V�"�B/��0jB�>�F��-)a "?�vs�ڠ���'�}�������ɜ�G :L�1Dz�[�M��CX���'�Q8���h\ɚnf�sT��p[<;uQ�XZ;�9���_��Ch't���+K�cf�Ұ���a߉�;���'��6aw��J>���H-/��Qo��u��^#Pf�]أ�dRL�\���5y�Uk$0��θxX˲�vȔ1���"�5���̥`����%�x����Wk�cf3X(� sJ���(]p�K��F#���AÈ5EU��uy_��*{��{�B�����j���e�8kX=9 ��Q�Fq�ښ8]��i���m0�rP�>���R\Q��]_d���uH��d!g��,*�.Z�Ŀ)�@u��FW�L�P˛P�F��C�����uòw6�t�S �ܤ�CT� ��\��h���0P��>|����-H��@=-\��xxV���w;�R�Zڢi�@���32����]]B ��ҪXK���Ou���������ڒ�T�\&�gj���{˵�Bs�Ϧ0�_yZ��p1����d��0��x�oH�ڳm;Z(����5muTr����l�%^B�vC�LBc��Wq[ϤϷkS�!6�;��N��1�quN�n�e�]���P>S5���d��^�0� �-����vC� �_�wd����Aۢ4�z�11T��T���ʿp�3��_�ҴE��ϥy�O�yD�@��[�?�^��7d~��F-��⏗#����bx�A�iq�#��"��xe�b�� �~�0�;������sN���Qo�P���G��9�`˵� �}[9u�op���ļ��s4�N��� 6(�?0�S�!C�<QZ*��J'�j(r���z��E�;�y5� ��D~T����������O|�gQ�.r,��)�n� �_i�Ly5�oW����\����-�W�m�<e{�d ��d\�x��8�´��w�H���;O��:^�+M�96F����G'�n�40�z~���9^.ۃSǻCM���r����|�G�{�srs���Z�'K��N��������I ��'�s����&��������n� �V*�2�w�g��/s�Q� ����T�(�DL������h(S�]�H�f��y�`���;��[Z��j�]S���f{�s�&v�pfLCm@� &�ɲ�+CH�8�H�u�u9-����䃙ͭ� k;CN��5�e���M�K��Ú�1����>J�B�!풎o�e��f 2�z����"���j��K�P`�ˊFן���� ��|/u�"��j�w-�'�EAHl�>��:.|>�+�͒�5=ƻ �"���4ҷ�<�q�����%���'Fd� ������wë��zݎ���=�$�C-�vC�{��Zؙ<H|����k�����w��w��+H_����X�b���D� ����T4c�&tj 9FXі_��33���+i�w�d�����=��81�&0��]���m��֩�b��.歾�Pk2��D�mߨ �U���"�S�V�צD�!$+�+��zw i'1�⧸��qnұ~���O�~�3C���^~�v�|���u����"s)������'�vY�٩xKL����O�'*��I ���8�.�������d�'�%.C�i�XC����� F�iQ�� �ڱ�<�1�� O ���ank.]Z�s��&�B��&����#dA�ւ9٪��e�E $�'���`0�4%��j�1 ��^o�9�����>�0Z&.��h�k��Ǽ�C�&@��Qw���NZ���/C����ol�awDPun�]'?DŽ�����8��ru�x������觽�GG�1�E�W�5XKQf�m�� �}9I)���D�Oˬ�njPd�g�2�i���9�U N�����v��p�z���&3B��|r�r��?�Ϡ���<���S�A���4D��o��,g'�;��:��1oT��h8�������I�m�)����'�y�\�wM�]!J�A���1���,{����\��=^���$���d��� �v�S`!v�� �[� �߅�� {Ш�9���=�➤�YK�u�(j����{�����@��`] �4�~�3�{��w8�_�^�[�|�ϕ��c�4h�m�E�Ұ�Ubz�r�Wg�S*���l�C�5H��sA?*+S�{�2����N� �+�@|����w��U���ׄP_s�P�����"3e���[9���O�n/0�5�����s�;��#�n���Aq�&����F�wk]��{��1�jP=#/η��=� #6B��e�E���*_ �����q������;q����RB�D�֩Z�"�<�qhηt�0���Uo#�目�ϗ���'C��li�&�,j�@����,�6FN> ���/R��Y��I�Z[T�������WCg�nЀ�!����m�����l��M� �����`��;~�Ԑ��4_fޏ�;�o�7u��G����������ι��y��h�5w]�=�ϗ�����_���W{���H���&Έ`$h�,!�����L�Nu4'^���!���6,���!�{�,s����v�PU��x%X�宖�o��y�}t>�.I�h��i�H���{4L��^�����LU�^ 4����g���eX�mb\J��f�\)q��Rd��ۄv�����1:�: ��a���=�;�Ʃ�������;�������S�rj�����}��;��_tAn�@j��^h����~T^Ĉ�<��D21�Ú1}oOD �B���t��G8�vhgݟ�S5&jVB���ݐ��G�GsT�`@�R�s���Ow�uE�ߪ�A>g[`{��غ2�}�HG�������VT�w����$s�#=�Jy.�x@3�o��J���H���쵽(�>�*��aE+b�l�m{�)+�/ �7.��H��_�&ꥆk/�x�};��� < ���6�� �� 9��������v(�swlӊ�R�����N�>���bz�u��z�����s�UuZ�<+_�<��Z����:�*ֲ���������v��.C�Z��ߵ��<���X��&��.3Z�t2E���c�|�,�/x����
Behavioral task
behavioral1
Sample
cfeeb983bebb10360e61b51b50da4468_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cfeeb983bebb10360e61b51b50da4468_JaffaCakes118
-
Size
4.1MB
-
MD5
cfeeb983bebb10360e61b51b50da4468
-
SHA1
c63a687d8d59cae6b5a7e84535c2d1e20912d272
-
SHA256
a48bb425ce7d04ed4d1e4f0f1c72f3ab576181d1657f4b006ea598b7fcc148e1
-
SHA512
b03e8815bb7d2d05e7d70c4354f92da04fa1cbdeeab936c36d7d43da79ed0cb50f5f9700fc1bb41f8bf703cd39d93ec63925c597c4696b240db5d70d6922188b
-
SSDEEP
98304:/vzJX10yV9vsptCFZxWi/a6luHhJKen560z08wa+:/vgauqFZxV/JluHhAc6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfeeb983bebb10360e61b51b50da4468_JaffaCakes118
Files
-
cfeeb983bebb10360e61b51b50da4468_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: 291KB - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 424KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 245KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 817KB - Virtual size: 820KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 24B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VM02 Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
API Size: 771B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VM01 Size: 16KB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SnD Size: 640KB - Virtual size: 640KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE