������ٽ�8�C�xoM(�Y�Y)�/B�t w�pO]��4o�h��@�R�{�r��2�E��'�R!��5JI��2��*R�UF���V�,^x@~�a�ۚ�ס0�&���^R�DLR����~~p�K����q��R�����a������v�`|��i�>���61��)�ˆ�d!�yy�xq��7^D�#�tt ��.������rܱ�P��7�ڱL^�;{п�#4��D��ݚ��H-�I=#}(���a�����a�>{���a[X����Xb8hz�������WL34m�A~.�E\o���l;����&���n���:ۿ�/����7�λfb��j*�2���V]���*J�D | ��=��-�~�}?Y�S�$C���$����'�.<j�3'�馇E8�{������OiX�"���oq��CF�� +�Jg5��l��p�b��~�.u��W&^ K^>�^.���x��P�� M�i���-+|�3�mg���y)����׆} �� �y1��>�ǰ:?���ղ��ȫ6`�Ѕ�49>܂�8]ӑ���5�Wk��h%|:�?ٙ�ա�L���|O{�����!%�:��z�J��|k�F&�Ӽ��� y�.&^RC�jRT[1[&�7=�w�f�`�F7�7]r�R�O�xo��?������2jw��Orw��(g�p;��U�Z����Ēݫ���L�A��^u~n ���鼏��S0�? ���$5�xB�����W\����Օ40�\u1��G�C3��^��J�5��+�j$#��%������Of�F�K�����R���7 "� z��Wב�5��傆��q��4��+�̬�X���/�B�:�7ӠrD���^?���5�Đb��_OܶK�q�g<��,mmJD*,��= X2��[��$�փ-�[��qn����*���ǘ�b���x��(�ň�N{�WLD��AuX3��������B��Pb-o ol��,Ӷ�F�Ҁ�����Ƚ�P�1����6��C�r����J����Iy��'�.�ٟ�M�,���ºU���L��Jg`���-�(,����/|Ճ�j�סV���숔5�����AP��:3稲8l~�Z^ç��ƲX���f��t�ܿ�KO��ʖU\tLEm��h��7斻�&�_�.Y�D�L$�m�'U����#��R����WE�� �-���7��]ڕ���#�z���"��2M����?"A'�ğ*ⲻ�ռ;��`r��S%=�����p��D]�61��\�yU 1�L_��MPc�p�Pս� �����,��S!������mq,�?�U�y��i,y�u�ܯ�1��|lL������TTCx5(�l�����s̜��K�c�F�0����~T�{T�#;�뺧�Z����s����Hx��N����yW��V*�xjZ�I�X����`M'��&0��~8����s%7��{P��a$0[[ b�����p��_&M��Īz�n ��G`>� z!4i�d%쏦i��X�&�6��4:�3�m ���2�I�����Ep�9��K��۩xQ��ɿ"H��X�E��A*��n{9Sh�]��z�9���2Tµ\,�)��-T�%����N@{�Nķ_T�U�z]�p��������L�2D�MA8$N�>9� !���>�19���Rf�(�C.��I�#mmV�*���g�(� ���V|�/���{��w)�z6���K� Z�����4�B2����,��&bAݎ�e'�P�d��~��ܽ�gP���D��b�X�9����ŐJ���s��C%)�A ~|=�!���'�Ci���?qD����]t8(j���[�!Y�(�k@z�eN�&N�����KH@�w#�;�nFh-5P��4����$��gp+�I ��ޫ��d�g4�L��(i/<l9� �D�L,3�v�)q�n@�Y��<=�j���a�rEj�J������'��?��G:Y�۹E���?*�Ҷ\xw�:.��5(�Nb���s���� F�m�v9������L%}��PE�O�@��}�T�@L2� �6�T����^�B.�zu�-P�;�������8�Aݝ���AJ+�bG77M�xV`��}M�Bf�ҝ��P�����fb��i�տ��9{0���-���������o�q�j�5$�_{nScv��x����4C������Ӱ�Ԋ��iuy�-4�+P!s���� ��E�:I�Mv���Y��OE'�^��70�#oy�*�o����q����j9�Ƶ���i���FX=Y���7UJu:A�i�i?h���.C)*�b��~e�g��x>a�����W�jX��������{G��z���b��p���U�������ˎD��#E�տM��J�N��F1��.�]�����Va@8e'�0fe^�\�8l�7�. ���CXbXt"�8>�h}�vN���Z��kc} e�'TE^S6���3�LL�v��a�n,̹����{�l�Se�'�����Q�+����4mjf�l�N��P����������~����>w��~��\GF�l���];���Ή�d��Bu5O�b>�P��a(~A���xoae�)�:Q���Z�Ģ��"m,����c����A��%��B���Q���g�b,pZ]�-��%���gtsF���6S�E�;��p�wL�gws3>�o�-���$eP ��E6j]����n��z��ßo��t������E���w3Ox �x��8�8¸:��G4�qX�4��3g�\�a���b�J��9*_�4��J�>A<x��v�F���C�:��\���['�*=������m���Aw��-���}�g�j�Ѻ캏}dc�o�<O�@M��Bh3-g�d8���/؋L�.~ԗ3u��E��4�s��uA�!|�0�[ԉZ�ux!x��-DFM��M��d��n��'�u��HJ��S�)�h��]��8t�Q��<�sa/��r.�&��s}������?�3��ᔣ!�V&�|�.C����[%��A���#��/}��x�3_��>�>3hn�VK���Ȕ��gSX�{�]xf�^�'
Behavioral task
behavioral1
Sample
fc64c54f00cf9313300f443cb07fdc66_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fc64c54f00cf9313300f443cb07fdc66_JaffaCakes118
-
Size
408KB
-
MD5
fc64c54f00cf9313300f443cb07fdc66
-
SHA1
e938fc4897edfba31189e8028a834670cb8660f3
-
SHA256
3650714e635c5deb6525b761ecec70a4edf8a507700c928547bc01f0667b5505
-
SHA512
ca32424d2a9f3206cd839b0ad6adc3ea0d344b06fbd91bc6308f99ecd5901ba6fe66c8840b54227fe985074d035b3a67e81e416f515a9ea347c0970f42d9e30b
-
SSDEEP
12288:HqDJ21HY0S1Coss9YAlpoEPp6T/qfgMbbbEmL8ja6re:KdqvS1CpSrHoEPp6jQgMbbbEFja6re
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc64c54f00cf9313300f443cb07fdc66_JaffaCakes118
Files
-
fc64c54f00cf9313300f443cb07fdc66_JaffaCakes118.exe windows:4 windows x86 arch:x86
469baf83c7515dc8b5cd376f7d941fa4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrToUnicode
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 396KB - Virtual size: 394KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE