�w����'/&`��q%aY�C�"����PN���j�[�4)�)��mʈ������(ة%q'洪�Dm�>j��(s���x���������;�U"|g�"=�[��m Nւ�Z h̲֔¾��"�y����[���@�M�.�� �S��NYX�α����F��PQ"��7�3+���ydy+:��A��μ� &��b<��d�v�$P*��ՎАl<M��#���`����L:w7�pǃ��ߚ`З:���/&Wj<K��R~��a߹����ZB��~�C��능���ep앗�`�{SD(qL�yOon"D32*��M��?���u�\8��.���-�?B��O�A���.�ɇ��D�W�`FxiK����o����2)ٖ�G�օHP'�����^�2Ղ�`0Ꮦ��G=�5�@����� ��W�DMzY��]"B�0}��E��_td$l��ݎ�٫MQ�?O4�Dd�0���]��8�r���W�W�� ���0��{0Oy[]��Qh+�>���"�;�����a�E$���o>��+��hܛd�g��J���\PG��á�6:y�_�wgs_�����v�/��o6�H��Y�/xT��w dE��S'J��L�>DP��yX�o��Q�by|^��0��%5���A�뇁z��aؠ4ywر�$7��B!En6��!t)�������G����ڱM"��В���K_2�}�uIM�=��7�[�'Q��������v)��y� �B_IR>�S��es���<��g��mKB:3��p��]�)]�;���^��} ���t��uJhB����1Y-v#�������R�1}PZ� �[����g*R���lŕ��W\��L/���� ���V|����1_�ٌj`O������քף)l>�(�|.e��G�y��\����!U��b��pO�%����9�N��u��F~�fBv��S�Q�H�bݵ����. nh(��=El%Kt�6EKm���`�š����{���N�qaA�]��ŋ[|��O��C^��N�rI�!Z�O�g�����1wL�ٖ�i��K��eN��1�"����K�����.�h����$Kֶ��yX�W�w�R�/������ �S^=|-j`�HU��_2��!!��L6���$��nZ�k��G�ɴL���eq�x7 |���4���U 2χMR���PzVCjf����?��b �W��۶� ���ӌH0i�qK3�S9����,��8�h���Ic��Fu�0Fm_+]m���7��� y,�'�� e��D��f�v=��"�HD�R$W�fn���� �-� Y�@�wg�D�|�1%'��Z��C70ߥ����@^�l������z�\�.7��������0��(5=I������d��"2���5��6����ڒ{��jA�-�wʖ�6��X��9��rB[�]]�Y!8��f$�_�}۬,�0za����P�i�__ a�ÿv˳�A�W�i=�R����f $`EA�A�.��|X>[dϿa�Z�p���[(�CZ|��ز�=v�ZO��y0�@�oe��g��� m��L\ -�O%�{�u��XC�����3\洃%Ɇ]I��ow���l� ϫ^G�\<��� ��C���;5'�j�]y(3�%Ft�?�k�@Z�D�Z¿Y�(8�dQ�3���X��N��� �6lm�U�^�$��:5�m�5�P��|���垦��fL9��^�yЄ'{s}L<��K :VR���p��I����jR'/w؎��)s�#���cTjw�N�����w�� �m��+��pf��- RG��sw:�~6�ܛ �0�Dl�2S�g����{�=��u�������bCX�(�/G��B��/�8�f�ф� ��i+���'�wh�/d�p��"$���V�7u uJ9�daᄛtϿ�?&�4�zC�d&�(�&���2>�#.�j�=, �姞�>�U���Jh��J4 L�� ~m$e�St���lkW:4�s�%Dz�r����{�fh���t�y�$�7���:x���UI�9 ���2,��!@~�oQw3�j�S��O�(0�V���A�A������������p��A(� �.wm�{5̰�p#~o����C��n8aR�"���$�#\-�hЀ�sؒΣ��n5�U���f�=���1_�\���Z��E/�v���؎��G2M���O�'��1��Q��?9�R��T��¤�����~��!wS��9���������~7������%E���+����C>���qS�� 8�p���M� ���.��K/�c�V���[��!��ï����9�!�\�� a��4Yk� h~l�Ep�fr�BFp^j���=��%�|���Gc|[/�҄W0?�x� E� ����vTb�Ļ߲����_�!���D`��A2��Vμ������L� !���y���+�� �OC���J'���h�E��Ӱ��� '�Aw�2q� ���c�^S���y0��c6���D �{���")Wu�;�����&4Gl�`gy��>H1�b�9,���@Fs {����HH���h��'*��V�:��D��\o���=����/Z�D�^ᅨW)�ԁ��Z+������,L���!Z����2��ź[������*���5J��t���֕�ZōVޏ���=i����dgC��_��sR(#�<Xj;� q��Q�j��i \���P�^�֛m-�Wĝ@��r��<�S8E'حh^�v^� J-�5qؕ0���$��3���f����t!���3��8W��9�kP,��i��� 㒇�C'|RE��(������U�s浵���ʫay0f^\�8�]�E��zd��[�~�m��8����`�nE�Om���uM��<�7ئ1>ffl� \mɖ����=!u�G�p�`N,*��%��G)���t������p��z@m��V��n��2-� ���#��W��ã���>����y�@0Ϊ��&���5�UuDeSD�@��cauq��%��9�X�Pȓݺ��Y冈�iC�2?�L1�1�MjC��w�v�.�Ø R d()���
Behavioral task
behavioral1
Sample
d68741c8bace4d295c7d8fe1ad9664af_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d68741c8bace4d295c7d8fe1ad9664af_JaffaCakes118
-
Size
716KB
-
MD5
d68741c8bace4d295c7d8fe1ad9664af
-
SHA1
ff1753386d261edccf120a4477c536e555281551
-
SHA256
d832bb5d4a05d732b9f53cc1c94589e18d175797474519077523b8a6a02f9419
-
SHA512
8f083acff91e4e2544ff09b2f7e2bdf608049a0bd26bf7de4ff2bafdd9890eb8f8bc59875ed67ab4fe2772c9f7f3cae7aeda35e91836c0cbe90786aa343aa4b8
-
SSDEEP
12288:IMONgqfEmNFnnwy8HlBGNIDzDJR12E9vHX49/xpomwSXI+T5hzDpV4r0:tqgqJNFnqLp12QOM2JlV4I
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d68741c8bace4d295c7d8fe1ad9664af_JaffaCakes118
Files
-
d68741c8bace4d295c7d8fe1ad9664af_JaffaCakes118.exe windows:4 windows x86 arch:x86
8ddd34fc0b375258f386d5acc27932d3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord698
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 663KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 704KB - Virtual size: 703KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE