)�楊�W>]��Wܽ�a��x�)�t��� ��}z$NtYϡo&~��}38��F����&�����V�'��j�Z���"e�[q��ׄ��M�G�4�/ �\]3¤Z �����&���e�>}����P���Z?Q9���V����v��8�a���a�O�8�c�9�&���� �o��IH�u�\m�E���2�W����|�}�x� _�4G}��@;��sh���o��.�c����Y����nim�r]Z����Qw7���{��Þ�q��Y�nC������DSQ��;�'=�-C�d���ىi�`�ʷg� o� ���mҼ{9�7w�q��Յ�<��m�,W�����w���Ze���"& �q����V���W�ݏa���V����)��[e&�I�¶�q}\��c#$nfə�������1��(�hܬ1.o�� �d0��ea�����"���;��f��v���DbU��Y�f�]��յ���0fhz�^��q��3��#T)w0FM�>]��y��p�w"*����:��e��fZ(<6�&��l `a(�-}�(�X4~��Ķ��vIk���, �_p���h�,M�h�1?����M�7�u0���F��+�8���N~ٲ��f3��?�s�)j������8{b%�1����+˕�}��y��p賍DɃ�#��e��ճ�'X4�,h���'�9_�Su��CS�D���� ӟsaN*�T�f�����'��CV�z� z�ȋ|E ��ӑk5�Y.گ���� Vg`ܮ{�2�~z����`���Q(���$��bU�SNY�H��)���fs1���~U�����^v����B�d�W^�*J'���D{(]BX���)X���!��E�rF��B[Le9؞Y���X|w�\N�r���M~��9QO�tL�п)��}�w�E�9&ܾ?MΩI��k�>�l�qi&]#�=c��5}����Л�'5w���@�f�?#Tf�� ���jl�1���\l�ފ�f�晘 P�pt��*@efMf���������L�m����������{IL���C�d���\x�)٢�1�L���bq7�W�\V�?l�z��d�ޔ/2^����@��V�ocu� �Q���;�$��p^����%�>=�5����~��E|�p C 7uZ~�7>�Bޞ������*,y���F���xYă�:����?�`����{����-���u5����|��y��F��M_�^�{������(`I�DNA&hdq���yHT5 �S��B��4�1���#�7��}j�1�sx�<�3�<d�^��G�5��\E���*�h� t��ј.�GH5eð<)���p��U�;a��=$�n�ChWd�rNTi&a[��^5P��f�+mY浭={ð�#E]�g�*4�s�w-&�e��#(9�n�\;{�1��6��>c<��/��7^������F�,� y��Ju�E餇)5�Cg�C�\J,݃NBY�Fc�:�� ��!���8K"����T0�p�i�W�w?��w����:jC2��0ü6CK0���6�ɯ #ʬ �.��Je^e��4m�c&Ch c��4аM���H����Y�]�_�pJG� a7�/3]��ϡ>n��{�\>H��gJ�/n�%Y���^�^1�E�MW�oޞ�2�������V���M����VZOB��3���#�z7��:t~G��7��ZWw �a���YXL���4Q��W]7>���ɳ�O�˽���||eZ��Zd3�*��&�tx�+�5�f�~> ��-�o��r�E���P��6�^>,~5��礬ąO%h���p�d�*>5#����0����WcKC��>5��[z�>S��h/�- n���v�����c]���^R���ⳤ���1�Q�NJH~�Sif��T�8pβ�����ٔ9����; ����_ �bf4J�<�0�'��Y(��*���x'|�����X�#~���5T��5BE�YTvvI0ڙ6o隿|4��Q�\G�vuA��a�sn����S�7C(Գ<j!�]�������d�k��4 _�� � �q���ܤ����7h��F��2�0�ϙM�]������Ȥ��(�N�� U�a!������5 ��d�K��䖕*p�mX4�Ba�p��ȴ�ٔ�[w��r��%�O�B��:�D1-~�w-ݴ�� |�7����h���M�Ō b����'�s���gѬ��)ip��>�=��"�@$۲ �K40�LGR��VJ�9�t70�����QMF,%�,���"=y����+ ��<������:oɪ�l���P�A�WSu=!�:c����v�����ş.ۚʑ?�<�����<Ӕ� �����Rl��b�p��+d��p��B1�6}�0g����^�>.��������6�b�+�N�3�"��\�U)�{1;g��M� �0�g������k�F�� &�Úi�D�)E���4�yv�f���y�#�w��?�-G��&�,�(;-4E 3�A�������X)&^ `���uQc��@c��X�B�=�@�ȁ�����\��lg�RB�F[sgiսl�/᷄]�L��=�v"������`���Mv+N�wB{5�h�a�5%I!$G��r�$�S}��i8.I)R�0Nm��1��R���,/��M���A�����G�{s��q��Gh��ih�wpu��f�`���\Ut<�k*l��5��K���!�ˏ���2�� Y�N��ST@5�3��lj��5�C1"���~�x��?��̧p�t�Cΐ�t֣��<���*�bA%DrƑSk����J�g�d�2�A�V͉�0�]Y�p���f�MD�v�@���H �eп7�h)|ݵ������>������څMG?���� �&l��������& tr��T~�v T�i�hV������*Z@s �I8�DLoÐL�r�d�C=��G^ZX��7�ҳ���E8���]���[��@��M�b�:�_5?�����Y��t7��@���AS(���T�C���KڅZ��.����X���$���$lIE(��̋v�?B��<NlYw��u
Behavioral task
behavioral1
Sample
eb92905d1e55a1f976f57e769dfdcfff_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
eb92905d1e55a1f976f57e769dfdcfff_JaffaCakes118
-
Size
676KB
-
MD5
eb92905d1e55a1f976f57e769dfdcfff
-
SHA1
7c172f21d0edec68e9c9eda680d91d5699ac7868
-
SHA256
7443a4debc2f6d77988b88423ef8c69ddd14f79c3fb3b9303cc1fca49bbb65db
-
SHA512
1bb2c2da4a9a9a58fdd5ae104cb2dc01553409222f12cdaeb9d890ea722f4f3d0e51e48a5f0a4b4c22a50c5a86fc66459c9f2bfe9b3050659cd001a63311a788
-
SSDEEP
12288:5CgkLX32fqaFwmmInFT01RTLJjWhqCsaJ0dE7hKbjuSfMdyindD2IN:w5T0qYcLJ+LsaJ0dY2dMIidKIN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb92905d1e55a1f976f57e769dfdcfff_JaffaCakes118
Files
-
eb92905d1e55a1f976f57e769dfdcfff_JaffaCakes118.exe windows:4 windows x86 arch:x86
379c428feedb3f7a00ce87fbe3212579
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord587
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 595KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 435KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 660KB - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE