��M��&d��v�����L��|;k����F�V�d��R��T���q<������[���Յ�ʨ]�6-�P��F{ \���*�+" ��ք�ץ� A�����n�"�1�JQ|N$�m��� �L���C��j���;<��&T�@�u�ѽۜ��0�"�Pe6�i#ъ���~��Sqx��mR_�Y�s|�>J���ƥb�m�Żh�G���s�5� z"�σ�Ix����hE>q�N��^u�n��B��[_[�Zw�ظ)���Ö�����pj=��B|x�&h?>]Y�xFMQ��ZZ׆⣴r�]i�*ԍ���5��r �L���t�Djύ]q�胖.���.tu��;�i��C0�a2Q N��#z�b(!fL���f�7�;0���{���m֘Ֆ����np(<}���2��O��pm���`|:�NmR��~7z���k��l�ai�w� z���m:�����a5u�M%��dw�hF�i���dy>T���Қ�leTs���7�,�rs�AE��/aw�J��?F����K�~ z�LVr���Y:����$I��W��m8>@9� Q�\Ӥ���2�:����'� ����<�o��^��Vs~��U=0�)�?����#ރ��*��@�3��r֙3.�����R��~42�1|YZ��&��2(ʊ�-�� �q�i�Arv�/�iW���db��rQt8��yr�����"�=��<�_'S&�}�Ew���� �;�l�����l�PWu�=��ʬ�dB" @�S���];e"��UEI#1g0+�y��|R����l���Bb���5@��t�γ�s�~2[(ᐴ}F=$E�9رHIf1��깺t,��dܱ Z���u��$���bƚX� �2E�5��xCa����<ȗf�R����eb�d �_�b T��iĿJ�����S<�56��MKJJ���X�ί��V���5^�2~���G��^��%]Tu�zy�k�ٿʋmK�s� K�7&7�Cb�wx ��'ɜ봔&�T1F)�i����:�7w)���GƯ��8����T��>S$&�b�z&G��ܛA ��<���2��$ME!ί�~��^`��M�TO����.�60�~�G�dv����`ܰ`�Ψ�E��HwC������y����@�|萟���d�;�n�yZW*��]|\��.3�?�!�RiW-�����?u��h ���!��N+�-�6d��C���,��������2�Ѕ/�L��B�O����wg!��dj}9tl�J���GcoϢ?�Q��tϑW1��y8l����h,i�c���ow���t8���0�GCC75w<��mM��v��ז�'��U�x�W}&sG�#�����D���T���'�(����S��^�i�y{.ڶm�6B5�0����� �ٷtI9;���8y�al���}�u h$K_�����d���C�_z�;�al|���v��x��;��i�H�[�]��bŹ?�J6��T���&-6���B}������Ƌ��ڍ�����r� �R��*�����l����}4r����$�/*��h� �� U�U©�l�f��]���B�_�=��&��VI��:d�OUG4-����)����9�%T+�{���C?Y"��=�4r�Q����KM�������L�ti�� #��z�C������S�����f�.^y�l�*�(�t�G���}�,[d�´=��5v��\�K������������k��i�h�ǎXp�[ ��ˁ�����x�����#�����m��휺Uv�� �cG.v��I"�ES�`2I���T'��? �b��.G�Т��7B��A�/�y���ŚC�~-�)>���{G,���= ��R��7�d�qBޙ�~�e�XY{G��.��ȇi��o"r��^*����a��~��+���5�2���/�=�����6��GV��z]��0O���+��"tQ;�V��d6oBAѹ��j��ޣ��i����6|��+N8�����I����Ө��;��g$ ����1l�tP{�0 ;�Mҹ�P�μ�a�P�Uz�v�,PZ���Ƀ.�)��E��u1�м,�]�������np���:��|�J�z�O �s������֡�h�{�d$$�p�g1S�\���IoaN�C������/_�w7N�;`�#��U��*���� �}���|>.�h!s��Ö����� �kM�PG{��x]�/���vY�sa+$U�KXP���c,���YA #?��Mos����M4�w�(` gKvk��ʊ�6}� r�j��a����A�^�Ñ�T�s��Œ-���7��\EK��� w��M��n�t9��+��c������i�2�����܂�c����W�:S$qz�8�sIv�.p�����Q������H ���\{dއxM��H�����H�4�̶>�Y)� =��+p-�q��rU�&�9�b����^_00�,�ID�v��yxnf�`Cj�#w2kV�!m��X`���J�����sfc$Ӱ�a��-�RHF�����P����?H�*Lm�]����1�2e���'r�[W���C{ ���)�2��lf\��jF6f��=��V�"4l����/m�nh��i�&��]�@�����B��:b��Fwt�v�|�Jٟ�jO_ؼ:�Ps:��{��$�]�e��|�'N�p��G��皆��m�֒|��|!�̆ȌF��,ʦ{�lA.� ���I��(����!����7#s�=t_(�� �^th|�~̴��$F,p���>'�(�%Ҡ��mU#�9P��u���2��F^����<lQ§���oʗ��)a�d'��}����(����44~WSe-4I�F��� ���5r��鄀�������Jp0�yo�k�"2�a�i������f��Wx4c=s��)��e��]"���J��Ĩ����B��ڹ4�<͚����~�7/h���f �-�؏� \���J�),���U�|*�H%ƾ)1dM%v|��iɚ����u8{7�s <�2ţj%?rJ���I��ڄ��nb�gB�ɓT�������/5r�\L �y>�F��I��Q�S��cy+1�
Behavioral task
behavioral1
Sample
feb9d3f1729e3f245f84df0cb4fae80a_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
feb9d3f1729e3f245f84df0cb4fae80a_JaffaCakes118
-
Size
732KB
-
MD5
feb9d3f1729e3f245f84df0cb4fae80a
-
SHA1
45fe0ca4c2f1a3196cca21086a0b0a2a3bd418a8
-
SHA256
3bb6116084430a11262d49cab4ef9e81660837b68956ac3803a01b13f613278d
-
SHA512
6d37ea7fc7dbae61a850248acf3bf91250ac9339ac5a0b864958c73e947f122af3119702f3652dc351f942b563c49a87b61644553ffa050a536aa99d3d90f435
-
SSDEEP
12288:mrFvIJPrBoWHrh0X8uwWqAW7ocu5f0b9fSGYRqmTaqET8rgHJortJGbc:mrFvIJzsXBw5V7ocsMnUHT3AHWrtJG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource feb9d3f1729e3f245f84df0cb4fae80a_JaffaCakes118
Files
-
feb9d3f1729e3f245f84df0cb4fae80a_JaffaCakes118.exe windows:4 windows x86 arch:x86
a9dbfbbe8d35b29ec99f634ff7400b5c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord525
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 720KB - Virtual size: 718KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE