��Tj�@}_�)}h<���r�j�m�L��q/2�64�uS�+5�|�(41����U�y�$�˥��=sBna�)�������{�5s�uEζ%܊8���o�݈����̮�zE ��~^LutgQyAA���|Y�̒fM`��-��HG�&�N��r�/��҂�46���6��Bdr����Ș��u`�����H�;)�)�*�{�����������oN9�)�H�?b�}��:�.�fD�Cu��3�X'�f�>Sh���$��r�f��3#�x������\T�������Y����>^ʛ����<�c�y>�@��,L��¢�ⓡ�T,b<�. �������v:��n�iD�l���?�LiVrk��ҀUE��B�P��Κ߀�*�)Ez���s&*L�Ӕ_�ɱ'�MRQt����`�ln����2h]XD�� H�N=�譎���H�=�W�ҖVd��n�n�����>̞alrw���k#*W���B����`�Vw�� �=�Ťy��y&����`����M@(�0�G�C�l��6�&���l{7]��;7;*�K?c�I`���� ~-�%�⃯�&���r�*;���B����o`V<�,�M�r��;�q��m~g�B�;P�u�q`�(+�n��h\���8���Ѥ�7Ԗ8 0Q�2�ʱ/vo9������"�x�r�pa�I�W����.w���ˁ�-y@*��!��i�&�hK�VyQQ��Q�,�5t����Nt��Ks���ME�C@��H�X�t�/�r����K,�.�(�v~�rl�C4kN�A}=�?�ժ�����a_��W@� ��?���Gn�&H��M1Ue��/��R��j7��4F0�1 �l"��P�خ�<�%�[��:[˾*� ����r�P�h�k��]DB!GjpYzj���꼬������C)i��� ?2!�6SU� g�D���{;e�ãk=���;5�V���W��y.�q�T��|P�7*���௸��<�L#�s�K9�y���t�/�s�� ��7_�I���Ce�3=�T���&�h�9�� A.�� j �D��v^r��D��f�Fp��(/6C{��$�5��j�:P�d��d��m�;�믢�<�В��d;wͯ�����t��3�L�8,��{9��-TR�X���6 D8n�T�Sյ#� �agV��=�L�� mQ�q��A�"����ϸi> y������y0���T�`���~��7���g9Ÿ@sWN��Y6�������k��? �r��DARQ/ߒشd`�]kF2ܾ��b�n`���ٍ�/�Wbۡ�������@�i47e'� 8��$0����om��I�7T��u �]�'�d��Xώ�Gi��̈�a�{|�r� �B��7�P|��#{�c�A��|A��<0��a���<�q!��x��V���/� V_Zj�E���$l��dL\�@�)�x��ۊ�HLԈ�t�TZ�1���۫p�����;��ݢ5���s�Q4FU�C�rI�Ow����2�0ڝn5JY��&C<�fu�g�y��g��,b���V�\��3^�, ���`��*90����J+l?Qr�BL����yꎌG��ְ=´y�$�$���[���:�s�*臹�\�f��@��Glk ��f_��}�������&R�[[���V�ɂ�W������0K�v.��V�I���Lt�����o�T��yi��V3Z�?�K-\� ����拑�p=!��ow<#�*��}�������O4�#q���}K���`J)�����8��GRX�4��~|�j}DR%�H� ��G���z�x�N)�4�P���\A��U��b�R�Fq�́Z�hR���� ԭӊ��CΕj X��p�����_�X(�#sХ�� }]�R"33�$�,�F���R�����Gi�BJd�£�sS����rip+Zg����%�t�+�l�������7[D�P��/�'W�L��o�g�?!z�lsI�)�H}vs^�1X��������rn�7� �1rٕ@��� _m�����#������1#n��3��L-T�6r��>HM"�����y��hq�ٹ���-�~7'7�6�YR��SZi�ke\�4���W�$�N@Z|�6��j����ǐ���2���JLT O�w�w���P��>��Z���ʗܺsy��'����Y���w ��,�'Oc��9�R?��Z����Jx����5�&���0?+��;�i�@���I��T�� 0�l�嚆k3˵��>�v\G=�x���j�T/�Q������pҌم<�
Behavioral task
behavioral1
Sample
c8eb4d5fa949217dfe3fd55dc34f6e7b_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
c8eb4d5fa949217dfe3fd55dc34f6e7b_JaffaCakes118
-
Size
124KB
-
MD5
c8eb4d5fa949217dfe3fd55dc34f6e7b
-
SHA1
382da311eed1f4a2644e25acbb7190065c5ce2b5
-
SHA256
4390fbb58ce7b22fa7091b22ce49aa4924aff1528efc47d9e3e76b9676a19c74
-
SHA512
6a77aec23900a4e1d8104b04fc460e6302ca29d262d960d08a22cf2da9bb158399b8cb3fd0941a317718dba4f45332ad40c91736d5b286ebac7b81ed11815a53
-
SSDEEP
3072:dqyxh2vQuMGFd8abUtKqoYtxECX7T3cmwcSxH9dCO:drIQ8F6aotKqdtxRT3cO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8eb4d5fa949217dfe3fd55dc34f6e7b_JaffaCakes118
Files
-
c8eb4d5fa949217dfe3fd55dc34f6e7b_JaffaCakes118.exe windows:4 windows x86 arch:x86
8084e8c282f2a649692a3def6938152d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
exit
comctl32
InitCommonControlsEx
msvcp60
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ