�zk��f w\�1#3�r�Z)aD�3�4�gTK�x���=��0� ��L?e;�_}(1b�H���a������}� ��I3B��h��\/m����guL�}<��=�gjƜ��qRx�!��pp - ��-����q̿�%���Ǘ|θl�H����`Bm#�/����[�R\�����_��)�|nEN� ml3���"HE��|&Cm 3���#�ek���������l� M�?<}�R;�Q]����Ŵ]�@iky�`p��V1�s���]�� ,֡e�q�2N�O?�g�Am���(��f���iJf۟�K��M���a̛�� xV5K(��QA�����(d������8�.�z���0�mɬjW�y����Un�QOq�F��D��*�г�`�0�U�CӮ3pY{2%�<_���cAJQO�}�J����L����aZ�����#K�V*$\W��ޘ!�,A�P����5 ,ǜQ֊y<�u;,1E�F�m��\�9yj�@�F:�$� ����у��Wo�#��k���ϩy��5���mn"�_f+#^�����q���? D�D���?*{����Xju�(���}N,��A�7n���� �W\�_(ODCN%�L����6��y ??�ޓe��D����1L��x�U9���p�^B7C���C�VD�����iڿa������3��xA���e�W���.�QT�3-Y�|j���"����ge��n�z�ȵ�:I�,�V8�k�83���TP���N��_K���V BÙ_�XA�W�;��Ci�-G����;��h�۾۟�9�{�����&���C�Fn����7��h�d��(jc U]������0N�K��9�����ә��ݳ�(� �h��c�R8�D��u�{(g�Z+4���cO����uX���ꗐ|�7���7��<��LCK ���Pf>;�z����%��@������%���sAJ��8* �?�E�pyqОWH��!=7� uTfK������9� D��_i�ʫ�p��.�b��YTg�C����F�����}*,��vV��Bv0�\��?���<��+v "4r����Z���W�v�Wc�F���O�p�U�ʹ.�ͧ �起�̳����g�R~ ,��Ct)Cn��s7�qQ�o2�9I;/:lÓ�\��Z���AJ�S�c.�":���|�����En������K��0{�f.��{ue*�I�J����Pl��pD�1����s�����hB�O�3�v-�0�4:B義�e�C��r_/�G:�e��1�����UF%��*3Jf�d���_V}l��r��ͭ��.�1��'�)y2f�^�u�;~�؊��+cu��;R�$���F�ږ��a,B ���٩}'ѯ㇀�a�+�Sov��;��Tu�^�q��&��KT� 3V\�d,fȒ)Lэ�H�r�"�����h��Y�����fZ��#8��\\��YvK�_��'f�'�-z5�:L�+J�L����Y��M��C�]�?�T��f�{4N���,}B?Ȋ��6�"��Ӱ9:�[��O��ܬ��e�м��\���D�V7x|�+��zA��k6^�.�4ֱ����:>6|�����:��ǔZ{�V_���2�����K����Z�1�����p���./|���R�� 1��N���V;����xTn8y��j��Ȗ?�e�V�x��a�$���P;g4�����iB�6>3�^���z��D��q1u��]�l7 ����K?��h�oe����1d��HD�iܘ��L(4�f� @11��o5P�A��e�F�٠����֚l�xla�`2��|B `���l.m����A�'O��(��z��c�*�Tw����$,����U����=�(@��\:�y��J�Wη`�>��K��#���s�l�[(W�/�9�k������XY�>ݛuYTe�3��m�.��!��AȮp��ڸa4m�R�6v]Ֆ�\��t�]ɷ��f�/�;.�^i4�\p���� D̺�.ү�3E���'� �S(�wU���x���*>�Q��Rץ�:Ay�z�6�e�Gwi��.��z{�N����5�����5���.F�(g'�W�8#D_(<}�w$���|�9u�~�~�:�;/��dܶg�tV�y!��?�܈g��O��X���b�_8�'uQMZ�����������o@�Ol��T��_���E��V�/����8¥�~na.Sv��"��TD�2x� :�K����@A�hTdFi/Q����u�K��t]����2�t�!��( gi�����[q*�7�u?�,�M���!:L-��5<"���S��p&%;�YZ_��*9�ظw���H���G���;����2=U��`7���� ~��� �(;��c˻9��@��>���cJ�FO\�g�������j�iF%'e�b���#�.��k�D���U������Z��Q�Ed�?EN�Ah��s��J:�9�H��o&�n�,�������>�������wgq�I�ϘYj���q��2���%j��!����`u��9;�E��6�=Z����iT�ء&�aE�Je�7y�\��U��(G�/0'-�z����~��[�o\��=˰�ו����>7nʼn���g��j)�c���M����"~�lȓ3e���D�Ɋ��m��V �=�J����� :Ly{����������p�!�F�[y�p�� ����SC4��]� �������۳]H���T��Oh�ʴ���zk>���\��Q��`��eR�Ĭ��zZ�K=��S��ϒ�`��R^&"Z��p��������Q�<�����imXJ������B�E>L��#�p�UhA%F�t��J6^k��j�����$�M\�},�c��R�� *�3۫�Ԫ(�ņitR��̽��]�R�.��E�x�b�ø�X�Œ=��_��`��9o����0N���<{1��'m=�� ���/ې ı�xWmo��4�V�6����@tDB��y�[�$/ ��[��~��Ï���$~�����B3�^ �'.o���L�c��eV0ݢ ���'OR{}�����F:#V[
Behavioral task
behavioral1
Sample
db521aa15a40bab22786448a4013841c_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
db521aa15a40bab22786448a4013841c_JaffaCakes118
-
Size
720KB
-
MD5
db521aa15a40bab22786448a4013841c
-
SHA1
20358587c18c2c50a2e9a41a90a0787560953ab8
-
SHA256
fd79d12d123fcdf1819d47cdc888b62657a635f1cfe59101e7234b43120fc070
-
SHA512
65453264d6c977211c7e19eacf35d3a1225d250e15ebd193f1235ec4c252bdd989e54be2d21128635bd8c260b24940b28f524eac6b390c538b28403ae39605fa
-
SSDEEP
12288:oz7mRhD+I93nHyqs7PIrcj8gcPtMTCJnWmyKMikyYaklkbor93Tgo6jiD/:oel1lJrcj8gcnWzKvODlqL+D
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db521aa15a40bab22786448a4013841c_JaffaCakes118
Files
-
db521aa15a40bab22786448a4013841c_JaffaCakes118.exe windows:4 windows x86 arch:x86
3922ef0edfeffafb85a042db5d6e4b84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ProcCallEngine
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 706KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE