jz2#�6�{�e���K���F1�a!LJ��"�\�X�iV`������Md[�?~���w�;�ְ�@$����k8C�xm���t @���S(:"� � C�J���.x|!�X ��[).t~����Y{�$_�|D1��ef�8SI�g���8���kG�L�F�r�7�kUD��hu�-?;ܢ�`BUڌ�"��}~c��ݵ�kS��C-P�/��7q.q΄�#�m�k��,=�`�ҏ�V �Yt��*��� ��ބܑ#F)�'X��� ��04(��K����_B�����5�{eI��鴃4����"X�� ������ ��*�6��T.�#���������(��:X�J�?�5�ɓMm �n��X�!���H�����hem0yrl� ��Hy����1D(p"Ic��*��9�&�g�mr܋0 iA�f=\R�1��� ����|��Eu���{�j�����뵣��"O1�*�U���<l<�l,E�N*���8��-#&N�Х��~��s/�&���tF4�}D�F�c����"&��B0��<Ȕ�P�@�<���]@�dU�Op+���X��1� t7 cQ��G,�H����-��n���MX5��4���e�E��ы�TH������� y�2�����O���p&�T_���%�_���P�E9�JTf&=V��1<_�G�݀9lf+o��*����A��iPՍ��!�}���u.�9L�h�p����#t ̤�Z�n��,��d��owOA�4����ӣ�v*���"�|^B�3�m��O|1�D�V��V�.\���}��ә���][��������})�+X����<�!���j9M��I��m�zm�"�[%�|UGˊ���]z���]�K4x�MGY#�'6YN5/>����D@\��K�����������F5;��S�O�hPn���G ��y~��#�k-�qp"�45IMP��F5H3���e��v��m9U]PQ�3��a�D@�� N��X3eH�[�#�Rp~^���Q�5�����>�ͼ�۳�ݴ(��G�[�N��@��^�3��qٗ&���&eD�zy���+�K$IC���+���p]���58�Pq����w{�E:X��w5� ��w[�e�o1�J��i�ɼ}f��Bi<<X��8&�������Ôל��`xhl��i�� �G��FНX�ߦ�Y�t�vh�e�; yW���r Ase���8E��r���qs����mn�c���;�I�|�ʄ���T�f�O�����Il�)����a8@�=��9��������Q�Mߢ���"V��_��#��H�%l�C�5�0,�2k��Vp��� ���-�m����ގ� ̚���v��;'G�����v���{�v�d��C�H��ru�+����� �S�v� s�e�g~�E�H���c�Iԩb�^�ZzPQT��A�d��ֈb�C��U�<<�p�w�Q�Ey����-�%rܳ��:�$=��,���l����K��+�T��5fb!��5�4_�ة����������1�:5=+�0'��s�h���L��qd7�4��4V�A�V���]Q���Z�ʢ;��Јҵ ������L���9�V�{�������e���{^!�M`�-�(���D;&{���������� 3��Q8 ������ɖfK��IUP�\�m�:�e���{�u� `6��y�T�kz�\A�B�ܹ��\���|��X��]�x��]��W�ɿ��õU��R�������X�*����uy�4:b��,gl��7�A⇪�Z�M���T�����̻��"���9[F8jjz��5,e��5��� |���/��S��"5ޟ�����7u{�E~M���we�KT��L��(��-�@? ̺�x0u������.@�G�B<����2m�����s<�K���"��4�d����8$�3V� �X��P0"�M��埅s��^ɻ��|����\1٧�JƬ ��yV#�~���P�����$�� C�PVl�T�c0�;ohxbn^�d*C0Pr�����(��V�"�5�WQKg⥚�қ#���x�P�(�D"�amt���S $Y����N�s��AC5��m�\Y=��f9 �"�iғ�Q���k ��h�f�Ǣ��{2����i��UI��~��� ��L7o)Bt�c�:�n�w륯@��(EƗ{h��э\�����;����"q%;��������͙�Kl���a��)f��)�-����*����f����]�fC0ў�b���κ�D�ҝ�L�N��KՁ8�N?�M9H��}r��t)�� ^f�p��T���7m��� �tY�ݠ����(DU*S��_0���)9�E ��c��i��y$������(ʠ�}^����<D�X��He�^ �h\���Cw*���Vj-��NQ��{PX^ }���X�3Ǵ�'��G��I�����[ U#4����ǖ���Ϲ��O#F���9U�i�&W��lL����� �5x�@�L�:��i���{�D��}+����tZ��]�{�+�����V���m���>x�A ������%o���lt �~���%�`����/>�����Q��h�,��B�FBZ�s��ܐ��p�j�I� ��k��[������x"�6��~��� T%�N�ѯ-���'���3�*�Ӱ( j�9ɗy��F �� ��D�q�����?�m�OV�� � � {i�i`�+4o_��(�q3�z�ո�A>�WF3���`*#*�o�9����%ႤjN���p2��*�b�&i�]���Vz��33�* |��1&��)��V]�FgQሖ��@B��WA�'�-7���]4�뵊�����c��\�<T�?���EW��s���� ��yL'ȩ�B��B�cdL�v\�z�d��iV���i��Yg�Z]"�0��E�v���"���p�4ϕ�̻ؼjkL~F�>�k��N@�;K2p��́��G*�a�犏^�UfӜ"�ҳSj�*J�ȇ`\>\�B��l�Q�I�Kq���/�)Y��10M� Ujl����eN��#;|���Aѵ_�0)g��
Behavioral task
behavioral1
Sample
d52ea7cd8b01aac3ff6ae47dda58a1e9_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d52ea7cd8b01aac3ff6ae47dda58a1e9_JaffaCakes118
-
Size
720KB
-
MD5
d52ea7cd8b01aac3ff6ae47dda58a1e9
-
SHA1
a4de8d095e5ab1976a2b046c6eeeb795f304674d
-
SHA256
d034f148c4687a2fb3162714ab65af552e5fa42b7ea659e1993c6773c308be05
-
SHA512
8216aa4d2b349ad5263333a0654ecd85d164e1047407c63e3909beab5b2c802e6366b668a62caeb1e468a8de31d14640a692bb9254318bb265a508b30a8cd3fa
-
SSDEEP
12288:vscNaMP252lkD/AVhi8WDY5JxHYqfCt2m4TNC9T9ACuoN5DvG6Tbdi7s7U0paGWY:vpUMezX8WU3xHYUs25sT9Aw7TD6sgTW7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d52ea7cd8b01aac3ff6ae47dda58a1e9_JaffaCakes118
Files
-
d52ea7cd8b01aac3ff6ae47dda58a1e9_JaffaCakes118.exe windows:4 windows x86 arch:x86
c1f0ec2929fcbc398073dac131e7cc16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExceptHandler
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 663KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE