[��H� ]�.)�4]�Ij-�>�Pq1֨֠��K��֪�{f���l����?Z�'�u���M��z�Z`A��$ͺ����T�@j�m�~d�!����fw�!̬���(��;�}�����}K�X�2�!�ض�}�,�z�{ d�<i�9�FRMq_��d�T�s���0 ���㍘8������1ҮE?u\r���r��u�S�)�V�LM����D0�o��\�H`&��ݲc�*$�ǭ� �*S]�YaW#�ꗨ{�j�DEZx����ٚ�����H��)����l.��� �h<ʼn����I���l�kA>X�Hঙ�����aL��� [{a0˝��>h��t��k����/z�8����\��Z\!��x�d5��WW��1�����6o��`7����'M�У*�1iB����sɒ�5Z�CÞ�K�`5ϫus|�s�R�cj>�8�V�����o��ң��%�*��|�[�w�L`��h��W���xDU]8���r��^����>�_��/����$QBb��öQ�u0e�,V{z�AJS�)��h6����M��?<o���~�1axm�JU<��3A��Ep�ۖ� ��Q:����� /`��}�H�lٳ`u�e��ζPCw&ޖ�q��@��R�}��.���f��B��b�ĀI��Nm�lj?*��+���&��ص�{=R�؈T���>9;b��� �O$��.`"��6�?�)��x{ �GP�"{_H�h�����/^$Z<�9=f �%�e�:���k�j�G�dY�6�L�f�d~��?��x!Y{��N@��0�0�6����t��)>����@�U�S;�b�u������ÿ�����n@��g2�Y��2��M���4ۡ�������C���?J@����bm���k͈��ۅ} �̦ Y��W�tZV_�&�9��B�%���k4O�P��q5p�i+��[���o��2ci5��ø�������ͤ�s�oL4�õ}J��If���j�Y��N��S�d�i�+�m� �2���5��VE3���`Zׂ��Ug�����E��M�@}�M��xh$�a�:�nt�ON'@��}��Fn�� � Ek�vo�6֊��Q-iU�ƨ�Ȕ{��DmcT��v8Z��{��*PnS�#65z��_�V��/���ȋ�F���1�@���!��ZP�v`��m�c\�Q����w���F�.Oq��n����Y���9{>}V�tb�لH��*����t>Ԗ���oC���Z�Ð�T�E&�i�i�1MJ��#6�P�x�A���i�Bs���z�T���M�LRT��)D�Bg�k�_k�Q�.[L 0d�Z[�ޜ-J\D�� $�;�x�-�r���wovM���Pr�\�p�B��� ������ܻ��Y������Z���J������������- ��i�J8&K}�����G})����֦�cw'�T ��HkN�t,����U7�����K}��W ���PS���]!T�P�҅��%��V�hF��.wd�o�}j1�������d�$'!պ{i�h�.���M1���o<OT/8߯���+P�Z|�V=���9���!T=&o-Q���07b}��;��)Fg�����B�^0eY0t�$.r���T�%j-]���:�� -���I�"� �D$�$���� ��L�e4���V�����5�q�,L��tKnfW�bA:X<x^�.��ӹ���)��hk�NJ�RԗG r��]��Y�y;'���GO�]h#��ܝ������G}V�9��Qx����ܹ°�d�(�f��ӱ6WPϒ#��%����5Z��O�#n��g�fS+e��W����'py�G'ܪ*k��m���3 ���W9N%�O�-�PQ�=ь�㚟Ӱ�,/?�N@���y�� D��0���>[�\��m���:���l��i?J��k�j$���Z�����JoDT'E�ֆ}�Ȃ�����w����0o�\W���&�e���F����=�K#��ԏv��KF^�s����J�D� A�o�5^l��˘������B��㽥���EX��s�yɺʰ]$�^�8�2��/%v�8L:W�x�GXU�7[�����|TK��/ lFO�I�����zp3��;P-����a��MG���H��������50�j�^�p}R܈����6z$mT4k���h��0�u�p��o������V/^ϩ OΝ�G��{��h��(�����;�{y|�g�ގ� �H�ޫ~$R��D�'������������ �Ά���$���g/���£��yA���}�|���Z�+k��S�Ɗ��}���R�L)S��魗�ɯPP�m%��&DN'T�+��R!S�r��u����Y[cY�}"fV�����K�~u��^��۵0����W(�e���ߴh �?�A�>������ (��~������y���I�����.v�'�W��Vdz�bQ�C�>�I�}{�UA���p�9hkQ��+l������k2-#N��T��z�-woJ��8����ŏ���#��eO[>�)��!;�(f{h��]K��� �`�6�$�oa���S�GopO�䄾�7�I������z\�A!�o)X������sy������LJ�XE�+����?y��� �k�4Z��'I�� EL`ՂK6��/�d���/g��3lIm�}7TJ��-��>����i4�����%��� ؕ�X�F9���,�Ѭ�e��*�dc���;�E��(�2c�;?��,�!����O�.��x�����֝�/Syx�4}S�P7娺RP����ޛ�3�٬�7{�K�Ih��@�[��J��a *�R�� ��4�F ,}N#^������/f%�22���6`c���je���Ke��d� [��m{B1�-R{>�2�傸��Q�}�տ&� X����g� )!����X�U<��� E�g4+X�� �C�X��� aw�F�)�-X�� w��!��n��⯌&�1�V�Xv+{�y�V{r^<��1 ����e?@�V�����h!�s0��|��ռ�3�I����fu��R�vjSUy"�M�̭�d�4�r�vj��1
Behavioral task
behavioral1
Sample
fb968b2301f0ff3cb087ec3603459572_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fb968b2301f0ff3cb087ec3603459572_JaffaCakes118
-
Size
728KB
-
MD5
fb968b2301f0ff3cb087ec3603459572
-
SHA1
a36dacd1c2d2c3614bb2b03eaad0bbbfb4f183c1
-
SHA256
6f2c158f140bab792fb954d4c4aef3e97cdcad5b59d51ab0defe8e253077c63c
-
SHA512
7584ca9a7887399329b2f2777abf67d9e4986beb6739238837de1f0aab86860f340853bc379073739042100e5e2226d34f58fb128c1a841566daed8245545588
-
SSDEEP
12288:eHzuJkeHsogIVxpX09Z2z5rtXmBIdaIjFzHB83WRwD/Xdi:eHveMyVxpX0i18B6hzdRENi
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb968b2301f0ff3cb087ec3603459572_JaffaCakes118
Files
-
fb968b2301f0ff3cb087ec3603459572_JaffaCakes118.exe windows:4 windows x86 arch:x86
44c7369dd8787a7e57d1624484ab73ab
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_AddRef
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 716KB - Virtual size: 712KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE