�b���a�Ϭ<ֈt��5Le �y��R?�v���h90� ���kS�*�! q(���RL��z���o�7�Y^i��m�7�)ͯ��켺�0�o0����<3`��n�?P� �k�UK �������9IM!�ѩ r�^iq�(�K��Rߣa��N�X:!K��� ��x�@k���[֍�ŚǬ��0��R�s��G��j�3Gaؕc��4�Z_��Ez��.�$~ ��g�SO9ty�W��ua L^�d_7S��:�&��H)�������$�WN�����^��o�B��?��%�Mx����1�J!.�2�֢��ǡ�@P�wa1Ɗ�����s� #�OIDw��{{�,k7�Bqj��,�o���_�U}JA\3�C����Q&?�q܊ʒ�����B�S��9�$�d;�S�������H��~��`O�`��`�U���ʁ~�>���e� �J{�'Yq�(���yvT�`���Y��3��c@I{�Uq0��G��s�|Y|X����y�A���U�D9B�� �14ʫ��ʔv7��4��/� \�)���1����WZ:&P�J.;l �ja�����Q������:�����x_2}����̒� ��?G��Z1�Έ�w#gZ ��O%w����y �Lz�I]- ~O}={XU8��uX\?9�+0B:𧯹�K�3F�͖�Q�5�ܮZŋ�d���=e���[��7to���T���8�ف�n2 $~�R�v����@�&�e<�%0gj��+��t���G�fw���E���7�K�0S�5�� V��ra!l�Ad��՜c�n�1��iw������X�G�i*��ޝ�_C�1 v����<�n�XH��#�HS�t�e�ͤ-�-[�[��������R�<00;N�6R��Hєa0鰛�N�ס��Z�P�3�IVr?7;�8�fd)D�s[k��=�{;��sz�g(�OyO�n��6��Q�����.��Ut5����n\+5��;�Z��@y��a��8����U��;%4�#������[g��ART���uc.bk�s-���n���84�A[��@��~- O�����e�p��eg cޑ���L�_�H�+9֔��x.ޡ&� �9�.�M�W��{�pA���ޞ:�-V�ߥ������ K�P76F5��~���N��u���n h��`��᎔+�B:���c�'[�ZB��aڅu���e����a�5/��t���N��������Y� ��G;H`�v�u-I�2�.��e�S�;��#�R����ZQW��U2�[���I��a2!��B�lg��>�z��R {2�iW$D�>�mg� ��X ���>��{����]/�o���q8ޒ��șUQ�KtD[98~�6[����e�nC�T�nj�����f�e $֗g}�J�FS[�G��y�f��!�6?�]"��/o�KޫvrĘ��=6G����{!z�� �?[����,�aܢ�>ڙ��ׅϼ��w��8e&ܙ`$��8�F�H_���~z�S����ݙk��aSc�=����iP(���'=;��8}2W\~ZЎ%�Jpl��ϴ��*�F�������ܞ�Cp�4>q��L��J_{����K�W��+�1{�9��V�S�,�];{F:��~���/���k���>�_�v��g��a$"Y?G������JS+�!�3�p�<�ʷ��j�m)�ճӮ2��|f[RA7��E�Ҙ� ��5���=(iMh/v��������]���:�5Wt7�D�ß����2���Č�����(�R��A��_Q���$8�D�C��K7�}�nZMx�&i䳵�~�e!�8��Y19ڗ��.%��1��;�;"\��-a��t�^����Ԏ�h��א�"�m��g�TWW������P �0qC��x�`���<i�^j�o#%������Jl)g����ف��9���?��TN�,��:�&�X�ä�H� ��j��Y�.l���r8����<�QAӠ5��7���}��ɴ�T}��>�tC�S/җc��^z�����E� ��ecS�WA�ᠳq��p�l�b��p�_hT�z.e<�5��<b��hèt�O��������Qy8_���z��V�{�V��Mx�~a%���"n�/�m��6(-q�.N�3�wl���)���1t��o��n�gT�]^Nl}��R�;/0.&̡3'�qaML���݂�O�s'J��ό<�4�[ �&ĜL#�M���e�h�l}x�PU����m-����D���G�����^��[5]�d!k���1b��Yؘ�a5dٍ���j���?�mBs�����j�Q�ɽ1��e�̂^k��`�����٫Er 5�oQ�\�u� �&���>��l��W�%u?z#µ~��2�̘�(GXװ��~m���'�=�K�w����v��P�ҹN�¿�+�x��| ���;�F`�tD�F�m'{�c{bJl�D�>X�F��KW9B�����8W�G�����(�(fFjoC��G0�J�C�x>���1i(�Y�=��=��)���&2mb�6��LnXm�l'�}��_�K��L|{Vd�`s�U#jV+p�r��;�,���y�N���[����t�,X���#�ֻ��YDvZ&Й��Sr���.��ӌ_z�lX���-�$B��__9�!�_N�<�'>��[A���-�� kĵ�HG��2���Kc)G֘(�"Ā n+�kK�f�j��NCfC:=����ӯh��Rt|��V/�B�T��n�#��6�%����za����_ܩ��sя���D���[��@�X�Vz�f<�Jr�H��������3De6�{:��F4Hk����a���?`V���lR/����^�19���*:`�V�i��V�' lNS��erm}��B.Z������C����ƬN�����N�����{f�dF����(L��~�;�G4��o��ژN9��S�mI�P�i����/o(#2����?2�7�����!��Yr)��xL���(1���;�r��X��]W7+���(��5�Ȝ`Q��W��9�ljl&��*�U��[O�c}�������Z���A�NI#wG'�=��EVw *�m����
Behavioral task
behavioral1
Sample
fd8ad8864669719bce7c624698b9e9a0_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fd8ad8864669719bce7c624698b9e9a0_JaffaCakes118
-
Size
256KB
-
MD5
fd8ad8864669719bce7c624698b9e9a0
-
SHA1
cd4b95144ce4ab92689c2495dcfe88549359ef85
-
SHA256
c7e2f7e641721b6d3b148b4cb876bfd3c55cad4f2e7fe9198294e257d6bbcd38
-
SHA512
3fa2c410e1be30231de3324383ecfbb2f95858f6de5d1853476d3f98f4af78170d98698eceb740c02c666a3f183c18c25527fc9fc2176ca68badc49a1f3b6528
-
SSDEEP
6144:Xbn/O9boCl4Z3Zyd9M+PDTc+Fd6FnwSuZSm:EsCOb0Mr+Fjt
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd8ad8864669719bce7c624698b9e9a0_JaffaCakes118
Files
-
fd8ad8864669719bce7c624698b9e9a0_JaffaCakes118.exe windows:4 windows x86 arch:x86
ae8224cfe9046ea609ee655b2ff3fb3b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord594
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 220KB - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE