���i�qP���vYB}��� ���b�+{D��OL~��M�� ��x�V&w����?����V�J?ʠ�P�m�&-�Ѱda�|M�Ce.0/�u��;���Ы�d����1�7�5K��<���^e]��k�����@|X�U3k Ȟ�emK��TM�G,�-*�7��L�h��k�B*���'pEV|[��t��Sqp��#ʍ%!7��R?�>'�p9�Ň�k��>�mX�ܠ Zx��W�]��C�?r7���]:3L|�-�����h���߽���I?^.�$V��TM�Qxؖ�ͣ��&�3���5�'2��;8ҫ���rB��V�{���_$�V��D�`�����Y:l>�pr�}gLIxgh�i�e� �J�v3ȎD��'d$�[��}��ح�{��<Q"U�&��3�%� "uN���� #�����F��Z `�XT�y}����MF)�V�����N'�f���#1λ<��a��xXn��Dy?��g˪�/R��j�6Zh����]̜6:O!H�#�~<y68T�����3~���J��5�@�Z(j�$I=U�jߘA�\>�[�P������ �\�q�x�� �\ U"w�(D�Rk&�I���3�8p��u�G��kjVm���y�fڦ���!�������%`�E�&q�O������C x���%'�={�����ȕ��3'��k^a}��թ�@�����2�_���-e.1�s���<�����؆�������2���E���"� y�R�I��8g���7��\F��z�����ȭ����2f ~�b����>���8���t��B��_`P����ɯ�?��Ը����HP��:�G_+r�y�N��oR�o�*s=��p�]�:܅�0+!.��dT|h�Iy.���F.�W��h�e�R�P��?� ��Vyس�8 T��լ,��e��8ԐM�[2�������N�ۃ"*U>8&���N��\�m%�d��у���f����п���1�� �t&��c�M�)��E�6� �oO��zz{w��yV[��� ��No��d��o[p��(�`p�{qQ�λ����p�o�7[u�F����X��a�X ~4 ���%�LB1?۹����!a���W vw�?7��zk��ܬ�dD�"�^3]����c� �r�� ۳^��� |��藆����X��\t&��@�!���� {����Q��;ݚ���%O�s��@��M/U"9�饱ˉw���M�_6����$?-,�E&E�~�,�P?r�Ë��O,2����I,r�5\��1�C�dzr���4��hW���2�!7Ee0���z�Kh>ĬJ��,��B����ܟ���(�,G]KH�N��M �8�.dg��o8{����/ ��Ȕ�7�[�_��=�g�da���b��z0��3_x�[�}� `w�[^��>��V[�OZF�r�g�đ���vJ1�0���l���x�9Q�m�Df�3����G�g���LWߴM����2�wF��'V��W��~��6��w�a�m�Ch�p�V��#l���J=�n̪Z��=���F��ځ��d�4�L�H���b�.���_qc"f {X�v�YJb�ȑW��Q���� �{5ںE��g�a��G:��wVH�=>��\ �(@g�X�5Lه�y�W���y�G�1r{�L7�F<Y�����O"���q/ph�i��U��*0��v2Ym{nV&�-��h��t���8R4��������&����{Q��U����}�.��c����E�`��Ҟ3�r֦)1i'� Q;�<�;V{j ��k��y����, �ء�/��m ��_�R��s�i;�F�8=��-?���+��Ϝ&�>�Z�g���� �d����P�t��o�V�Fn�5\m�)ٍ@���z�F,�k�'���f����YIԬ��ȾJ����sVK����������(��6����=�PK�Kx����j�ܱgyW]��[�r2�𠸁=�ڂ�4��ZD4�'y�A ������B�5~O��X������v!�����*~���69\x�I�+B�!7S�^zKL�T�sC��ink�W�������C�B�,<]�X v�q�镨.{���]��E��)g�\8��`<�<L,�'�ҝ�vB�γ�6R:���J��Hy`�j]���Dƺ���z�jZ�/�.���K�Z;*�lH���U�������Gt,@:�w̘�d�����!r�SB��x�^��i���v>�D�*������M< �Q[5�_8ElD2(��m_��[~]�|�i�k��@�7e���o�:R�_TV���Q�k^@�\���V���Э.�BfH.��(8F���ˈݎN�"�j�p��ƖK��jO���+��e5g i��x.�PP�B0�N�1�A� `���5�W2Ou�!NJ�ͯm�X���W�<��\J�9�L~ሗōG_k���nJN�&��j���;%{���7��@a!�p�8=��b��k����������C���{ �%�A��m��"�,֓a�]������:o����/"��f�>��:L`6���G�o��%}j/��`����`�N�� Ä#�v����oK��Q�թawB4Z��O�w �����M��Ӆ5�(ld1� l�x��0���R��FDI��]92���?���*��,��)�ЂC��m\l^�m����H�i/=-�=�k��m\��i� N %�Ȃ�I��1Y?��Tٯrf�kIp^9���E 5��t?��W�<�y����P�k���|�Z,-l���J���yZ x���:p�"�u�Gp�Ҫ`�V�T�z�Gd�����<�O�����V�k�B�@6y<һ�@}v�����ױD�8�k\f���Ӻ�4}�ah�_0� ��0���s$=]�x���:���-|�m\=��<x��\��3xN���!�rT��;㾰�W��6nH��>��MԵ9H��������`��X�=���&L�إ�c���2����7J���⠡��&��Xz?�g� u�8Iu��j8J {#��e�[NY�-��
Behavioral task
behavioral1
Sample
cf2816ce1a82da2807262663d7330025_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cf2816ce1a82da2807262663d7330025_JaffaCakes118
-
Size
152KB
-
MD5
cf2816ce1a82da2807262663d7330025
-
SHA1
03de849919bd9297c5b9315948a0fd03d62d7b59
-
SHA256
8bc5cb4aea396624d7bb81a42d70698d0fcb45a734a3675c1e93142d8aec48b3
-
SHA512
193fe388ee50996b4337678b1c501a663086640c85e896c650995e044869c12bd024ce47348c88ce2575a375096342a04f982ff667d0e369528c6afdd40fb46a
-
SSDEEP
3072:Oq/YY+VRa+aaan/qRswFpR4qik9Rvov4b/OnljxYxWLHQPS:ONY+VkmywFb4qJLwv476ljxYxW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf2816ce1a82da2807262663d7330025_JaffaCakes118
Files
-
cf2816ce1a82da2807262663d7330025_JaffaCakes118.exe windows:4 windows x86 arch:x86
a1e67e3281dcc40aadac422d328be723
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
AppendMenuA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
exit
comctl32
InitCommonControlsEx
msvcp60
?unsetf@ios_base@std@@QAEXH@Z
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc0 Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ