I�'�Z��C꼿���T�8���;�"���Sc��dܟ���Cd�,ң{W<,m)j����ѯ��Gj�E����<�;��Uo�TUr�W�Ix^�wA�Y`�:>�����e窩h2���'���Я�H!4ϲg�(�@���&��G�$^�����-��/���/��n�V�`�.d���p���*<�Iv�)���^��mV����KF�q�b�[,T�]��>O_�F5���e�x���Y�L%Q؞�����B ݿ6��<��Zʄ�r�Q2B`E�d��B���Gl��w'|#�Q��@["����3����*�%��&!K������n�.�@�A��69R�5dէ7i=�.�]�Q3�J���C�ٯ��8��5Ҿr�O�CJ#V6��A\#F�?߫l/@�?5���lW�2�K�L\0e� 'x_?���7܂�u��k�;������!����Yr����M�,Kv5�FVs�!���n4;6�ᤜ���h[�1f����X�\�R�Ʀ�J�2��M-�:7[���d�\��ؤ(�N�tw,��0V�yj�,�!��y��Y.i��*���xs�)�{(�;����VR��G(�!�b�����_Eb#��9|�ߙB�<�����V�b/2��v��H�y�X'�F� �wl���`1wę{���� �g͛��eT!A�ҡ[6��z���J���{�b�����z %z�ץ�.��.==�9 �v3�S��&�;���rl�W�3WX� S���o�D�32֮��Y�ަپ�%�,��[�Z��w�OTUX{]�TZa|���A������2�,M�B�H�pFܽ@��\���/!�i�LJ�Hd8*��xs��3"��3> �x|s(����r�5%�k�"u6��Pb�(7���f�����$�+d\@I�g��(��<�j˟���Rf� ���o�JC�n3=��k�qp�u6�$}�C�@��s�dQ� ݣ��{Ϲ4S1��%)��� X���ͦ *���)�ׄr���a D��W�>�e�P�H�۹(��9>mF�����Q�*c�w|-��`�)�A+�QEg؆�&��_(A�s0�h7,tɉ63l]��}�^r�3�����%������LgAr�e�P�y8�/�4����4��;sw ��Z���`��X�6A ��+G����Sn/����2�����}��ZɭԒ-���-f:���M��]�@TW&���F(��&�NA �$�%˰(Ѕ�X��{L]='�梚�9���ax��{@������l;���K⎜�~��f�߉yio� ��YTd�Eh����2Ƽ*��Z}C�ȟ>:h�Cd O��e�mzU���Qa�[ ���(�L>�]�Ҡ�~��1�n�S�h�&^Ŧ˃Ўb�X�eU���Z����'+����Y��1��&�;������خ���I��~g��7�}N,/�<Nt$+�6�լ�0� �q�c2#��2�H!��4̔eCOu���8۽>�Chi�7�8��Z��0��6KXI�������0��d�u����1 �X�},�9��������߽���5`�������Q���>�!�CWԶ7�� ��:L��ƋfȐ�G�!�%b/T(�o�rl���<wM�[��s���T�3/7U�[q'�C��ى���=k��: ���Ok6��%�_��<��^�Y,N.6��c�e�O X�t�C�m�$s�|�ߡ�\�����N*>�3o:���r���:+��Q�#=1�����'�?hz7����e%����B{�.6��V o����8�R�d�Wd��ha��C��ز&�����%eZk�9a�tta~��8���BBS�Q69"a��-�n]��O�^Ģ�L��ѹ�c�Ya��%�q��<?Dyd��NF�(-{����Ҙo��6=�X�c����c�Bz :�����1�ƓݔP�3=���M� �+�tar�&w�Y���Ė�����{��<b��j߳w<�����b�{�i� �Uo�G��iZ]1���)n�MU<���u���>�y5i<�l�K�5�F`1�S���)� ,z�w�bJ��m����&�D5t݉����i���=�/$�2����i"0��Q�V���N�Ї9��#�6{�t��ca���)����U=��A�+�w�Lm�P+N���x2^'Qh:sj1q�UVhY�� �;B���M�ګ��Ն=��ƒ]�\��y:p� �R���3[���j��2���v�T��T���V�D^��Y�\�<�ϻx\wM�_�U_ݼ�=��ȱ��Ob�u�V�b�d�A�����$�o5-7?��Βaf�w*�n�s\H��S*MsN϶�<� �]��3�;���X�Y Hu�j� ��2,��=l�Ӕ�1.U�ʧp��}i7�U� ,�k.���ߗ��D��7��Nl�f+Co[�8��*KۅMX9^��/ �s��3���AN����Ùn�����YEպ��P_����\0-n���p� T���J��!�Š�)�S-L�g��e��v2�y�6�N�Ր�K���B-����F��|�~`Pى�p��7횸,����DtW�Q��$q�[r«؞ꋽ�P�&��ψ�7�*/J��������$I�����r_�ȡ��˞��cP�����FBA�>���uPط��3�i�zma qX �u�n7nX���k��ou�L�G?=����Q�L�hz�q�|���6�,D�y��Qo����ꃅ�������)ft�#��(u7�h,�o��!!ޥ��+(�������QceS�u�s�B��'�J���O��m��c=V�hW.v�[�'��JE /u�������هDEִ��6TH%Ԝ�p�j���4Z`�?h&�������a�Z?h>!��ew�_��.�W�!H[TѠ��b��r�9%ݒ|�YC�m���ͷ�%m�7��u��r�U��%�f�"8�w��o+l�Y�]������A=?�#wB�vᆽrH�m[dn�nD�� ���eB�>�����e���KJ���-�/ ��� ۩5���[�Z�m�����p��=�m����O���5t&���ߝ ��B��+�P��˝�����$w��C�ɽLǩ�߃�Z��Ex�\��Q��^�
Behavioral task
behavioral1
Sample
df1483d83ad53c7f20b88ab35a456d87_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
df1483d83ad53c7f20b88ab35a456d87_JaffaCakes118
-
Size
816KB
-
MD5
df1483d83ad53c7f20b88ab35a456d87
-
SHA1
e6a365d18e3fdbb69a7702de07a70377700f25de
-
SHA256
458a7f6e0726d6565cdc50d69d7e307fd5de9f0daa40704e81b798752b64f1c8
-
SHA512
d4b4d8dbfa821b995b3241ba6b5a779aa7ccf51c7cf2515c76997cf3411eecc1b15b8168b3b2cc34a3c8019044550e573c254e81ea722647523814010d2ccd7d
-
SSDEEP
24576:vi/ynlYUBCnjCo2luQhyRHbl900Bzu2I:YYyjChuQ0HzbB2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df1483d83ad53c7f20b88ab35a456d87_JaffaCakes118
Files
-
df1483d83ad53c7f20b88ab35a456d87_JaffaCakes118.exe windows:4 windows x86 arch:x86
3922ef0edfeffafb85a042db5d6e4b84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ProcCallEngine
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 854KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 451KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 800KB - Virtual size: 797KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE