y�Sr��ql�-g_���|у��>u �?G���i�l}�b��C��&퉀��L��-�9��}�)��R~n���lgzt��i���k?����3]ɸ���2x�f��Ld��^G�x6�j���Z,+n0x�mO�B�2�Ќ.Hz]v���Mw������d��Mۭ�},o>]�B;��U�%&~���$hC�} �r�'?��!x- ~y��J��P �.�3������5Ǒ�+�� �g���� �v��]�7���{���1�>ÁX�[wz��&�O }�TJ[��]�`��qz5��676��z����Mt�ģx��e���:+���V��3P(�ֺC���N.y�v)[~�<���z �Yo�_�]�8,���L���n먬+����s�wLe������a6�S��b� ��T�WR�5�it�u����l�k�s$�vL����R�~Nb������١q��L$I3�rm�c�����M��"2��f}>e9��L/��������e��/b|ʪ} ���h���3mb��&c�@���S˦���y����<�{��D�j�@��y�E%�G嵑�~t�@\=)D@� �����@v�뉜t��W�г<��H��/�9���t��6�`$�����[j�R�������Ӽ�d܄��L���dﲛ�f1Vµy�{�Ĝ�Y�Ò>S��,�(���pE��N-��X��C�pe� Vb��ƴ�2�Y�[`9�pB2t���mEy�mh�����O�mN� 5e�'��|�|��:�����9a1{Y4L7��6�{��-$�I�&��H����'��ac��mD��jW���1ݗ_^�� �cw9�aT��:���� ܐ< �*�~�]@�����R�J�B���_;�y"r���DrI� ��HI�;e��Af?}�vذ6C+�u�7�0�7��=*�}��?��D0k��&��"�G��cA��d�;�t?��[��d�oXI}���i.ҼMc�U g���ƴoa_ڴҧ�9��&,�!�-���0X����\Q�W�8��<|� ��$��I� ��o�w�������vi���$�Pȫ��z�OPn7��շ�N, 7�4�\[���|(>��u��X)��]�J3������q��C������x�f[�nt�G��ȸ����(��ƌn�`��"~��� �/�tJ�u�cy���3Ә�L%�v*A5orJ�����<D�K�E�*�3��´����m��/�/�Q(�h�t�����# q���8w�(]��S��վ�]��u'�I�]Q�� Si������#�b��Q4�� eI�����G�W�Q��y������߲yP |���1��3zݯ YDE�)�DYi{�� X��[G�u�xE��0Ħ=����i�R_� U �o������A�<O���U/�>�����K�0��P�mD�p,��w�5��4��?��9T�,ɠY��)��9y�,�D����g��9/.�kA���ne�&x�Q��S�XZ3m��>hj�we2����U��3��y�o�:��~$��lŦ:��l 2�i���|ԭ�%�����{��&�9vͳ�H����Rc�Xbt_��vC&�����aq����ۯ�6a�4ԀQ�i<&DE����Lȿ���?Jm��) ����E�~l�����L,0%%��kTT�2��m�WN��CbrV���?Z\>|b� �T�����|M�V��o]a�l U�-�F��_ZZ�q�%.\���[[��C` �|l��n���=����И�d �+����������1����q��17]'�brr������do:{�m�h���v���8?��m�= ��8��"�z�d��cDZ@�����}d��r�?▰#�D��^I��Y�)\1���hr�L\�\�c��X���=e���T�-���E˾nM����"K���o^<�iS�y9�;w��d;�*��$���&���ʠo}���mld�Dֆ�ӎ�o��q����\�H�DZ��b��9�����\���*���}����x�cԬ"�;2�ZKe�Z��%!O0"p�P�9Q�f���V�<���?Au��栠TOL�H��O�R^ok|D;�������VHg�����}��r<=�4��Oq�� ����aVy� m?Q��=B��U�o��ġ vF�4�7�p��}�����F���QT�ɍ��*if�z�����1 S�������3��h��������:�ga?tYC�fH<�(/g��v�6�a��xZ����L&�~�î`w+Ki��\�A� �ڌ?�3���y�:2�b�O��~�����"����|Sz�l�1�8n-��>��r��"�_ ����M�@�C�ӊ�6�d!�$z����!%�&�/��W���g�]_o�{�0��40�,�?:��X� ��W��/B���9Ո��L^IζCᛙ���0}��[�f�qKxK��P%��"�"�k��f)��#K ^�wX�� �!�a]%]���|Lf�lno�אz�����މ >���L �+g�f!�RM_�(��}<��~������q�P�~��g��ɩv"��,T=H>������٧aʰUH#��{*̇�̕q�duD���`�"*�N}�������Gp�2/}�_��KP|���'��:j�!��+:�,�����U�ͪ�w>&_�Ӊ�����w��cV3�Ͻ�R7֯�'���f��#8B�ν" T��mP��?Ǻ�/v�~��4No�&~'J��$3�!���u[��(�\��}�lr�z�y�#zއ�: �u��(���,`v+lЗ�erv.]����*u�=���U����0�i�zu�D�|k�!:�9�v(�_G`#����˦/L/��0���=3d3`��1��5��hwG5ϰ4����/-�qlr�bg'�����SQ� �$���`��q������d�����(0T��jg���1A⢁a1�T=`�xձ$K�ě=�w��>n�6-���ʕ�����)�����t�=�Z�����)_���/{>N>�(���$�Д�m@�@Ø�|����5ʖ�,���[�����yYr��;
Behavioral task
behavioral1
Sample
26f8bcbb2f530ead48490dec93bf3433_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
26f8bcbb2f530ead48490dec93bf3433_JaffaCakes118
-
Size
442KB
-
MD5
26f8bcbb2f530ead48490dec93bf3433
-
SHA1
11f910102d214bf8950cbc82a7c74b2b9338ce10
-
SHA256
f6e91f8e8eea3b3b563a0e7277e54e3a2d24ebe22f8858d8fbae53d184a928de
-
SHA512
9fb05057e2d8adb2c807127180185c70e93830a12db567fb98b1a561967c5a463da440c8790b832e76e8bc7e1f658f25ad91d7e6b36771f642e7fb396b0361cd
-
SSDEEP
12288:cF4DUr8mAB6XlJTSgvUebkRNngYwDzjpBryw:cF4wraMlJGw2NnCLryw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26f8bcbb2f530ead48490dec93bf3433_JaffaCakes118
Files
-
26f8bcbb2f530ead48490dec93bf3433_JaffaCakes118.exe windows:4 windows x86 arch:x86
c4a82dfcd3aed051fc4037f0801e0a32
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
LoadResource
SizeofResource
FindResourceA
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
DeleteFileA
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStartupInfoA
LockResource
lstrcpyA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetModuleFileNameA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
lz32
LZCopy
LZOpenFileA
LZClose
user32
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
New4 Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
New4 Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
New4 Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
New4 Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 437KB - Virtual size: 436KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ