T��_CgJ����#f�M7���K��8�$+��0Z�̀2�t^����X���?h[�r0WZ�x�vʋ4�!����C�{��2�J�i�?#���9�@�*�(�ؽخ����ANh!�A��9a9����G�҃>�X4'x;5��>�Y��+0z��K��V��h���/��ⅾ�Gj �^�=b�"����Z=Ĕ-����[,9P�[���˹g��\ x~�^��L��&C��ɷ�r���淛�%E��?u���%&�6�^_o�3��\�&�W5�%�n\bQ�y���-<z" s�6�B�u���2����wWZf��#X,�8�1v\��ԥ-ij�zR�X�;\��H5w��;x��}���@��J�|�QSe�_�>\�Ζ�C��2D���ΘZ��j��'��1G�$q a(Q�PL�^����p/q^-�F�6y�~�l�ap�8����ۗн:��JG�pF����6�>M�H.�����^G�-& ���U:yx��o�P=��{/=��љW:�֛f]y��şl��E�QقxJ�s�q��>�R�����T��:o�%k\6E�}A7D�� y�Vy�B����G)��� ��=ޥ�e�>��Y��e@��<��g+��I� �H�s(ϴ5E���L�vs��3���T]�V~+�3���#���j��{��$"�a!�S���&�h:�8]���o��Y�#-��|~o4�@��k�ك*ܐI|m��z嫂xK�pf��nڣ i��*u2�R2���nd/jI���l��X{��skF=�/�[},�ڙ���.}%��w�g�'�.L�E���ޜ��EW�'�ÖD��p�i��8�!Ϥ �1�"(|�ÁZR����r �6�����u7˦�\&m0�,/��#3+:�ԟB|�?��F�`��:�fmbr-��d��u��h�bO<��gꎀ�r�d8�/91�z��[�U��~E�f��w���Buէ�n�x=�.m*��F$�������s�㏈1�o����R�ܜu ��O����Լ��n���2\Ӡ���$�?�P�M�o��_g,k��B�⻇u�\�%�l�������`��x��;�nv=3�a�Ka?9�7�|U9ʪ�Nɱ�e�7�<�t�� ���H_a�^M�L7���k ����p���|�Aizy]]��҇�jW�a�XMVh�M��p#GeeFnN]�B�FC��8���' ����5�Ci`�<��+>rD첞���r�q��ї��Kru���dd}���6�%/�ǒ�E�*e�.��pLdCT#ulzC*�$�~F����������c������h�̞8������z��}z��� ��8���l�j1�k��o�4�t���6�i����M��]q\^���F�l�j8���X���@>�@��d�������A���u����b������J�q.Fk�_��?p�b�H�6�"P�� �%zq�|0Nc�Wt/��;�ɯ)����_��L�`F&���6g�C�x�ND����D�ragv�0\�o���^�(|N��F&q����5z���'�iW�n���7x��Cb��W3�����n믟Rߤ����!�E�I�!�]�#\Tn/ ���%��l�T�U����A�^9J�?�R�2��������'��f�=M۶i'���d�o���.�=k�z����,E�'�N�aO���7C���0�f��5��Q��@a-Pa//V�����E��ǂ��f!0s�8��[b�B~��r���� ᧱ ��G2�W�P/�r�䄃]Zf5�{F�����W��9 ˿�I]����K6M(�l|;.�@����xkB6C�]��C�d�~��������N���R.H�5������du�s�����p愬P��GGoxh�Ѥ��V=p�(��N�m�((,�߂�3=���/"e�(wa���9�"���[�kN �-ic�q>[,O*����ֿz�ي�D��.�ڌ�'�ڍ����X�?F�f ��Wm��o��3jf��ё�kV��_4X*��QI;ۖ(ŷ�4�"7yX�^�ֲ��J���ӎ���e����d������Λ?Vd��,=y`��$ڵ�#��n�E�W�d������oƗJWn�]t��Y3f�_��&A�dž�[�R��zE =w�}�vw�/S��_�f����Ԃ}�˾��7�i^�)��ҏ���j��s.3���mj�*��{���sv���V(o��C<[(�%n�1�d��s�S�1����0�h����Ya�Y���0"SP�~�?���?�,�_��:�A��^�o���ͨZ��B���g��J�7Fɫ)s�j��X��b@A���X'��d ��-�4v�㇒���1;{���^t�1�eWb�#K�VR��3N�!���ݘج�gNeņ�4]s�����l �zt��Wf���B�˗N)p�����Å�:��ƨ�Ѹ}V�=��r�����Š�x5()< t����[����h 0����3��A!g��92����<�p�>������ߗ��� ��ם����p"S�q���B��3�J �G��-W*5=��5�+��� �Bxo�� #��(�-�i֟�Cb8.����YFf0�a���R���h�7���[�VQS��r$�J�m9q�&�-}�|�I�PU��~X"��x���~�Z5qE����,Y�PΖ������h�.�D�%��qx �d�"��3��%���{�~������o@'1d���Z�-�+��w̓{����K�%�jXz����t�8y��&�o��H�]������A&�]����a�F[��[����[���%dU����������I����J'�1����ӿ7Fs����}u-K�w�nM�)=Z�,��9"Tg��o��f�����):cєy�3=3�Q��&@YVs�,-�Eb��~�4x�+�k��s�7H6�em��l������QLJ�-��� �"C���(����ɲ @��qm�C��0h��@ ������0a+YT:W�����&+j��I�.(�xb�5' \
Behavioral task
behavioral1
Sample
d5b17dd80ee7b512709c5b6bf63a4324_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d5b17dd80ee7b512709c5b6bf63a4324_JaffaCakes118
-
Size
112KB
-
MD5
d5b17dd80ee7b512709c5b6bf63a4324
-
SHA1
09c972ac4e06e1dac53adc2baa09470665179ca6
-
SHA256
43fb97bd34413e005fa5784ec55dabf3352073e814228befb1b309646d0530a8
-
SHA512
702ed2c8c5289b659ad938ba4a051e6f0d9de9d012d56b24643c633a6b9f96bbd6604470345116395a9e601e4688bd5ba36a82485ef3ced701c0f06d6e79ae7e
-
SSDEEP
1536:/+ujRZJif6F2+jHuZRUYfqAi+G0Rf9GLFd9VdYmKV0vu1bQATsSD3zfLAOT0vOD:mujnDjo2aO+G0esVJhRD33AFvE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5b17dd80ee7b512709c5b6bf63a4324_JaffaCakes118
Files
-
d5b17dd80ee7b512709c5b6bf63a4324_JaffaCakes118.exe windows:4 windows x86 arch:x86
b5a6a25ad48910612c3a815d19d761e9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ