��Sá�����!�L���~��g�����lz�-n�jD�'��v��镁eۥ�cV��\]8K~����&���%���B� `ԦR�B�N��7���a_�U��[C�ň�e�Н�~��A�A�].S��g�������ls#��_��z�����@�H"'JJ�h�\���@<��m%q��U�`�� �q�ĩSn[�C�$���t3ln�,͎ ����G/>��[݁��h���#R�@��"HW��6�������Z KK:��dQ������?nK�Mm��y�F�rR�f�#���\���$��aO�*F��3צ��ybhW�_II��:�����B ���_�U�� ���x��)s���>��U�E����H�k����0h�V{�\��?"S�m�����남|���b�;7�&�38G:T��Sf@�R+�Ro܌��p�>Fa�� H�4D�-ѫ#�I=�h�/�%>K$�k�ӜЉ����&�7��L��L2&�ؕ�[�G��z�1Z�?�T�8��b�D� H�w�|��9���'˸:�bM�r��j"zT#y�4)S5�)�p��|v��fKufc�In.�)e�-��o!q �98������n\~�D�N�>�y���;D�]�W����E�d�y���Mr!�����; Y۸딷Ӝ�������!�60��}4s�\�A�Ȁ�]���b�ə� �ѯ�ԥ:rs���z�]��)�ES�Cˤ�?��¶k**`0��\��ɛ��3N�(x�v4�ur�[N�����T[�bWC�f켱Sm[3QFA]���3��>p�P�44�(l6�s�o��2��_��)��<=�M(���+Xm+�曤jO��g�dP��O����øt�-ׇt�����]\�t��CYjeY���[|���Kvҟ�ؚ t,��Θ�D�G8)5��,br�x��m��z)Ez����&xƎ��K������sUK��y��$�* P9w�@���~�)�Z���*Z������Ů$�`ƛg����P�+�� B;{�|.e,0��Or�\1Q�-�E�yFR�X zp���rw+��Ѵ�(�����P�~"}�u�%%��;�e� l$�D��J�e��˜�WŌ^2g ���jjhݎ�Q���a��Z����T�U�����;X�↜C�әwʂg8�ޮ�;�ϔT��B�t��b>P ��p��K�Q������_�n�ǫd|�)Uj#�)N�~��}����D���I$��rN� �_��(0������j�&�T�g�\��8�| ��c�����3)��7=Wif#���5pV�I9�/�����/�K������ n �Ʃ�$��r��j�r$����C;:��_�%� �0�@U��m��@h��k"T�;U[�Y=w�Z�4��O*��BW�|�E$��:)zǪ��f��+1TT��A��L���,1 ��Tí<k��<�j�=������c�6Q U"��B��� Z�dv�X�.���f����u� �U✛h����O@�}�*�^�8��-��ʄ��h�(y�gdث�Z�İ�n�����S��g�=j�qx`[˝��RG�{*a%ސ�� x�Ad��zo�`�ՊD�\��j�k��d��[� ��2�c6'��ҩ� Z���Q��Czw�n��ӿ�ˤ�`���k�i�X�s�ksϔ���e2f9 AOJ��MY�=�P��~Jp$��5��,�T�<M��4C�\@����i�e�r����n��t`Vţͨ�#v�j�zDФ��54��u�z-)v>2�Yz[���s�V�,}��a�ԑ���h��z�z��u���ˬ�Gj�U/��bY�&� 3��O=�������HP8h7֛J�[h��9�b�"��2-0���*m8�]�b"�� �j���oR6$ =����b�![ݪ�[�u���F O���%�Gܕ:�����-��.��U��V� ��Q�K ��c��]�) �+.�����n�쓡/�_Y�"�v��UΞ�y5A,������]������<�#&��{~��G|�dL �DmP��I�OB]m�]:Q�O�+�?j� ���)���6I�瑛��W� �++ H-���g�K��6*0u�#���w,t�.�y��q�;Zl���3М��u�q���3�A'~�nez��+��T��)m� !)*�2{N��MIZ�D�~~s&���s������}��c���(���4�D�b��&�1�w:|�,f4�0(��wuL��"n��G��"��?��w��+��~Ƃ,1y�C��A �ky����=�.�l����n� �{�Z��*z�}�ʹ<Zߎ�ݕ he+����k3�^�;�V��B,�4(��I�[�|j}�c�7r�hoVI���c�HAϥbJ[!ݓ�a��+��e���{�+r� h���YG��e��d�!�K�������dTœ��3&�kg�o��<�<��MF��$w�]�t�y�!"l��t v�o��3y��+8�H�(�o��V�PD�~����g���~�4;H��x���{�pp�g����W�+��T�OV��t$��� ��l��xyi��`�H��;:A\�Ӊ��f@����l��W���� �����v7%@�W�*]�Jy����m�T����L�yd�ʤ���q�dQ�U282ӆ�i�Wi1�هoY(��(�����A��~8/���y�r�rV�n ��O0� 9��(U���s���lh#Ht�h�Q�+3�)��;�ϩ�x::�3둽<�����ӕ�.g`��g��8��8�}5=�} TFh<x��L���`�A���&����`����g��܍�����)F���9($;<Osͼ�ؽ�[��Y:]��l��w�}�n@a]d>p�q& ��� ��GwX�r9��#�[�tw��������je�'���?I��3�>��O��zd���<Lo���QP M�����3+$(O�;vD�ј�}��O����� [T�u����ۊc�Ȱ��4ڥn*�:Ͻb�}� ���ENo�?���;]|m�;!,��U!BS�7E�]c�iG�ە�s౬#+m{8�����ݚ�T��EkYƺ��
Behavioral task
behavioral1
Sample
136a188a29f1b9f0990a17b09db3d29e_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
136a188a29f1b9f0990a17b09db3d29e_JaffaCakes118
-
Size
1.0MB
-
MD5
136a188a29f1b9f0990a17b09db3d29e
-
SHA1
f61c9782c9a9c519554b5f97a37cf1f963a8be9a
-
SHA256
bbaa61fafc19ac910283251dbac80385dc3c5d82b6010f04342c13fd3a104119
-
SHA512
9bd8c54e6a6ece1c64c8edd97f2ebc766533c2c051fd6d91ad76648d5aaf4b6cc6e1d61c69b88ca8c17e0d57e40845432f28570a07f47d45958de4532aa26d0c
-
SSDEEP
24576:hJ3Qe1qY6X7BKs3YUzZinpNFD6z2s58vkKlftczPPFHWzcy6SX:hJ391qCAZi9D6z2I8sKts921
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 136a188a29f1b9f0990a17b09db3d29e_JaffaCakes118
Files
-
136a188a29f1b9f0990a17b09db3d29e_JaffaCakes118.exe windows:4 windows x86 arch:x86
38e728a3c45f1378f47932aa8b4fa045
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsBadReadPtr
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
iphlpapi
GetBestRoute
Exports
Exports
Sections
.text Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 905KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE