��A��6l]�}�j�./�nU�Xp�]����Vĵ����4OI���:��F�́��4���Ю�l�G |�rC�����qo��v-�u��9��5p�8�}h��X������tDϦȈs�t��Ek�Zz��*���1E��r��і:��u%�)"��Կ��ߪ�*�D'��ō���RjɒCJ����5m�mB*i��ʥ�̊N_D([����|�t��}������|ˬ�/����G���I�}�Ux;�ͯ3�(\P3�$K���B�m&�wb�&�17x,-�xMk�-��>�C!@���3NQ@i�k���9��d���Ao�TҾ��� �t���zTAD�/\���=}�V���N��߸Wv�rf��_�T�2^��t������}�&z�v����H���>=@��}�Q<���"��M��\�NF��e3�����v�ץS�neT�U8�L���$xi�s�X�p�`0v,��a�K�&��}N �G��خƑt8�䆸l?"f^���`��Z�g~�#i�pOE�N���� �xlyb��/b\G�C�'z�����<�RZ��T������ :ptu=��<���@�x9��p/ +�C��좳F��(�T�ae�n8Rx���ȼ�U�=�GL��n(����W9���9T��_�0.PD��< 䓞ϢT~�\$6~�$��>��3��x�Y#�uSiv������ܯҿe�_�3�U���!�L��������IR���[�B�IHz�����V����hH�~��h�S;E����*�4�p�C!e5�m�sW���&�'��4�Cx��Rח�|�8`oIR�AR_�ԧ{�����&������Ueh���E��uO�kp� 7ϙZ ��V���?����`�|�H�d52ɰ�����֊����&�&jm���K���n��/>�0*Kϸ�㹤kB�6�t�9̾rZ��Ϡ娎6�[��A!��Jr��+r��c0dY�g�N_:i��s�d��K�^al �Hf�9$�gN�ͥ q3�2�9��{f�b{�[OoY�w8Pt�*l�"ڦ㚛���,Q'x�e/mSP3��U��NNJ}%%觴���R3�L ��p���/��!�[X��"\ޓ��!�@�$'��N�%�~��ot�i�'#�A.$MO��x�K*X%�d�g*�V�I^��w.9`����V������$�oQ�`E��<�U�N�(wa>��N4G��E��p�DE��ް���-Km}ѐRKx�7a�O'��Q_ƽ��y(x��,��Nkq?�DlT/�4��侁!�x���3�}��x��g[be�x��>�$��)�����9��4��!(�/:�\�yh/�ˇ���>�@3���%~T4�L�W{)����)K����! �{�Us�����wJ���Y�eFF���nQ���r��i��H���%�Kz����e���%���q|t��P�}�����>#>Z�\yG����O����(�+ߡh��GX�݁<�"!�gi�EK{($(�F���� ��H����tr��淳���NU�]����@/n��m��O}̟�ד�f@��m�W�u�ʑ���l�G�Ӻ\��s.*�ԯ���ܵ/K`�Q�4ɷl�7������m����<��*lR�17���w$P�� �n�R���ש:�U6�>#t��QW)���ò�Cz���t���S����E|���7J�@% ԄA���e;!��6<ƯP��MZ�Jͦ����G���8��8�6�{쬰*P"�)^�^���3�a��'e�?�s6n�Q������fe����L���Ϩ����K(���(o��Q���m�#;�$u�A���؍9JdR�6 A͆|�Z��"�%�����6OϧU���=u�'r��t1e�KǗ�TR��h�ֶ���5�pg��e����G ��X� Q�Bt�3�[���k]<n�)���X[(��]dl�05| �y0��8�JV�a�:�Y�pC�j��?�d\���"��9�\�7Z��1�lIߘ�D�?���P 3��c���������k���iC�v�7H|P՟D�ܛ�PZU��zh�Vp��|�.�ѝ�Ab"@��#����D�������S@�����S{DFe�d�"�/G��8g7�Ny�ɨ���n��@f����&`��V���G ��3nj�g�j���{\e�o��� �T���C�A<�C�F>>���7�8!�U��_����a��l ���~Gjm��q<��jEz>����Ӭf{7��з�^2�.J���i�5��X���;�ܷ9��#�����gxH�J��}Z(=#jL��΄��Yu���=�ԗ!�1����ֱ���tB��(�5a���-�������m:�,/�i��nf 7��k�I�tF粴�J��w͜������M��M ���筹o���]bJ)��ޅ>e�梹�~(��~�Z (��d囄!VH���A�̊Zif`�}�0(��@���6�ljd����S�����J�G�ZAy=5}v\�zܬ��z� �ܶ��z!�E�%~����9��yJ�L���[��ts���dSP��>���硆����>����w[�2"2�@��=�O ���x�u���?o���u��>�����0������ؓ�&w�4��9p�1\b��!L���$Ṣ��_�\~[ΓD�k����6Ud�>��]��C��������U�Ö�]ֽ� �&����-���'�^#��JJ�a�����O��:�x^��7�� ���#d�j�(����Ci2��:L����q*Ol5{pO����o'���>�}/7�4?H�^�黈x���J�����|���*钔�~sIzYTa��w8��ԅ����-��$E������qe��Ei�EG0����@����!��o*X�~^z_n�� �M�c�7E�M���{�"P������Ζ���f����Z�� 8��cV�l�,�{=?DC�kE�kt��,b���ݵ;�kD��>�^UA'3wE(�0�ʒ��1������������`oT5р�pA�>�uB�6|F!�d���
Behavioral task
behavioral1
Sample
d4d63b3e7fbd20b42f4942db32fb045c_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d4d63b3e7fbd20b42f4942db32fb045c_JaffaCakes118
-
Size
1.9MB
-
MD5
d4d63b3e7fbd20b42f4942db32fb045c
-
SHA1
8669c8124b360d7f067d332bce2a4076440f0c8a
-
SHA256
93b37d10d4838c98bff8d3ef63868613cfb904a79df3d71ca5aa9aed0603c399
-
SHA512
519318f348d70f84139758af563f0a45e95610296c7c70cd0c83d1c0438bb5b97cbb420a3507728813d6d8e81dbc2da055c3845e21770e55e8d98ab84d29285d
-
SSDEEP
49152:8GCWbL5zoZgDbNaSEgkr8mBALpteL20qAu3:JbGZgDbNvkr8me/eL20qAu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4d63b3e7fbd20b42f4942db32fb045c_JaffaCakes118
Files
-
d4d63b3e7fbd20b42f4942db32fb045c_JaffaCakes118.exe windows:4 windows x86 arch:x86
72953c4842d848d28fa8ca5792ebb240
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteExA
shlwapi
PathFileExistsA
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 232KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc1 Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ