�����^���g��L�p�u��rUœ'r\~ԝ�"���r���{Y8��ƣj`(��H��F!u�^]P��"s�Q�����p����� M���O{���������y��������D4]�#�>^���H�����*��P+���Ϯ��%.v1���P�'P�-�6jN�fl�2(�5��&[n*� E��EU!I��:m�ۋ� �<3�>��3t���z�wT4�韶ظ��fzS��L$ջb ����iNL�|l�ո��z�0����� ����HS� k�gE1t���X��M���f�zg��}A;�sg�re��[5#+l��Z�d�2�u�ͨ~:�6�`������K����D�l+�������p)�n4�Z��zj. �d�)�9N�����v���4L�J1�p����q?�hj��tQe}s]o�+xc���)��j�M�Ӹ��N{�L-�E��E@y��Q�5|��A�"���oI(T��z�_`i���m3jK9�7t���w�J'�AE/�,ѱ9e��"o�\�a���o[� �R�C@���.7��'�I�M��G��dh'K�Dd�c��Wt�V� N<��cj�D�4�b��W�p���7u��!_����"�.��'d���0�6w%���\��J���B"����`χ�g���0[oX�`J�3C��t�@�Zi���]#��|�*P�[�҆�A�Ê�ܮ�p�]g ����=)5j��H[�-�h���3i]���:'x�7��r��2!/��``�����T�����/��G: F�{��7&ێ�F�Ϣ��`3���&�*�o�֑6�݁:翎Z���tR���1�� �tֹgH~�Mj��w�a���l�=Y��r�n�e'Æ�=aSa�*�G�ZFP����Nw���zi�I���%[��dM ���ؕ�����x���5�p� ��l��It$��?���P=���8 �Vi�q̏|���m��?��ͱ/f�g2$^���?Zh��Al�b�����w��� U��LK\����Hȅ����1j7A�j��&8���z����f�b�fK`�)��y{:�.�. �m"��EXV��1�ƽZ�?ZV^K63���GЃzW�)�RߣtrVck���A�ӿq ��P ���2��� ^�-�cPŀ��v��j�/���/�yc�.�Ձms[!��� 9o�Q��kޡQa��J�����YB��.#����8&�t����r[�B�"B�w%��&���Ԏ� �%L�Ta�s�Q����|�d]�^M�o\���9EҎ'�����l_5-�gׯ��*`��$�g ����Q:�����P@z!}+\���l�{�1�Q�o�%y6۪]��C9\Νa9CW:�h*���kZt�o�+Rу�����*���|�7X��}2�bf��>"Jb���{�b����8WD! �3H89S ��Sc�l�iu-'$8�� :;-.�M�}88J~O�J�AM/����ɴ ����o{����)r����1� [\"�26����uZ�����E�8��x�aս�K@�I��nZk9��UQ䰡c�~��+-�W�PG��`@m��E~�m�~�*|E������yL���ҡ Z�F��l���&-�C�R������H��[�L �J^�h���lh�F��[���}�S�k�?h���_b��Y\�:{�-�-^����l�#0��i��d4P;}�3|8�} �Xh�j�wi]�J�r�$�O�5T�5�K�z}؛k'�s✮���`�(Ue�}u�����h�Q�gQ9h�Q��0��̴a�jM�[ d��[��s`�mvs����Y��5U���<���NXA�.��,�n��TqZ���Ο��)�)4ʗ#���ˢ�����T�mI�B}7�D�Q[/3�Ux���N�%�6���;*F�дB����T&L��?�������3s\���0�w����A�#�O���4��`y�벱�gq��d2͍�I"�j��Wc݂jF���|�B���d�-��ǥ�L� ����7�\��XC-��ڪDx7*��F�L����H�e��J�9��d=H���Y�Y�U�&��v����T���Z̛���^v��@/!Y������m�[p������R|�{�#�(4$*�Uw ������4$W� �mr�b�k��u�l�H:��$Č���OJ�W�bf�����{樖�'����� C��G�h���$�˘܃��ms��%fC�J�O{�0�oT{`_ю{O�����0�+���0��)�Α��֞��)Ή�KV�o���|����ulb��C!�����|��`��{x���{w�M�����"�N��[��h���ÙcvLL��Pz��]����:����!��i��OdV��N��c;�'q|��������n��-��N�#�<��Z�� � ��G/�Ik�dc��Ĺ��2���Ϫ���x �T6�ڷ^�)�bm5(�UW���{�6���Nkt��Ԃ�3�8y���_�X`��j�+&����}������I;��pX�Y29['%Dk��0��5.\����Fj!w� �: �M]xo��|�Ț�t%|p�vt�/m�|�m�sr~?r,��{L�60v�e�ʯl��0�(}5~���ߒע����/�]u�߱���n�;�npm��k�ּ� ��F\�O�o3�,^9����!(��+����.;=C�1�X� I$���n�+��Z����Ħn����w(���.�nOu����N���Tw�<�Ei�����q�e@���a�H�5��>z�L��ej��t"�E����%bHeM�zN"x�%}�`�����GĻ��}>of�?���6���C������ >^�ů&��O����'��S�`^���0�gK��`�d+-�,\��J-Jմ[7Ix~Nͤw��@}��}����µ0���4s� � �G�-�U�@���F^j���p��"@�bUeL����:K y��e++��];Qē�����'���"x`�K$,nP'�9���,�+ �������ڗ&{����A��r�I�0����#/�;�#��n�-X�x�q�d;Hs�E>�
Behavioral task
behavioral1
Sample
ec087964db028af1e6cd354a1e81d78a_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ec087964db028af1e6cd354a1e81d78a_JaffaCakes118
-
Size
1.4MB
-
MD5
ec087964db028af1e6cd354a1e81d78a
-
SHA1
1768698e01e58c666f7dad07e57d1cbe29bd8d03
-
SHA256
1575728f6bd9d038a76db6f991993690cf87b9e89f0d21390a18b477d89f9d92
-
SHA512
0f2921a47dd4ca4ffb7c6a5843fac5d352a594a5dd0d86fbf9fb8ec2809be98f5cbcc40088ed3f41ce40b7c65bdfb6b1af7329000b6a133ce5be004ca35c7bb3
-
SSDEEP
24576:/9xxxxxGMRK8s7j7oCtk6jB14+DVYUjJZCvvA7I8dNA9XEg/i/tuSo6bYBq4iZG/:Sl8Ij9WUj/vPfA9l/RaMiZGyyk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec087964db028af1e6cd354a1e81d78a_JaffaCakes118
Files
-
ec087964db028af1e6cd354a1e81d78a_JaffaCakes118.exe windows:4 windows x86 arch:x86
a477c8adcab1ae0400a22769aa474c03
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarCat
ThunRTMain
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 600KB - Virtual size: 600KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 24B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 584KB - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE