�������ܗSbo+����:�4U@?��]�'EU �|�S*m���� �Za�m8�Y�N�N��<�� �x�<�vj!^����1�</���ζTC&@��*=�@xج'�J�+n,f��S�/��L0sE����z�H����%�~K�e%a��������t� !Zt7f�z���٠�J��GN!T�������j<�6JFl�/���,-m�}�o!iHic�� �%�1=�����.�������� 5?���S<] x��c�M]�w� .q�7��Y�lW�����N�s���;#o c��4��Jhh� �o�W����6)Ӫ:�����H�Q��<%��<��? ����nj$�u! blhߣ&%�w�6��m��(����ȏ�%,l&F㪺u �苯Bڣ��2}��K�7� �3R�Ür����`����X�|������ʶ���v�BtN4�r_Om�)b�CL��m2�$��?@Cqs�m@����7o�|w�[�"\�l�(A`͙����/To���x`+ +�Э��?�RB�W�l�ɍn�p���k]��us����� �cH�}wP��7㆑�9;ٷ��Y"��y�����v�խ�l��u�a}�����I��G#�D-�?=}��m;!�g 9���0G�k�/�g�b��ju6y��*J��}Z�c Z��V*�%����u-���r��wS����`�~r�1j{j2b����l�)�-s�&;��b�����Ux�x����D����R�p����B��̋:���h�!��-E<���ztW��ם��IM�u��O&�ʤ��D��p:�qYs;f4�������Cc� ZGȿ֢6Ib�nDǘ*���bE����(4e�D�]&�ҝ�= ���,ƙ?�cy�t��M�K�U hi�]��Uv���g%�U�:LS4�I�[B��\@G 9a�3�����F��ܠhӠ�S��!�8v\:2��Ɏ�WU�~��D�opDQ6�m��l�uj��3�ݎ;�!��b|Q��Mm.��`,��� �j��(K�,%�E�����z!������V1C���C](e�J�9����,����i:�Q�,⢌��@3Z�@�~<cm濫h�p� 9� ��=o.iZ��ٟ�;��1l�|p�i������V��rd��+:88(y:�i�C����E���Q���{,k�Ժ⭍���]��?�� �y�8e�f&@,=���C��P@q���qv\�(�&�8�.DvMAЗn��'T}����6�C���m��-���\8����ݗC��J$���9��@Kk��7�f��n̓л������w��^��e+�1���� sE�)�操��n��L�;�Tx��V>�w�Z|�F���WΏIG�Q����_51L�qnK1�{��+�23++<܄�m�{�ӟ�w�?�4eD�^8Wf�@h�惃�C�0t�,D���fnc�a�+#�p��'$bq�q>l��d�� �h�B3m��"�DŽqG�������+��iŘQ ����H���*5��DF��<�뿕��e�(A>{�>����d���,�m���$=,Y�a���:� �d+�hB!I����T�i�ϑq�������s脓�')" ��>2p�c�a��� &ec��v�.se/�~{^����m8b AV,{=˳_9�6�;u����P4dP8��dd�$FB�t��Ƙ��vcI���S|�H���{Tѝ�����S#��`��E ���L岼�!��>���_'i�����S���ܡ$f�Q�صA-�N�E�/BoX���L�Ą�zӚ��`?Lo⻊-��.�µj�F�s�;`F���UW��<n�F@��c�9���elWc �������ݮw&z�i�-���BAX_��?�[��22�~��|�[`�+(Q+�'�4�7'n�wu繷t�f�&�Ϋ�L�[�7�,R=ۓN�B��P&lh�����~A�t��^��̺�+$ 0�7��)���d萄`F�"��G�a�,If��r�x��j��#Es�Y$�"A�t& q�����w�L�������4�������1[- ��%/>ct�D��3�q��Յ����D�� ���������2�^���1��hy����eI��>���H���t�ؿ�YW�] ��%K�����{�A�����1��ߗ�� ���a�p�� =&��{����З�b�}P[):�c`�E��[�w�?�>�Gb�{�ڻj]�玟3�C ��ݲ�����$(�p�V/���\�%f08��ty�'+�R���o�o��,����]2��?�X5c�O�|Ue΅�Ύ�L��yKν�C�T'7Oܵ���c95�a�;����� ����\a/x�o�1� z� AG�P�x�廉B�ah�0�7������=�._e���?��cY�[f��iԒt(;��������z�p�T�g9$�U�]�LJ3,�l-��(�b�;d�J%����f�+��+tE���Z?�� �ҝ#.�b�e�`j�zo�W�����&A��FkV��pKo�V�����c�Bq�����|C��������L��'ڀ���L��ɏ�n,�--�#�:�V�H�nMp;/..p|��F˹�u�� Y �},��ڇ���(��W�ۯ6��9\��aӹ�]<[yO� ���*͋p����cD����؟e��b�-}�=�5�U-.pۏ�����Ǚ���Da'�/][��7�H�Z�%cb2���l%X�Z��8�]OF{�lV�mQz��*���ɻ����ZSV���؋|��� B���4"�g���I�XL.�!JI�h�-�͙ܞ�5?K�(`���%�f�ӥ��jO+���� H<A���n���4dL��~�w�9�vm�֒��ZNc�w3��z.�v�f�,�J�=K9���micB�fABŸ���W�sQ�Y�tt���H��̹����\%�[N�A��9Rd�^uRK����a����Wi�|���A&�̴��1wY:�Z�#�Eڛ��������^NqX+ȧ^�$�~�CJ�бJ �&�հ�[i�Y�n����������x�m<��Q
Behavioral task
behavioral1
Sample
d40bb5eacee555a5d734f5600e2fa77f_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d40bb5eacee555a5d734f5600e2fa77f_JaffaCakes118
-
Size
724KB
-
MD5
d40bb5eacee555a5d734f5600e2fa77f
-
SHA1
432d3b081bb0d9f35c9606f2c26cc4af35e12d90
-
SHA256
471dad047ffda28bcdf662d442a04d76b3cd21d8e0d08382781028e58019123f
-
SHA512
fb3c9b7e4d379b169b22c0fce732c7fe18ff1728d91d631a9ccedf3d20546426b8abf6ee4a2a108295a85a7725ba93b41a9ad8133215388010f4636905b93ba4
-
SSDEEP
12288:+NFHKCwFos+FUYYf7pYieRXk0tLz5bX7dKQBQu7h2SqRBeZE:+NFHKdqUYSpYiq5VKQKqYSuoZE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d40bb5eacee555a5d734f5600e2fa77f_JaffaCakes118
Files
-
d40bb5eacee555a5d734f5600e2fa77f_JaffaCakes118.exe windows:4 windows x86 arch:x86
f99d5de6124499ea7c09ce49851f1aaa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord607
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 676KB - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE