X�Q?�������KY�������e���I�s��9*Y�7l���q�q{33�')��0��w-U�Va7�N�:��$��W��6�֚6���h�\V9_�]����u᮳���62=) 5���}�*�3��|<��%��n��(�v��oQ���b���)#`��L� 0��� �2X��˔t��[Ş�~%�����T�&�����C{y�6�&1�坙��B8v� r��|�~ܸM�4��y����ZE�ZsB=�˂� �4�g��_����5܊��h$�� }��*΅�A���m����#��j���0_���e�T�]�A]͢%u�|4Ӷ\�����Z���/D�)���UO��ܯ�Mj��Vߛ�ym ���B�ɠz8��[F�3���4�F5�t��W������o�k1F��xP��a��Y�_z�$P熚�K\����#A��t7���,n�\��X��j�%�F�*����9��(�1!B�Lz�̱�ω��R����W��i��l>��Y��:Q���u�'��`��nLcl���&�����.ܮ8w���������Q���(��o�9#��3�5����[�&�q�Ah�e(Fo�B2�9 �|�`��ԭ������\E��J�%�dy�6�xĻ7�<�I�Z��MZ�����-ླ�QT~��PsYx�ɧZ���9?_����'��$/~_��*纼&���Wc[���BA�f��h���~��r����p�+�����X�9���w;�=��TS�t�e2Q߽�(c4������(2lTVgٗO=A�m�J�>�{˓R:��@�7�Z�!��$6���&��7ǜ��r��A;������zy�6�"���180{ /j_�">w�����U|��t 2%Ϭ�%�P71x�劕w/"43��6_ӏԂ� �5a}[f�����{� �;(+�4�����B᯳��6aT).��r����5�K������_.����c��5�c�{ɔm֠��"Ds@�?#M��ZF��v���]Ѝ���p���ɗe�ȿ\�r���7�d:�~Hc�>���q�V�@�`h���\�йe�� �M\mA��W�h@�e3Ǥ�D���O�Jy�*�M h�/� L������I��S��R�A I��C����t�=M�ע"�㸬-we�+��� ���⒑�F���x�p�\$�pR9 )��E�;�h���=<:c YO��7���E ��WX.�b�/F�Ȋ�e�J�/����+:�'S�H�~R6h�X��:��~�Hc4��;��v��5+Pӌ[��{j,�W��x�r�ǽ������mJAF��h7�� �����dEt�p�!d<�i�m�XYX���Q��2V!����B���b� �Zv�����Ʀ�k��e��B�8����K���i�e��S{�q!_i��|r�q�ʚԧ=n�Kb4C��fs�Z��;��'�TϹUah1"؇9;��CY]�x�^MңN�4s���w:�5�P�Rd�����r��e�~���k,�?<�!HZ�8����XSUw�I��a8q/ v9������b?KCrޜV�c6․�Q 9�/���ߕ ��+��d݂�ƿm�b:���� ��)M�����U���Ps{�,��X��6|�V��Hz����AG�����m�$Jwp��C��[�,�USu2vsvo���lM�}�7���4���g�m��e#<��~�E���KG��m�1��hA����c��LWS2Sfm��>pr0���`G��(��grJ� i�10J��lI���1�P c�U���G �9i�TX9V�a��q8�g)�~c�:��_�պH������|�Œx����L�c(&�d���9���c'}���p�m�-� ���)�&�f�T6%��@4���M����$�M�F�WL�Zk�|{��gX=��<:�c��L:��{O�iP�M�Z���H���^ }����X�E�7����ƴ�d+a��jeD���=��@u1�2� ���>Чn;��&n� ?����)��kU�����\eI�q�?.��>6��w���L�B�[�m��� ��H8U�`$Tmh����Ϯ�E�t��o?-n:�l��ɀ����D��r��R��rR��k�(kFU� o�ƹU]5��^�^}�'�-�6){F��^-钨���p�z�yf첥�:@w��^Jc2Y��z5q���,/>w 9��O[�1���)���`d���nP3M>S=�Res%�g�r����?Ǽ-���'9�1;O���L��.\5���j�k��L�/ʰ��iRχc�P�������,gk�k�c���%D��I�p�OWe�{V(Ȳ���>I?o���/�����O�?�d{�$v��϶�_4���,�+ ��~w��g(%"��g�<�(��BVc��(��gkaˮ/c!Ew��J����ࢌ��h�UkV~c��v�w-xG[,�eρf��@�>(� �*E2����* h8�+#���h?$m��s�`1DK�.��m(ml������ߍ}�\~�CUӲ`�_�m�`Xs�Z��G�A�!�������-�8k�wnmN�6��`����|H\�I����u�hO_�e,�d��xރ�,��N���Z79�"�_���W����� �zs��k�f����a�*���c�>�a���'�Dk�ޛ �^�q��#��z��p��?���؎Ãt:�A��4;����� �K9*C�?"�}:k��]~�U�ߙt��3�� �+��е ilwA�:���Ce�9�7v���V���^~!ӌ1��xT�IĪ0���C4ٖ�2\87�C.����k�D7r�ǫ��#^#��4qoqz��\}WB��kLķI�\np�_u��žZ�z�uF���ש�}`�3�P��~Li���άnNQ_VJ�j���hHX�?�8�2'��X���L��+���E0��7� )<<EP� Us��|W"/�~mP�YhͲ�����)V�XnE|�v����Z@��S8 i'�aۃ�����[��[j,J�rѫ���%���gh;��<���J[[xq�i_d�E��
Behavioral task
behavioral1
Sample
ef32c5856be7c7867970ec2b8143c472_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ef32c5856be7c7867970ec2b8143c472_JaffaCakes118
-
Size
736KB
-
MD5
ef32c5856be7c7867970ec2b8143c472
-
SHA1
2859619041538293cb1ef39d4fbba26ccb6f4572
-
SHA256
1c9d4d50c0bc8c409da972cdfc4eb208f6c86a1b2db963c9ca836c8e9ea9ffa9
-
SHA512
5cb7acf91aeffd10daa4495b0f12fe6825928966f2f1bb749f058a43ebde4e17d64ea21c7abab79083599779ee9a851c4cea60f62f65ad0c2e501f0af4c5659f
-
SSDEEP
12288:dtagqA/4BgWmXYAoSCZlLd8C3ARk+IFnvvPr2LeDYvFJKbYcwuF/7PdpKw+t:YAwBgbYTZlFAyLvL2LeUbKbuuF/7Pdv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef32c5856be7c7867970ec2b8143c472_JaffaCakes118
Files
-
ef32c5856be7c7867970ec2b8143c472_JaffaCakes118.exe windows:4 windows x86 arch:x86
c0634448132b64d3f5e5330b7f11bd3f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
DllFunctionCall
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 661KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 724KB - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE