�|�1,���ɇag�S���K+����ח>^l��#�eB��9�����!?��m���=���Y������� ��#9A�Ά^}d��5m�x�1$��c�ZU莤�.��Y�[p}v��E�2��/�c̊q��������E�a̲"����^r�-��(�u���@�}��r�\|��ls�L��:}Mt�zX�0�+������F '?:���@���j}V!��o1�6�;@�ܖ��Qz���U��#�+j� Xȏ�����{��̬��5D�\I���7B����O Ҹ�E�n0KB��㟊=�(����Y+������wQ ��� - ��D���'��ǓI0���>w0�)�`)��-c�t�@�����^��љ��ۖ�8��{sJ�����l}l����r�Ͳy�[) ���/xn����Eo�*e�N�)���� Dr&�5>��}3e�C9u�K�G�l ��u +%�2F����/�e����,�@W*W��{o��-�(�H�X�j���s���y ��m�OH�Ƃ���[l)��bu���Yq��f1��&|~�)�O�c��7Lc��P��ngq�5#�!�<��z����gn'r��d��G2(Q|۽�9���+���88���X:�|����?C�:7v���Co�@�7{n��Tf��]e�������&�,)/aڿ�&*��a*��(�ƈ�NW�f��Sh<Jr�bc�2~���.X�v^��}�a��w=���q��b������D_���S}�!ϺQP��ς��Nrm���1���Km�^ ߿����re�a��Ծ`���堓/fa�j3T6ǵ�4:��~�6��60�o6l1���*�5���T��;���zw�|��������)����_��z�����4���,p��B9� MVT�C����rv�gKoc.��~$/�'\U(}�1��M�҂�B(��0��FR|�=���`m�� +�C�����n�u�;�^�W�P�U�dI+��P�W��<�^���r�-gx���*dP�X�\��Ok-u������8�����+2#{i$ �VS*���3���@�+L uj[0�'�����z;m@:#��?���-�Q�lP<�^k�K�������T2H9Q���pZ;~����4�j�?����t^���Y�z�V��2�~�}�?���$�Gnr��lK��^�Iri���X�W�T��T�6T��15hJF3�H�*�����S�֟G�0J�M<RF��\�����4\(f�����ְ�� 3"��w��]kΓ\��q\H��(/Y�VVv9p�ޚ2_�1xܝ����M���r��#��w+�1]@0��@��~n���jL����V~O3A���.a��?���zz?;�KG%#.��DU�ԻX0���Fz�.�m�x����w!�����9a�ޟ�t`�%��u�F���k����z������ӭ�M��7;�4�Me���Kx�B(|$Kr[}��r�����`�P�C�q����m��CI�O�����WF:M��l��1U�_���;�����f{�&��`�n� ��>�!Dz+�@���d.���hl��wk[�|�I>��}(&� -"wyB>�Ygu���2@���1Tބ�T�l�grd4�C���� ����X��C��b�����|�ۺ�Cp�Y4w�N��b� k��c�^�*Mk�ǔ��X����:VO�,}=�g��N�����V]|���M����eM�u^3N2&�`Q8�^�����F����0�]I��M/}X%/*�n��ߟ�!ז(�(��nc=F4��|ǔlB�(�v�8�Q���8B4t��2|bw����p��A�j��"tk���(TI=�����RE���Yp��H��>����.���p��8�*�������+�Pb(��gU�nj���؋����3I ��7dY���8��� o���>�����"��?5�1���S�t/t��r�9�QD�Qwr�ti�1�Z �ш�{���4���^^�n�Hbs��{��zb�e6T����wf�H�jvp�T�Wn&rK�KUt�=��GKO׳�㟀�Н���6v�Du�Vh ���TJ����WZ\��Bjpb�7��|��=����,C�n�뮀��B��}F\��9�ԌĎ(xK4���ԓiŬF��g�s�h�a�j��ޱgdb�� �_y��勫��J�(��-P�1�\�A>?�)!� Vqi�݃��Z����c���i�.�w�ƅ�Z22��LP�1>�:�6Q��4p�^�?K�ץ{�&��=�#�%�"싩��D��f\1������c(�k!$wߣ���(S�ġ`�� g�7�lQ?��Q����9�/"���?42��K1U�F=��r��!�*b(�jYG��Y�t!Wr�24��c]oU!� D-E��z#k�Od�_�y�Sj|�Y�a�G�q�*���H��ŖƎ*��'B �k�s1Z�o�Y�܌�:�ҷ��&@�1M�(���&����a�PYجs�� �/���@��Jx�hT%��>:��P��D5Z_$��6!Ed�����k @��Az������<�.@�p��Y>� �J@���UY�8���e4_DBv���H��l|���/7��,���"�yѓ�D}�ǔ#�T.6���V��r�[8�$�-'Z�קg�����+S�WKO[�V��#I{,��T����z�Ϣ��}Xi������,2� `��%n$�ɰdѩx�wVfL�[��<��������]���\�j'��K�,1�E��q��4m�C'��K��aɐ�.7�!i�۴B�"LP���f�f���}���u�åm2Q����2"D���oV`�����1���_/��P�[*�tal-Z-S����1��ZFA��;�8���s?G��.�y���dc����x@#��/����}E�+��5}փ���S6o����};�Q!eF^�H���%�i��{4s�8��y��H�0�\g�����<�ruI��eFܤV����i�u�����i���֣�h�=j� s�c��Q.��b�;k@�آ�Ap +WO�ꎻ͛�x��N��D
Behavioral task
behavioral1
Sample
e10b3ae87e4ad04c63bcbe828f45ada0_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
e10b3ae87e4ad04c63bcbe828f45ada0_JaffaCakes118
-
Size
132KB
-
MD5
e10b3ae87e4ad04c63bcbe828f45ada0
-
SHA1
efc3f8d810f4adf8df227d3a15ac9e305ec334e4
-
SHA256
0667c4f11965024ffff0356238da7e49a886eccceeff1e24fa3202206ada6708
-
SHA512
1aa650679699d65accf24069bb1c94682295fa8d05204ec94e951eb4219ee007b1efcc3ff10f9e8468aff6bf2a7026f79dd92de2b0b9f2f518a584700b30d30e
-
SSDEEP
1536:MdjMypj4baSkrUMTB++kHDBr8N9u0FeN7fbsaIDiJzKE5G6aDA2MapHeq8/M1jbd:Mdjxrr/c3OeZLwaIUzKEU6aDLM2e8d1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e10b3ae87e4ad04c63bcbe828f45ada0_JaffaCakes118
Files
-
e10b3ae87e4ad04c63bcbe828f45ada0_JaffaCakes118.exe windows:4 windows x86 arch:x86
cc2ce27f781b3772d57a542d8ed3d7fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
comdlg32
GetFileTitleA
advapi32
StartServiceCtrlDispatcherA
mfc42
ord815
msvcrt
atoi
urlmon
URLDownloadToFileA
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ