�Po/���w2Wd�%�⁓NX��g�__Nd�h�/0Þ�鼰��I�U�7QB�CcE�D�����YQ$C�ˬ���me�07��$�]�n���b[�ڲz ζ���.1ԅzY:�w�]q�R�� }�&Pڿ���BE/��,�X��8-��R�(G59;Z��t{qc�X^�^u!�:U̓���[m�ᙊ�M#��g�]���+ R&��Ԫz�~����ۜ�1/�M�%U>�����ߌ��+y��x�����D�Zw]�ɴ�� F�ZOH!E ķ����kQ�g_,�����k���M�|0| �/I5��m@P��/��f9��d�+�r�H�� ����%�6�/���~�vO �p{35������M�\$�b]�jN�1��� �u'{9Ȏ���-[}�����8�Ȥ��gZ��cF����k��8�e}NO�^��W�hO�m�&��J ��݄m̦��e�G�ӌ'���tD�o�b��.�@2�Bt����5�f41�G��" ��E7����XLle�@#��웊<�0�CwV��_� b�$�H�s��ۤ�?)=��o�q����7�1D��3el��M��z�]Q̶-m�뵦l�XY�L�ۏ���(=�c?���⥟����Kh��gb(+L0�Q��"�f��8Q@���l;�53�n�'���+?;�_4:�\:�#,��ĆA��y��,���*��~�-�JE��!��\ZQ�7K� ���!FpNg�Э���O���к�<�@���k�{���ը=lR�4+�A����*��42ߗ����#�N� '��j�x��a�L#�H�&�Ts�_Ob�cNJЮ;�١���-Y*<��Y�}�̦e@����_)Ŷ���\��G�9�2%�:�ʯ���X�5�y�SK�g�-%�����nQ�r0��A���V�3mժ�7�,lan��"7譖����S��>X��}�J�5s�|[O̤��ߒ��5��2��AL=��%�{+ãj`��˚T���/B���7��Eb "4d�^ˌ�r�/=b�M&���)�R������ �����W{��F-��Z���!�H��!��h�p����\ruٔ�C f@.�Ɓ�PJ�S˼O����u=뉜\�x��Y<�&�M�O�Q�s� Ko� S�k�"����!�� ���;��3�������=�S��$/3ǩ��S=Hiƽ�#{ܐx���n�!�2���ly6]��k����YF08ٓ_��r��w�qJRjB �hK�u��G#�)��=ZT��}=Iv������m��txm�am"`�d�q-���*V�2m~��WC#T|t ��r��q���z%j�Ś!m:E���~�@�"�r7�?Uw�ۗ(���O땵�=�,�J;��HU�Ϣ{y��� *�hb�L�l��*,�5�5��K�a������c��k=9F��m`l4pN�7e��������^tR��E�"C� 9eb���р�VZ!�{ʒ#0QE�OU6��$g�d֤����D#1 ��G���N���_��c3$��ic�Gp�+r2�0�(Z��Q� �a��m���B(r2�������w�3����v �цdH=>�������c�R�yA�Ď�Gb6&c���g�<�w�J����:���U���}۵bow���� ����Y���D�n��WC�/<g�s�׆���8h�71X�a���.eƔ��Vt}λ�����`AiDD�<�V g�oИ�B6"��Zz���~�*S�����^�s�U��[��1��� /����I�T��(=)�� ���zF����I�V�-)�������N��v��{w߂���j��/�����;�`�m��7z��"iEJC�Sۂ�z�n��|&Rt:a�{G�J�P��=t��B�`scݔA5JP_�^܋'�8�z@}�v��1�!�I\k�20�UW\�B���ܣ��/lQ{i�Mgͯ�'����o>�gq^(�m��b�M0��F����y:y]�k�ɶ���1��`�cA�SN��2�}hTėێ��I��{�V?}�X���}��{eH�xIc��2M�� �0�y�qs9t���v�� W���(B8"$3�1w���5r����%�9&!�� ���&pJE,���������\hECS��\E��]�j���cμ��>&�܍�gU� �ܰ� J���N�����6s�8��B��V���:�-�v��Z�y�{�+�Iy���pީ��f;qT~I�Gf�-x����vq����z��kA���`�����$fCaTG���p�����L�u�(����L�Q_p�%T��K�l��D5�Z��dť�@RU�4���W/�&�v��q��h�K��ւ3�5��E�k��w} k�d?�� �?u��;�=��)L�a���n �Ŷf@��% ��7�. �X ���� �U=vJ�h��ye��(Lb�b�c�s3\ �!p�˯��_Vm�er~Ç+ϥ��3���ʕ���0���+ar�%��oX$�d'f������)��/x��O�:�J��C�##V:*��O��7 L$�)`&��Nh�J��|�[����)0�������1�L�nU��לk=���!�S��e�:weڗ�|i\����v�L�>ڍX4$b?LV KT�W��^2��N�}8�2�$��ݩ0�G�j���5z�9Eo�ش*��Wv(P9��b��p6�|��l3�02YUCcRϾ͜��oD`��JG���}ٸh�� z��o�ߵ�2�M�q�P��<�f����#u��� �R�Ф��E�����h�M5N�����ڷˎܽT��ӷRK�x.���R����6��y�3�� �7���&ɀ@^<fi!(��0:W�����ڍfwQ*ʐ�H�����^���{�m|b�O�E��TjS��|�T3l���Y� ��$�b1f�����OB���,xeR�(�?�\�Y;1�s�;q���.`b��@�y��à@&j�3ЦF��*����S3'�l�Эʆ�Ւ��a��,rѹj�eWK��1`������E)�CJs)�FZ���谞�:��鉁�Z\�>
Behavioral task
behavioral1
Sample
de2911dffe0e132d5e75a55a2c35022b_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
de2911dffe0e132d5e75a55a2c35022b_JaffaCakes118
-
Size
716KB
-
MD5
de2911dffe0e132d5e75a55a2c35022b
-
SHA1
2752a111dbca1da58c67e8d2b0cc81e4a344f418
-
SHA256
d500d55097a86719d3d6ee6587e9edfe7a3bd5e663c203ff97bc848288e5608f
-
SHA512
d0fc6c74ddf8e03e52b31899d0f843270b82406a6756c331f0e36571610843f02ba892bdf70d88dd0c05d6663bc5c9729d9bd89a9bfe0bb746524c647a5354c3
-
SSDEEP
12288:GwYFEBrgFmkR3CkWkgdoHCaXiENhY+S2vuk+mzGBUJNq8m26kzGzRDbv87m7kcwh:dSExsm8SkWzOC10mUNJNq83kyzcwuUK4
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de2911dffe0e132d5e75a55a2c35022b_JaffaCakes118
Files
-
de2911dffe0e132d5e75a55a2c35022b_JaffaCakes118.exe windows:4 windows x86 arch:x86
44c7369dd8787a7e57d1624484ab73ab
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_AddRef
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 645KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 704KB - Virtual size: 701KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE