�}h�ƖP�?ϩl��F��t~5�\�˚�@z�~�}�ڴ��!"q|V�� �x������:b'I����J�|��?�0��@���Z^d7�}�U�j�0���O08"��M��U�����ç�Y(:څwC���ອ�,�4v���Q+ �n��0��� ���?U����ތ��a�:�/X�<{Yȅ��VY�.H��!8)�?\�8�"QX匳Y>�4�sq������uY�"����t���=sf*�I"��C�b�xbd���ϗ\��U|7Wɟʺ�ٕrD�K_w�3��H����7��75Z�;H�8�Q{���jd�P���ϓ�ۣ�����3��/yȇ��m��� Z[�ST#�-��!ڥ�`"��p�b��'<I�z��������J�M��h��f��}<Wh�=�;Iƃu\<������3Љ���":��: �ހ���Y�Aw~��<��~�v�*@���y�v���n��f�NR��d���D��mϽ��Î"L��_$۰�7/��Ռ� ���+����e�2M�s��/�����'���e�M:U�/YC�i���ɄP2v�����:����p?�J����H��W��3Ya���H��oj�c��2݆-��#j�B_��1@Z)&��<���.��`ɷ�볯 �q�[���{Zcr�o�{�OS�ڻ��?~����wNV� � F&R1B�?+aʖe�1|���v$^^G���Zr���o7���_ڶ� /w�e��n�������Yi���[iF�����#Nj�w�Ѭq�k��������Y�5=@L�|�s|�穔��#����ʞ�Z�(����� �,��zs&�@Cj�I§v��A'���{�P�����Z�Q@�G�߫.B�$i���p��=�>���6����k��13d��6�!��t�{�������a�r���< ��b_�o����K�C��u�y�8����las<8�"��ln�x�E�p�Z�8N�����4�F�?���5�@!�/힘�c�E��>���t��SX4|d�↞�'aSGE1y�%Ҽ�َt !�����ĵv�؏�:��i����������I�O����ط���.�=��� �C�Y������ɐ9hɜvUپST�4�/C����ECbD4w������l��-��vT5���e���r!_��[�:�O)��|�`��L��W��:L�*P��� �r�z�ta��ex� �b�լ�/c�a_&��H�\c�BwN��@^M^�އ�������G�J�t烲t�����sTBT�x�N����WM����>X�!���_L7�����j�D�*_dJt%�P����a� ���S��z�͐Ck@�~�ɳ�zp�!͓S��J6�{��&!)S�\`-M���C버��?��7��B�cF��'nE=J:�&.�k/���P��fD7D���i���ѿv)�U�������aE��@wv���;���,n�Z{�]%���(4%�ߌ�~�`:l��r5�����U�h���;`a4/3j��N�:xw�j���@d�١��v t�{�bf��0~�}�&��C6܂`EҞ+B�����j��w4���*o�?O����]�W�w�������)����#�|.�u���\`3z�T�P[+7�����k��w�W��k��K�#�p���R:&,J|%��8�_�Ii��ƻ�8�c�{�Ʀ�� %��H�'Z����"�����J��*�ʧ߈�`�5�@u��6�B���Eظɚ�0sO ��@��c�l$<:�TUp���� ��a]����4������`粘� ���1���s�T����i���(��_�CjS����|������l����SM�S�9Z1YG~�%�ܥ��9jQ--����&�U������ ���`��2_�!$?�("��_�[���@���;���ra�R3� �����j/ib���C����4�W�u]�y�v�j�)�k����x�����qB<�q�D�J�8����u��=TMl�<��$�9����AB�b�YBu��"��߿[ �$vɝ@���SV�0恝p ���w^LP�GG?C� �s�"�ォ�*-{@i�����s�� �=� �z���h��im4�r�F��kF� �[Q'yD�b�Jt3j���K�|A�ʪx��Ž_�=�f߿�nd�`�+��.e���ͷ��$�~n�JP���Wz���*D�?ݚ/�K�;s�ْUs�y�W����Q���p.�';��p�=G&tu;iT�<��}M^��n ���c~�e '���ۤ�6��3��et����~nZ)��f ��}b}�}���Tw.G��&V�ӹ���Ť��� �nI3f��~�kQ�W����Q�'��e#��*���N�"��>�s���VG7b��d��.��I�G�:9/Ç�9<����F,y'٧y&%H+�c���B�rp,2k��w,�6?R�V���������L]I���|����t�k��.�F��7�O$4S�[�=ڴ ��قn�H�"@dE8Q�2��� c��S�KFZ�35��6[.�h�(��j}~�RK�-�y� ���ZĽ���"(f#���4��4ѫ0�\i^�c��Y���?9"�|�nv�]hc�N@ ��h ����'�l;e����$��_��?�?�Y7�9��g^����i��}I�'��9��^kεJ����X� +���g^��SV�� �2�(��}�x�iV�k^\o��*�>���63&��Ѱ[��H�����<pp��|$߯���Ɛ��7T_6���J*Ya�'�0�� ��9Xƌ��6�����yL}����~Zʈy����:�Yʐ������*�xSAfڐ��n�(�HD��;�$��(���Gyo�����Q�P���\/�[v�`"�T��a��ضy�>I~�,.�IV�K��5u�Rn25����졚�-Pl4+2�N��Sd��βÃ3��[$� I����2�~��s1́�Z����1��Xp'���!��o�����x�WG�2@"X��xn�l�C����@�r9�"\0���R�u��
Behavioral task
behavioral1
Sample
dde9cbfef556d67dc5ad3d2f51732755_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dde9cbfef556d67dc5ad3d2f51732755_JaffaCakes118
-
Size
675KB
-
MD5
dde9cbfef556d67dc5ad3d2f51732755
-
SHA1
4a9196c7fa958c16dbbae19317fab68e412dfe6d
-
SHA256
97e271b0fd19b7e0985a124a3062e7aa5ec888ff2dce5e6cb0c9cc3484cb7b3e
-
SHA512
07570357ea52e8b81aeea96e5caa708079cf94bbd5c3eb0375e0cecce7d59697439b8d40d7e40af597829a86ea4987aa94ece4ee2aaeb94e328514b001dafc09
-
SSDEEP
12288:/p/k3G0QBQWVNaEjmo0L8r8fZcTIYep5XKm05WyRgItVMhvfiOpbZSTdP:/MGf7vhcYYPYepb05NDVMpNOP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dde9cbfef556d67dc5ad3d2f51732755_JaffaCakes118
Files
-
dde9cbfef556d67dc5ad3d2f51732755_JaffaCakes118.exe windows:4 windows x86 arch:x86
1aafc00648147d82825359fee7cb03c3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCreateKeyExA
ntdll
_stricmp
Exports
Exports
Sections
.text Size: - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 261KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 656KB - Virtual size: 652KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE