���N������95up��g�ߤߠ�|���%�x���lXq���L�������/�;Yّ2����=��|Woډ�X��M�|ۭ����\N"% �U���͏���\ [ X��h�aN��>I�MRB6�6%��!��=_�.X�(Z 0��=e)�IP�9�G調~���͒��%,�n���ɵqi-g����!�ʰf��t�$f�����O�`�"fX'�X��Ʌ��3�Z>W�b��\_���4����`vdh3f����K��y���t�h����WA��2T6kR-��q��b�b�%e`�Q����@��#��J��B�a0f�J贰�%V�m��_��9k���6��}�.Q-t�F�Rk��������dM���#����uN�7)��I�2@���a�?����<ng��V7�{����r��ȑ�Ѽ~��ڡ/�Y_��Vs�%��l��O#���1l�,Z���<�2�K�&r��P9�]@��p����h�������H�JP�gl�D����i���Y�I�LS���ݧ�}��)��ҁ�ʱ���re��A��A�!l�K�X)�lЊg��u^*0֙M���Ǹڹ���b1�ͩF�2�j�,��bm�I(վry!L�;��:�8�P��s����З�������F�t�:��l� ���V�f>���<�?��q����=���ʠ� r=���p��>�.މ����*bQ,�R�v@RO�;N��c~�q����̩v����m�"��~�47�;����:�ȁl������������;t�(Lo�^,�^��|��� l�Ӓ~��p�;GN�©4�A�~��OlQ���ťц��A�:Vw'QB#8�|GV����6�kXY�m���tF�� ���_OĹe�Y8��k щ۩�������������:�������0��X��{xқsN�>3���Lq��m���j�N%� dRڡ%� ��u 4D)�s튺���"��*�x���$��� �-�n,o�;;��.U6(�2��s�^��n@f�畏�=�������:��'�:�\�������3�U�r�=�}��M��]�����O��A,=�ʵA�J��g�T��b����͓e�E�*�$�H�E~R�� L���T�� 9��F���;�P�"@x�ۢN�QO���� ��̙,�U]9����[f)�Z�)�����y}�)�)g~�NQۼ�=1w�U��ܒ��/�����ꈖ-�C�z����=[,C�$�p���*�ěP�������,:��|������d*)��[���O`�kb�q���]롡��"��Y(����W�L@#��:�����\��D�-Y��� �~L�.�6�fwv(�.��Wkxj���*��e�H���0��no!��gVA��g>`�W�s�Ϛ�Jf�t����hc/-O*����2�5Z�vBy��su��;�mO��t��ۨċ�ܪ��}Z5�T!5�?P�!�y���P��Ţ��y��i��?���x(�dj��M��K�g���]�i5���+�@�>H[����`��Rsb�G��H.�L���o}�FqD4�Ӱ~��Z�ޚ�!�L$Zᱶ���R �����OLD{ U�m�L<���1fH��C�k�D 0�Z�'������v�:�k�i�?Q6���k�ȶ]�s�}���Ifc�_9�9�g��I���`���� v��;BT�1#��bl��En�nQ�ۛ�*��g��-�>��'���1$Ԫ���;���4��$�p� Ô �Ƨ�'.`2��c����ح�Ȩ�=�V���0��d}��K�b�����u���FՒz|�$r(LOYReP8�O�?9n���:M����'����[+,����c2����h��?m�sZ����Bl������f���U'(O���l����Ty.����C�]�>3�{dؗ2w��� dcƢh.�6��"$��3B��%�Z<��(0�ߗ��Ƶ�%=�L�4/�j�W釷��"��U�J������hB�=��E�I���B��͌��+���Hb��L�K<.��� 隮�hh$U6��f'�9t Z�$m�Ǯ�ܻ��*D�f�/~C\�!^#< <��nU�!g4$ޔX��tYe.GI�e��4�ZgA����%L]7Z�,��캸y��&���ʓ��q7p'�E��"5���U_G���~b�xqـ 8�D,eI7q�G͎@�OM���]eX�����j�'�Y�� ����iqn:Ơ����f*1�����|�pT@�3�O!/��5a&.���� !�+l� 8�ls�;�x���+��24j�5����H���"�Xe��R�[�t��_Q*O�m�28e��6��`���P P$��ŏ�_���m`�)����`f/ӣ${�)����;Sqo3�wE���oQ6��hEJ)%!�|�~���5���gZ������p�cu��@�=�f��Sj* L����AI�h�P���pf���S�Q�AX�) ��M�Ӳ���+��,�~�%���xv<����'l.[D��l5��S�����KB9*��}���\8�.���b�rm�O�s�߱ lO(Y��tm$��������_�G��O��m�ֳ��� Wh��4Z\e��`�S� �����?.{1A�U��Òh�봛$*���ʏyB�@�Q#���7��bE8A��fj��x�:�m�R�����<��[[���-�]���;��؞��S��Dcض"���xƾ,y���H��:@�0c}poP����1�o�1r;�i�$ZH��a��i����>f��� h[88̃�sa/��Ev�б�A��;�c���y��P9+� zH��R��9�������x�r�mq.:ᜧU��V���U+� �zZ9-:V�j�b8����@L����� �����,��X�8��P�O�5��MΉ��=$��*�i3���b��f�[�<y�����+R}3��2 ��τ_���Q�}~p��]�x3���/UAw���g�M�T���+� ��2r��ґ�n{�x���?�� ��2h���ַ���K�\�'�*�% 恮��2l�'vH��
Behavioral task
behavioral1
Sample
ef1681b5c35ffbb692584214981e676d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ef1681b5c35ffbb692584214981e676d_JaffaCakes118
-
Size
208KB
-
MD5
ef1681b5c35ffbb692584214981e676d
-
SHA1
abe79e42e2a21482ef5259df09c2ecce3438e402
-
SHA256
23efa0808037f6ac69cd173281fe467f7a4ecd01c6428aa56e693a26382e629d
-
SHA512
2ab78ada3f342b3885673469cc411aaec736c9bd9bb2947fce0194dec1ad443bb05c169bfee4ec4a97393f8717b23f79964ae171be40996c5c5327c98312dbfa
-
SSDEEP
3072:Vw+iTvgqKPkGCp2gDGoFIP7DCMM7xnBwnPguUN0EzR2ipu1HBfv5E6Dqd5bC4CQF:/vExhIPCMM7xePXGtR20eDEm2bkpS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef1681b5c35ffbb692584214981e676d_JaffaCakes118
Files
-
ef1681b5c35ffbb692584214981e676d_JaffaCakes118.exe windows:4 windows x86 arch:x86
75b901c23264e9398d9f58f4db1563d2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4078
msvcrt
_initterm
kernel32
LeaveCriticalSection
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawIcon
ws2_32
WSASend
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 196KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE