�r}"g&�_��W��jR�GG��½�����]�ih!��R+5;���t�s?�v�� ���ܶ�F��v+��<�/I9qPO�.���z��S��,E��x��\�#L��2at�.+��Q���{���GI�ZyE�ت-ΰ���j�E�M���ucE�Z�X������4G�w��s�����G�~]��p�a��Ul��%.O�q�?�|�E?��8�Lw��,V�?��r���(�Ͻ�E���b��ﺭ\3��y6�i�!��|ލ�d6]��ݽSe��b�ӮR������_u�ݫM}�^G��ѥԼFiQ>C���y�*�"��Uy�w�5��ܫ:.�B3jK��#��C8 ��/�-�x��'r�$Ѝ�[��z~K �6'��W����lo�����{Qkt���>J�QSa��?o�x��t�f!��I[���l�Z�������<��1�UT�{��ۨ.�[Pk`<$ק���w����] ����x/8��j��F����)+S�˴ϭv���R&3� �Zնp�«e �P����5�/@�L\��Z��$�ƆOd��G���z����V5�T�k2P�q"��27@E���_��q��2A�� ���v�čsP�n�ʈߝ��A؇�S5a 1^P[�q�3~t�٤�� �95�#6^��U�F�ob@��U��O!0V~��ZUM�G����͵Q�����Bt4�o��]\B�AQy?E�u�dE��l�� o�u(� 0Fde������@5M�"��!Ӛb����Uԛv�hqqZ����1��H�7�Jjl����-��H�l��Ȋ`��d�M��:"0����[�ʰ�}8c�X��/o<�l[�u#�qVW��y mT'�w1�b��M�\�ML?�-�a`0 �V�I�m'�ĜF��v�l����J���O<Aal����@s4�_siOQe���ŭ�� �O�{���"�I���A�nU��RG�T���&+�sJByhC��$ѫV����ś�)`���3?����f�v$��Կ9�x���&ҩ!���Ȩ�Į�tv�_?-�įՍ[��{Ch�xݺ�s`���i֜�V��Z̻ c���v�*��x�TC�#�b��A^�+�L�u��UW��p0���Z䇞9L��%��[���ߐ����V�M��6b���v�gl��݅�#|�I������~�����q���z|�K�F*�� �;˷V��\c��*v�d�ՙ�#T�5ZoZ ��U�4(E��+��X�~�`)0|��������SO���B������ȕ鎩���0)0u����dR}�A8Ɨ"~�}��h����6��������#P0�E�n<k}L���^$q��N���D�0��\�����Ԝ���ӡ J�!�~;���C�;����E7�v+'~tr�Ja����&Μ�gCck Z��]��7X bM��7���0tNf��P�����N�����I��ET���ʕ�������r(*��_����FwL������<�����V��Nډ��4qP��4��a�7q��=p�`IOg<������D�O��WF���1KSpk�-�_�����S-�nV>Z��9�ۋ�1������ ^�J<�5��� ���N;�Rt���( �X$"�՚-�R��1e�D��$�Z�:F�ST95��m^7-��A��;��)���ݰ��� ԉ��l������Ң�to��8���Y�j������,k��T�|B������TSq#j_� +��O�W�0���j�e��/�����qk�R,ij˾J��{%��\7�j��q��JL!�9N�zr��z�?����hWr�A�_!���� ���8�����P�y)y�h�}��&���*!��TTU25z�T�)|����X�=�V�������ܶR����ݓ��'��l6�����W��0`-�����`�R"�z� /�NC��}C����TX���1e��ԕ���^r'Ή�<��Fl�2Bu0=w���$�DF�=���G�%�(�܍����*5t��sT�_�P�b>$�-q����W�UcqP�2�u+<�i�*=T;�E~���r�*y���m�����ɗ�H/KW����73(���@N��r��m&����}ڮ90u�� �E3��V��*@�r�I�����g [i��H�����I�#�DYG��n9�9�"�wU�����Aff�DX_s�sJ��˯�Ԡ%���������G�V"� pKؘ���%�X)��p��ͩ�旎�W��~�V���O�E���ᕻjZ!�A�h8z�BP�3��3��9LB��Oj���JG?x�����\`L$ ���D��H�'��D�)��~� �@�1����b� X�ݠ���[�(�gd�ggg%�0ߚRW��Ju�!x)Ԁ-[c�8�:�U����������ڀ!���c��+들i�)&�k�a/*���,�r�����4��ְ�ZF��F�]:O������C~y�߀t"]�xz�'�������C��O{sd��"�,�.:k�|���"���T��j��!����3��T��x>t�� T�)�2���lSn{�����&��9�7M X h�P�ͻ�o�wmI�i�M�����C��j=|�>����U���H���A:���k����������_c��r�T"�Vᣒ3��|Γ~����y�j �%�A��Yf�G��}L_�;����n���wr�5�����j�����b� �f��x?��4�@Ϥםm��&d�al�C�/��ZE��|$k&ߣ�5�Ǿ '�-� Mt�� ؙ(ģ���ӀRR��uډ_E�^���I��ا �o#�i���.������R��쁦�%�lۓ����Y�8��4? W�T`C����t��O(83c�@S%;~�.��V,hLY!���v/U�U� ��=�8)E�� !`�0��/l�5{6��3�ݚ6�� �APkAM��K�T��&�o$dR������.�c��S<��;1� �F3���8t~Ke�8�?���1ރ� ��)_xX�Q�q�_Z��g��#u�B����Y!Cy���ׁ�0ߪm�8�3���6a6���� �6�Iu�����k�m�H���S
Behavioral task
behavioral1
Sample
05fc260a1750496294ca52a791cb1e46_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
05fc260a1750496294ca52a791cb1e46_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
05fc260a1750496294ca52a791cb1e46_JaffaCakes118
-
Size
736KB
-
MD5
05fc260a1750496294ca52a791cb1e46
-
SHA1
09e411710c9789fc9b9e2763558f32dadebc91af
-
SHA256
9fc8f65732bae3e8a2ecb7ea56e3f4c1834b7115adc36bb1537e82ac639cc8d7
-
SHA512
2fbeec9be890a099c5614bcbd9da3cc7d7322cebf4cbb5d68042dfb3f1ea64e05d41d399d85b78d290b4d2b4d3e516c4b72e5a5a828e987d042934761c8a43b5
-
SSDEEP
12288:07Gw/qQDOo6RKXY1dO+jGicBwG1Hw3EWiCTOD2ESSF9dcpBK2qCHpE9PXC1fFDT9:GSQDICYjyRfVw4CiD/ScU4FapEVC1UQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05fc260a1750496294ca52a791cb1e46_JaffaCakes118
Files
-
05fc260a1750496294ca52a791cb1e46_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE