I�J ����SĎ"��v�iO�+#�����X=��n!Ibs%=�,w�����^�v��a��h2�ej8"�R� !P> ��_@F�ih�=����*��Xuq�@�e/�Zz/��d̤�X�؊lb���]TL��u����AN{d5�s���=겕���3�Ɋv/F c{�-z9#���ᦥ!l`��AmO�����=t���1��X݀��p"��#���y��kg'!�Ky�u��<-7��1�����f>>N�p��xL�E���l�&�-�"3��=�f:)t>Uhm��b��ܕ����� a�x�#!�����8a-�v��v a�cD�Q��&r���N�v[�F��CX��s��7�/ML�jpH�6S; �E&��g���?NllA��~��Ƈ���U���w�<}���l�g�r��N�Y����Lu���$�bɣNJ�����Kr�������C��R�(�g�SCI�K�g$��)�:}u���K$��8Bʈ�ͫ��z~s��O4�/�e�_@���vY��-�Q��n�u���lT%�i����3~��*���� 9������5j�w�c�y���'� ����m&us�$�u����-��x�eV�Bdx}, � �]z<��LϾ�~I�4;6kM�jU��նY��;�s\��7A�W%���:hKM�gv{�V{�.~E�t��z��o氰oU, (��4�����;>kH�'��s�[e=�B���Jv�p�+Ӂ���I^�����D��jnP�y������4&���o���蹵�a��&]C�j_ �������*u�bTؽ��Ő�� 3�H����(�p\��pi;��&e�����Y��u �X�������i͐�C7����P�����:G��9^>1��/�,Å�h���B�����3�:?JH�\h�����J.�[I�.�1�n�_�P�k@<����= �+�eۂ��/`�9�����o}F��E.}� �mmC\��Q���������� �;+9��IZI9�_��ژQ�sӶ���1�O;��|����+� D���bŪ�*W�8��yO�z�"�.)����9!�_�@�B���y#~s�[BO�lhFs�~cV���h�Q���6�m��x��.�J�L&i�ÀMq�Nj�՜��ES���W� �!�N~�3'Gx���OAVʭJ0J�%Y�\*�������RT�כ�>�]pVrr��� �+�Ҡ+�i���C����Ӓ4a r�f��U�T2 ��,B��D<�$��@B������1ŀ�7`!�����31'c|s�M6n���Bg�CGp#��.�g���6`���%6��g9���)bd{�u��ũ]���m<��nSb*ڡ���#e���Oh�&��I@�]�f�fl9L}O�<����d�B���xwS,�XE�x��cJ>>>� ��Ǡ���Y��yaउ���^�m������"��Hkw�s��B��u(��� #��4~���mʫ[H&��u6��h/}�~�WB����S[��y��F�< �L��+B}���) �yL�P�R��?�6�Ze/ё|�ݸ�Y�(��dj�|�s ����0�*�[��g���ōy��>)n}.-��v@�_79���#����B���Y�|`�;[��Po��c';�ݵ���a�NF� �G"�.M���Ͱ�Eh���a��ҴǑ�s��*�v����z6�#�R>�ɁwQxl������,j�Tw'M8\���(�$c��t�S���[dV���;�*As �J���8_���yAź ���EO���CUA�S�&(�H��� ��e�w��+�D��;�%涡���y~�WF�G�� :**Z��B�Mod�P�� U�˒�z��(�P�du���D5��76.����OnT��?v<DU�s�:}zgc�=�r*6��ӂ��Mk�J��P��<5?��M���,i����mD�)�v2D��U�\?ö�M�f�[Ǭ�n��ݤ��5���?�^b��}Gr�7\��� �HK蕄 ���R�m44R���3�ӰD���F�>��lA�*~gC �* �z����h��Vb�v9��"=.�ٳ��'H�`Zו=� r��f4X�4��LU�Kykx�i��f��=A�r ��/$�y���:�f���i�r��Қ�C��)i �������A��d�1H.܊ ^I��ȉ���ވD,#1~�,��"Oޠ^~����+(�\���z��`C&��ZG��D ��#��Pˌ�R�z^S��<����6Q�(7�rI?d�O��������d:��l؞�b��x`t�� j��o�tB�SP�7#��[67_���ۄ���4��;����)<��g�������eh<�&ot��X黖��6?{a�X!0Ŋ��(T��@��m��و.+]�� ;Vs���{�y��.5�W�������E�P�Ҙ������,����ast�����YD� �AoO3�����G��@WB�,�����.���vZkV[Oo`�c��]U��jyk�� g̢���MI���_a���c��-h��K��G�Ϝڒ)��ݴ�3y�����q�b����^��T1��=f�aE{�k ĬH��=JD_w��{�7�C;Ä��y���KWW���[C?�EbS(����l�}|��*+b����9%�")w5H�O�����"P���w��x4�`�E�ז�u��~#<��t'���%$*k3i��::e�t�H�����P�{s���b|�Y�-�iDi��!x����23s�[��EW�,yޝ�Vѩ�"���L6�����lTY�hg��Əvڃ��XS]�`�n���$E��V�cWb�r��\y����jE�L{��r��g�i��OPվ�����A�DUX2�(N��6ƚ�n��{刑t��Nkq�L�=umQ͒r�� Mݵ�o.l�;�����[mb�y��HSj��[Y̭�{���F�������?�[-��\�>�=9��ܵ��@[M"#zb!�ҠB>i�K�^��_n.�����T��2��ٽ���14���)���!�����R��#t��-QK�+k2��� �iH����;c(>����C(���I0� r
Behavioral task
behavioral1
Sample
ea5f082f8bf882ce81fb9da10fb26b40_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
ea5f082f8bf882ce81fb9da10fb26b40_JaffaCakes118
-
Size
116KB
-
MD5
ea5f082f8bf882ce81fb9da10fb26b40
-
SHA1
9a1a0abd749e19a7be6cef5f5fdca0c97e13f9c1
-
SHA256
c8396d6e93ba6819bfdb6342b3911fe70559c8a0702ce49468acbb456fe5aa26
-
SHA512
43322d49fbe2e3ad98fca24753a7ac4aaf5fcbe4da99c5169c408dda60a786d46d2065e1cfd00e8b9ec1082adb829c5e7682e1ed9415f4dc4352fcb3de84c932
-
SSDEEP
3072:LqvpRzqTHvqEwpmj1/DM8ThwBpngkoYNGo:LyRzwq9sB/Y81Ypgko+f
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea5f082f8bf882ce81fb9da10fb26b40_JaffaCakes118
Files
-
ea5f082f8bf882ce81fb9da10fb26b40_JaffaCakes118.exe windows:4 windows x86 arch:x86
c84da386a07dd11a2cab562a5844f88e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateSemaphoreA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
??1type_info@@UAE@XZ
comctl32
InitCommonControlsEx
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 96KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ