Z�8T�J��Z����rZ�P�����+��|F����ob� (s��Y2Ӄ�Lu�9�F1�V�G�&טT���Q-y]r��22��������]fLzD �.��͠ bՃ�"*��2gW��b���zżA �}�+��ߕ�&xG�`1>�V��F�v�y�������y�2%��0m�M�ݴ.��n�I@@$�J'2/�m��FA�%�1���N�x8b�s�����A����w��X����"����6b������"}�$��6u�-;v��/�Q��#7S���� � c���ڎ�-�T����q%���f��h/\H�=���0��K~�c�%��� ��� -�ُ��Ia��wP��(ҵo����LY����,]X3�0�Sct�/oR ��1������]�i�w���QM]�+�(�9��>���mL7p4�WHnA�ۺ#J^����Z�z�o��$)�~b��(߹�����p���s*I�F��B�ɞ���XL~p��TT�Sb�����1aR]�'�'{���jP�������� ��5g�cD�� :,�[`H��x�'4^ފ�gA3�_`Ş̥���C#��ݭ�ًg��^t꣬DV�g�of�.gK睑��Y�(wf�`\m�W�����X�8d��BPh�E�e����?"&o���E�Γ��/����{�`�����C'9:O5������F�6D�� ԅ����M���Iv�6E�ӄԶ�X��pO���Z�|�^���$�dݣz�=�S'�U}Tދj�|،6nE?)�(���(�ʊ>�5LJ�P�א %g^� )���"`��m��g�wǠ���x�nwL��IN\&?�@j�"��(1������dEc��{�=��l�X�8#+�u��zѴ[kY���m�g�Ր�xso�l�=��#sMл�rnrE�,-��~��W�S�Ëα:�A��,,�X)����~��pY�t�")�]0��EFx9�'�ۼ�^���V���W����MJU\$cX�«q~��hnB�T���&�ҋ� 94�&g�5O9�})NT�.:��`���hKt{^��\�� ��ʳ �җ!���Q@�XC��jS��#J���XcA�2VK�)����4q�5�\�B5�Xtx RX�0��� �^��T��Iw�������kV5��b��U<2b"��0[����v*o�����iج��!�7���m�1� CWj<.d=9�P]3�.��bc.�_�H���mK��*-��7��)n�i9.m��ߞ&���v��~��ɿq� ���_A��O��B�sƚ��.�z��$���[�-�˄���<�ʽ��T��y��N����/8jd2��Q:��h�?�g��x��>��$f�@r�'��+��OO}�C�TP����U�T�����Ȫ��k�$c�54��f�E� �7s7�j��L�D��S�̧�[eʕ��ނ��f��Yl��#�.֣[@��;6�)�`ҨB뀗�l�{�d�����l�Q�����h�J��"0r�F���A��,>T��p<x&�8����Y)1���Đ�g����R�d���Ե�[ԩ��Hv.U�D���E���v��Ł�c�մn�x%�6oLՍ�.����XI�9qr�E����@/c��lE�ʷ��f!�J�'�� �� ���_�͌f�1�un{�ge�Yz�І���Xb�ؽ0M�؛�mJt͛���&��������P�Ǣ����.>��������˘Ie/L��_8�����hf��D��~U�̅����6��V�I�_�s���A�p�������u3ّ�ABl��|���U+iup?3��j�u�����W`�X�o}1�z�$��>�D��c��GR�Ir`��P Ǿ�|V��E���ȁ^��bm�k�P�N�o6�^�wv�{�ŕ��� ����CF��s�k�d��Eߍ�/v�R��L�kM�/D���H�x�@-����t�w�s�����]��0�i?GdorGCS�Xc�$�FD�d�wA�E�����i�n�1�p�C$�hc�6n��&w� �_�ΟP������Mn��{������k���;����Rl�KRc�P"0r��{��,~G��rk�D��AZ�BȶN*��Ù���N�HtB�~�^����Ķn#8��k&@ӚĤr���,Jj�'t|�k����ޙ��!1FcU.�J����s�>u1G6 �U��^Ɖ �"�Q-_ZP��g49�G�N�{|'䌃�t��������iF[������� f=[�/9����$��dwd��o�=��87V����G"�6\��l������@����ZT_��I���O�/!m�R8t�l����l*P�N;�[.���%S=#�"�q**8��0���C��3an����%�5�)�H���0�py�pA�Cu�$<��o�c.�mZC������'Pb-\�~���� b�����k��x��g��W;��o���cP� ������M��PY�J�a�'_�@�4a������GL���&�ǯmC���mn�x���2n�����Ck0��W���H��x~T�N'�Ty����=��ow4c�Óm[���:��ẩQ*����#�>dw�l� 3ǣ�5̄DH~҈/��K���YOm�lI��nk]i}���5�t<e��+32.��A�o6��(��P�� `��k[�F����9��A����}L�n��OkH�iz'�lx��{�$1����u����H�_����l�aeR�C9�r�$ٲ��z�b&��є����G�A+U�'E(穅J�/茳����t>�"�5�.���q��L�*@�Y �<��C �C\I��SFhr-��cOY�0����|�U.�^E'_�����{8BX��1�t�˻[��Ԩx��PlC��~K������Yek���$��~��v�M��X]Zr�$S�N`k�^�4��,Y�i�dd�е;��U��w��j0��>5n����[=�.F�xh�qN ������I������@F��� .���u� �hL�����_��2�b�|��VRU���U3A}ٷh�T�f�D*+�v����u��#L�D-�ZF���@D�,H��
Behavioral task
behavioral1
Sample
d4efa3bcdafd27ee4e513176531f4b21_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d4efa3bcdafd27ee4e513176531f4b21_JaffaCakes118
-
Size
2.8MB
-
MD5
d4efa3bcdafd27ee4e513176531f4b21
-
SHA1
b341f66014fc8f110df4916a46acba61ef66d356
-
SHA256
c40430f29e38fa042dfb4822145a535d7a9f242b68dc830ca985c51214e5d6b5
-
SHA512
90189f437797657d5ce16bf82e6da6243497d231de977f2a8b11dbf7043601953104638e219157799e1ef86a5e3c9ba3ea558d6eb971e78f079453f28822d47c
-
SSDEEP
49152:sbFX5LOVdeXBS6mIS/oiQ0XL7FB8RtuDQ3PfLTK/cDN54adzpDzsBcMwgkYwD7xN:+X5ijygDc0fP8RGQXLfGe5MwmwD77
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4efa3bcdafd27ee4e513176531f4b21_JaffaCakes118
Files
-
d4efa3bcdafd27ee4e513176531f4b21_JaffaCakes118.exe windows:5 windows x86 arch:x86
02bda24009c8d9cf9f520077a7e56c32
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaI4Var
kernel32
EnumResourceLanguagesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ