;���V^������9G�nr��7���Cs��d�h����A+س��^�-�����>_����ap��fX�s���z�=LސRs��6"+1 �J�Cb&"M�4c/uPy>Ƽ(��g��it���N�D���&^K��!�҃Pe����-��!y�z���."wP�U0�2Y=�Z��,����枛�b(�%w' �^��\���->�m[I��q��혐���Dp2?2-��06�L����i>@���q��ɂ>0#���d��D)ۑ�H͡�0IE<A��ݦ~Ѿ�N̚���L�фP�ЊjJ�g�An1?� ��T�ݻ����6�)F���.����<]����ʾf�1P] ���/�_�HTk����R�� �E\��!Z����̺Ϧ��Iw;�\��{���unOC! H�b c�GuB��j��V,��,,{���U4ݳ1P��������d����~Z�(;�Sn(��p��P��V�� �S���j�kh�(]P���p{��yo1�]��)}��g��r�H����%��r�wm ��.�T�� �Ơ�Q[i��;�>��R�QA��j��qz[g��ݥw�Gͱ,�&qC��Ӟ�߆h}��M$�thw-��LO*�T�&�y� ? W{=1��Xi�~��B��xv�x^'���`��a�y���������/�"!DW���ۣ��ԕ���a!e7R�Pj-+i��^�C4)GQk����2��!d�L�1�[����z�ڭ��"ֱ:��Ǵm�)|aߞգ, Z�+*n&<!F����u�ܑAV�u���[�l����"��J�hg��<�bʀ|���#wS)�<��NRR ��VLJ��F�&8���ֺ�f��rGr����NS�/-8Mt5�5���o/��n���,19�z��&�B��e�^����PT�p��F���!���I�b���/���@5k +��Ї��d3�h��]D�N4 ��&��x���W�C1�|F�v2LF?���O����(jt�1Ÿ�쪴�}���U��[��{��M�u�cM'���<[����BŚ]�����b9t��b(�6�D��gNu� T�����tT�cj�pO�"{����W��_J��q]�m�p�*;MK��u[��b#��;>A�tΠHNЇ��>� %�$A��M�5S8��2bJ��p�MDB�%���q.���&���?�� ��!Af�N��)���v��,@\��E "@����-��! fNAC��W��S�:J�������z�bw�K��������Φ3��DK&Uf�M姞n���V �Bǥ��H�%���J��� ��/a����c����'����sť�h���������JV]�n+����n�y*�^�/�.eم��$�q��^a��QK�3��0�h��)�p9�|=qp&�r20����I�ʬٕ�ӆZ�� r᪠}�� I:-%Ю����1�m5g ˔�`i�' �ywFul{��� �n����GQ�3Ch�WX�_����1�X����b��*�-'Ӎ������,�'Q����){���]+��jG����Λ��7>mZG����N�W��f����}<=f����Fp8lY#��q�n���$E�G��G&@(����Of��F>����!/��z3U���Cm%7�V�����\�ܫ��I!�y��-�>��4E��l7������x8H�=0�Q�,:�� Ɇr8�>�����'H���:U�V6�b`�`Rf���\:ŃL������w%o�A�c9HJ����䠹B��m����CпR�.,�[n�`f� �����������L⦪G���9�ɠ�H#�D�1�]���q$�̚��nz��Gx���q&�H��E��KJ$�]�s�]���+��Ͳa�{9�a��3�}&��"{K��� +2��3�̯��+����R]y�jh�Vz�I�>��+EE����xH�Ej�>�k�����/2$��!�RF!�7s��ゞYb�J*�bT��9Mv��A�,k�V@ϑϦ xC=X��n;� ��6CQ�!U�; �Z8x�=lݥ��� i��6{b�����3�ߒ6�eQ�[G[w�.QX7�=����Y6ͦQ�'`%�W˺W�B7�G\�����>�ƱSX�-x�\���KC[d�[;�����?m���zx��t��M�/{��Ų���hW0��'���ܙ��2}e�gOЪ>U��?�AT�������KW�F����K�㗐~)JI�QC��*���#��-�$���Lp���ښ�L^���;�\��;�b���7-*��y!��~ybɋD���������3VJϓ�U�G�lMl䅥-�/SL:C�煫��R&�$f;��uV��h ŝ��? ��#���Ƭ ����7��3��oZ�fd�E5d�Y��@��擵�b:�>]�Z\5�=�����*��Ց�&s����#a�҂q�P�/�OÂ�e�ز�̕@ �!myپf$l��]q��.���w;r04̉B0�q�����y1�Q?�<��U.��ۦ���t�����Fl��p(���p�+n��4�.�Ϲ��Wdc23�����5��yF�|�~��sj�ֲ�6�|����RQ~��T��"���J9��p��� X�4N9���=���BEf�(Ykм�q��[�~MVc�\���T�����d�A�-5�"Nv��i��n9����������(:��A��t��Q[{��l��'Sf�~$�t ��r��M��7�}\?U��JF=|;x��<� �n'Ź�=���F�1zR�"y���Z8;ߙ�/�֒�+���O*��M5o[��z�����R�0���;�u����3@�z�3�Y�X��]�G�3��y�MM��C��z�h���kɇbT����nȷKW�I.�8-xb9C!�/ t`��-q���·y9''�* e�T5���P��Qm�̐6�Hg�H!G� ���(��H%,��yϸ��?��z��ӫ�v�nޏ_ȣ�[���CA��Ũw���!��(��!u�*4 H����2�oVa#�yW[�Ƚuי�����=ѕN�@��8���Z��-�dn~�[�h�:���[ ���41���
Behavioral task
behavioral1
Sample
d693d37e57d04d43724765a84c735dd2_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d693d37e57d04d43724765a84c735dd2_JaffaCakes118
-
Size
252KB
-
MD5
d693d37e57d04d43724765a84c735dd2
-
SHA1
e2255e9b6a28feb07ab1c9f5f7d591a164512568
-
SHA256
4a41d85f2f2931b71bb512cd1247c394908357bfd06900fc12055bd8b510c479
-
SHA512
2d283fe9229becbd9ea9a5c1ac6e81714c710d11f3452e2d59668d4592f93be5d09bb21c9016f6cd646fd6be83f8a29f93c0a62b0a2ff0c830c0a7c3eee7b3dd
-
SSDEEP
6144:hbwEA0jpxF4sJXPUJ2dDNZZPoMX7pCA0G:hbwMTP/UQrZgM0hG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d693d37e57d04d43724765a84c735dd2_JaffaCakes118
Files
-
d693d37e57d04d43724765a84c735dd2_JaffaCakes118.exe windows:4 windows x86 arch:x86
ae85c04f07c737464959b1ec2aff9eaa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
FreeLibrary
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE