6����~�]_�N��O�(�-���m��+[��4��뎒M�ؓvm&�R�P%��2�|T�=>���4���p��,GC��9�� N�DǑx#M ��v?I}2��=����� ���d�t��Gl�L|�@�Ed�,I _a B4kA�[�#w���Ge�gx�a��Kb�"m����Yn(U����q�X�Ҳ_��<��9� 8WY�d���WX�<���i�����,L {��Q���(�� ��<-!R�����^���}�<�=�<6ْ�2]M��~�`8-���,�ҵ�ԁ��*ֱ62J�Ʀ�1���F쿸 ?x@�f��^�����=������~�����*{G���쳮�[�lL��ӽ8�4q k����Z �����э���Ⱥ tGY�鵋�$t0�K��.�d�e�8W�Ch�L�4�G��N��A���=�̍��+��p얦��r3��p����؎������>bN:��GG����z��RM���;�ĺL8������K�����^*t�. d-|��A> vv�+{6Љ��!�>q���Q�1�)u���?F�#��_3rQ��f�X��y��Sn6��=�,�[��k�B�2*�O!�*N�:����I�K��9�͞�����ύD��tY.�.?D�R%jݫ�DF���j@ȱCzI��,��`��5�i�?�m3�+��>��щ��/P�E� A;D�d�Ťdm�� �6���Qi-���q*�d �:x����e���yC���3�Ӫ���u����qzj���� r�z5?~�'E��OP��H4Z�<� 8n�y<�&�s�*��:bo�㷐t+_�AS薦`��;J�f�B�竅~����P����K�JNV��fQ�)2��7�g-��@(Kg+�����������n��I�ѱ���&���5��[��B|��08�O/W�"a�@��ꗀ9�O$���F(l��c��CC��QFt�i� s\��7?C�F�)�)nA��D-a�:+��h��(��ᤩ���P�v�2�:,f4\7�ڏ+�s`��/;����H)W�����h��W �JQ����\xdK?�?�������j���������*�Zc,�R2�M�9R��q���z�)�hc�Hq�ARv�����ʔ:�i���}H:�,"�]����N���ȴ��̩�Q�^�Y"���%Lx�$��S�HD�Vy�� ���E)���� ����̠#���H2 ����0�':� �Z�(4}%Ԅ�oA71h ݡ-:��҆6fܞ����3�4�zg��9yW C���7��)L`�l�� s�<#�z�أ��VR�tF���˴:>!����4�U����x��Hh�|Vh �Y��>��;r!��<�G�D��Ȭ��q�o�u�mH:��b����B�����=4VT,��^�z�O��豙-�a�˨" j�FW�^�A웆FX�"����-��;�˚�ܶ�?��f*�([:j�ʖ�����������*���� *�YX��|)���y������Na���X���j;� ���Nv���5�0�OQ�B��3w�2�Ѳ�gɟW�`��&j�qB�B�ץ�|f��ҹI�ͫ�o)H~����o}��cU�x�,�?��T�(��.�^�HB��������|��2�#9�� ��=J���0���g�O͋��R����f�`>pyT�s!8?��/�v�s��J1�o��j�ar�ږ��|=��𪚅���-(�Ö����Say)K� ��� .��4���F""Ml1���p�4�=����9�>ЫC��:�p=���q��FV�S�7��8;�W8����Cw��3������-P=��)!�������"�r�e���@Ԑ#[���6s(�����ו�*k 5c��6�@�C�D�ԫa�U����m�і� ��y��:��"�*է� E%I`��J]�Φ8�ˊޗ�����EX|JH����w��Os;0�`t���=�7+��D�#���EL�rl,2m���?d�^٘U%��"�n����I�f}�g96��D ��`�C:}"T����M���g����̲���Y��iy�6�8�,��Խ���;`gWtpd��Ί{��@x���<b��u*m�=_hm�{|�V�g�y��r�� r���?(�!�a�|;��_��]o>Ԓ��d^F�5\�}aD�@BIE�_Yc8r�hM� �����g��[@<�*�E|!:��Ȅ��z�=1��Nƻ̙�� �q��L����Yg8�@����:8 �ø�k��P��a~p���F(ӑY���vqAQ���B�� �뾴&y�\Y�w8T�Y@�z��x\w�k��h� Kb��+�D�2FGI)R�o���X$@M�E>��!����=Uv�JM<y/GW2J��T��~���\�`�ѲP2>3g#{=�wNv��(G[+�e�D<@���X]O)��YP�F��U�ѻpB����v�����y9��{�/�cM�Y`d�vt���-��6Z�\L�,�}���2���#9�ΈKڬ�������o��~�ى�5�}� �'6�G���I���s1sJ�0 a�nS#�Ht���L}��K���X@ �y�@��A�� �!������/��}��x~�T��o�U���' �I�A��s���u;�IYt��ό�q���Пo�O9J�����b�ȵ�"�*�D���b�%��@ p<�<�b=�~ �y���s� :�e+~#��_�GB�A�%k�#��0��������U��b�r<��0�<�o�Vݰ^K�)��yHͩ�Kп��`6��)�-����(��xD�f��D� �ϚM�`*13dA���՝�;�X'�a&��j�����B����T�k��7ɐ1���CI^��22.���)vJS~c�d��Ak!U����{��&wt�h;;~WR�^샇c�e�K�|Am��7�rv����.�tm]Э�`̏���V@!��L� ud���i|b��x�ä,r}���a�k�B��������CD3�BoqxG��Ky��yy?Dނ����y�a���z������I/� .Z����"o�ĆX)0���N
Behavioral task
behavioral1
Sample
0efef2536c26152419145a390880b9b5_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0efef2536c26152419145a390880b9b5_JaffaCakes118
-
Size
4.6MB
-
MD5
0efef2536c26152419145a390880b9b5
-
SHA1
6aae40bb780d28da9261335afd862ac39d3585a7
-
SHA256
9a937cc1a0f8c70eac414204454ea6dcb3c506c1ee31a5f94f94f5cdb2738586
-
SHA512
4edb9c8bc6fd1b96211faa42a02fd77a09b05fac1aafb3fd2e1339bf30d6440f2e2fdb9c4a16bfefbe5717670c0a611335d5faf3e81cc658f980487c55d62ce7
-
SSDEEP
98304:V09S0OvSvdf+FgMH6/v+KYIVRcdNdthBdqlk7slJJJueTDUH0yKkegJ4s35FAfDb:VKS0OvSvdf+CnFx3Ujth3J7UJJbTC0cQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0efef2536c26152419145a390880b9b5_JaffaCakes118
Files
-
0efef2536c26152419145a390880b9b5_JaffaCakes118.exe windows:4 windows x86 arch:x86
e114e3cbfc97c5e36dd3cee9fbd755d7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExA
ws2_32
inet_addr
comctl32
ord17
kernel32
HeapFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
shell32
ShellExecuteExA
Exports
Exports
Sections
.text Size: - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ