}�U� ���(g'�6 D�EbQ��!�v%/B�m`K�ܮ��<;���i��֭.� 1.=:�� � �A4lt2���l@OĄ6�|���W>i��b3O��,3��]؋�͡�;LM $}�v���8ɂH���ޡ ' �`��b�8���q��p���n��~6����~C�L�|�#mi�{�b��������P>���>R}�p�#��6t #���_<�CZDx�O��cx���ќ�����[>��e�LǙ��ܺ�rW6S�}ª~f;��������e��n�q�y���l!Z��Ӧ���P�L����G��|�\!�t�B��!UU1]�z�E*ԥ/�����1b�C�!H�Τ�1��;��J&A$�Z��'L�<1��a�+�q��/l���]�X2э�7$��^�$e��$�1�6I(�|T���mB,b�"k�#B]���~dU�?��#�Y� �ԂX.�NYoPĢ��+rtoujAz�B�@��]��wٚ˜� ��� �+˕L�i�wo��"���u�y���OGv�lp���j�@N6���DE�2�rS��Z��D�����C*A��R�6S��R�i�@� s���y���Х��K�+;$���c��!���%+{�X�Pe^uG���� ^X�ݵ��E���"�NtLjH6������M�_'ȳc��,s,j�� �0�=k�k݉�=��}���0�nG�tzX��)x�ҩ��"|�4���K+�z�7Y�䞾��S��,���ϊ/�h�O��YZ�ퟑ��q�p@녧Ҥt%�6>KMu���s�'L���t�χᕻ����#M�;^oCn�5+Fw������+VN"8ڄķ�~�ytC*GIC���2�����[�_I�`�s��N�F`:���3��c����Ɔ�zR�������W��6Jƪ��G�Bļ-6rv��x:�OA�)�.�a$��u��RMg�2���٥���ځO~�>l ��hTs�#����Q�p`c�$G$��(3X!3�j��y�yX�� �z9z����ur��/��m��������=%;�a2�����#��Dž)���"� �ً�OG�T�g���J⌉W\ E��3�Bf[�Y1���d��:y�{Aq�8��W)L>MHո�G)�:����#pQ;t�B�� 8ٺ�˫2Hԫ�������Ioi��~vr�$c��Gc%�U�ˊ�;�K�<�� �́�����-Rr��y��PW6JZZ��'+�m7�$b)8I��x�A���� K����D 'F��yX�+�E,/����@�(�@��S��{��?Y=�O��K��j�m451o�x���۴�!zϗ�? 9~�e:�O���⚓�c��oV�!�P��F��;Pƾ!M!��-��1��^����XMu�8����h��I�6 ��j ����"�Nm�dq�M+k�kTK��8-q+3�yHw�r��uu��F�����[�>�!sޚ8d���8�8�d�Uc�"�c���DŽ�|�����E��J��)�/#�#��q ����u=��l�����bQ/E1��p8�rK-���Q)l��/<�@�����v% ^/��D��˸�R��A������ ��l�U%������T|��іd����j�慂t,�7��X+F$E��E���$�9"�۟����� �bt)�Ǣz_ޭqJ�y�����N�K �N-ω���=�6���8[s�-j�2/��+* 1���:���K� 92�qY$�jr��֛b�F�X�8"߂�8e�����ת��0��S'�{�� ����/;~}��cm�C��K�lE�%�w��:����Q_Cγp�� V�͖k-�i4U�%�_�Wƥ�i��BS 3����\R��Nk�F`�6Y�����U�<��Wu�|x�O�;��b�e�ؖR7�m����O��`��͝��Pڶֹg"3|]??���c� }"t�M!� ���,ؤw����/���A=X��iX:XT(K�Q֍o�.ϱ�܂:0�����:K��!�8L�;K�qv��3ec�4�x�0�`*|4t�m�6��%8���6)������>X����S����G-��7��1�E>�CAO��C$��� i8l�R�mxm5o�s��EB�U<����j�\儠%xp�>"�|:�T��_b��6m�"��^���jP��u�~��kO���:3���|f�NJ�������f��bF;���7���8����aZZI�1d@ =*IG&-�.�q�ĞT~�M��GmA���.MU���5��J"_`�U����}%V��I!�� �:h�2�_߉8�~X��<K� �jV�H�x��}"6e�3����Ɍ��\�Zt�����Q]IӒ�nB^C�Z�;K� ���]���S)6�W� ���-��J�t�]���-��u���NG2�Q|j�q)���2���+-eI3���&� [,�"�{�]����� �T}�y����ܻ���K��O�1�.�����x$VaS�mrN��\h��/�"�.�J�V)��L�[4P�V�B��Уd�� ��� ���xv�]t8�J��ހ���|�����&��k�,�Q'�L�~O_ Z���RG#Z���_x8�5m!o�������.�PSBEպ"N��!��ꭍTO���6�FO$��j�7�z�٭��k�4t�����2LG�Q P�!6wX[��F���E�34|/��ן���n�ę9-<�tY �}��[�ϴ�a����Y�(����j����M g��j[�UL_����6:j/��pc�L�(�>�������.5� H��$�6�Ҷ��Sҩ��3ق�H��]5+*�a/�� ��̨���$���ú >��r~� I�#GS�n�ʋ�U�7R?fXގ�:ƕ�Ѯʔ'�Ɉ��Ԓ��7^&�A�y��L r�s�xP`Q0%����-���[y�v!�'���yɵ�P��y��fu��� ����GLp4�k2B�gW�?�^�U�,����Y��j��oߋzB+�O����������I}z#����$F��ªN��t��u�Fޖ'��6�����?`r%��#�����P�E�w��
Behavioral task
behavioral1
Sample
e9cb51b0b4c9ac161f6824fa58d2de5e_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e9cb51b0b4c9ac161f6824fa58d2de5e_JaffaCakes118
-
Size
736KB
-
MD5
e9cb51b0b4c9ac161f6824fa58d2de5e
-
SHA1
9822a5c06576688d89375f7b381125bb0b2c2a6a
-
SHA256
644178f7f34df9aa9f0b65838b7a81c2c012c238e71f7bb47005a03220e813e5
-
SHA512
4411a8fb6bd98efe93cbdaa33c09f4b87a900aa34279de13bea66ab4028dbd7f1fc4e2a86511c3dd7a927cec928707d6346c627142eac6e21f01024406dc23da
-
SSDEEP
12288:ruwj+/0vM8RDCgmAo1Crr4FkXVxeR+ZLXRTRA2agq1mmDTHO2C406H:ruwj+s3JyxEr44xbA27q1vDS806H
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9cb51b0b4c9ac161f6824fa58d2de5e_JaffaCakes118
Files
-
e9cb51b0b4c9ac161f6824fa58d2de5e_JaffaCakes118.exe windows:4 windows x86 arch:x86
17fc8148a83e681e1ed618805c628c76
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord598
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 724KB - Virtual size: 720KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE