�����B���"�A@ 6�CO�־��F&�#��U� 4�_Hg�~2$��O^ѐ�g��eB<{г:�dF{��·��0w����HT �Fi� �Z��EV�\�w����h���H!;�c��ɉ����G� ���CJ6|NU^�8�4�������K�S�ZY^��?7^:��bMơ�9��n��Y����0��vu�d�ԣ��p��i���J� &C5�w2�����j :ٚ�����TV.�V�v�gY\p���ZJ��}G?���;b�:@��{���P9���u��~���������2B�p���>�]@1�)HҧG.T�Y:I�K&k!_�Z� U��c�#�ėۊ���t�&������2�T(��$���`M��4W�K��>Tj�*�@Mm8RDМ�'�)�zLڣ���鶶���{%'���X� f�ݿ�d*͉�,V��s�v ��K�K$G��X�"��+��:!�=()���>��{�������>5������6P��"T\ ��u,�4r�P���O�m��OA����!C� 8���D�DŽ�o����3hPG�6�T9ulSR·�L�ަ?��5!�`g'^�q��[��;{� ����{��32�V�����5iX�qN]OD��M��D���@;N:�`�?\�G��6�u����.+|6����,zԯ�YC���h����J���ClIi��{'U�PȚs��a�VôF��b=V�aĄGb_$�G��?��ys�lnR�Le|�������� Ug=G3� z>M����Е��&�N��{F���"���0Q0`L�\��������Qr5�.�Я�k��m~�+�G��38�q1�\e��r��UAMũ21���J����',�/���2�����FѲs��˅�>���[��AVh����F���W%�7�J��f���ץC�e���{BljJ������1'8O~�4,ϕ\]��s���IZ,���O�UzԍuO��$�A�/O�Nj���Ŵ�r�� U�ٸo��1~��f$��k��z�=0����j�x�N�*T&�C�M�Ȑ�v�n��;o��A�2US1�"��Ա�Ӄ���U$�k\�z}r����yυІ�f�{r������D�h5>d����ã��B��z2���GÛ8Y��ݿ�t�$����U@�E�/7���X��XEb4��>�R���<���<S�Aڃ��L ��A�W5cY��D9T���k��(�Ϟk���g� ��ӄZ���.��׀���"f�yj��x��錺mpـ��� &�h0�B��gvW����a��;e��Y��@VR���'�M�:���D0��@��!�f���M�'��'~��B������g������a"5AE�0�N�x�VoS�O�r2R���&{X�@Hl���bW9؝�v�ؤ����S� ��)���������:��Re���<PeƏK�����!�j\��yh! :�����Bٿc��EoqKL�C>��J��q��C���M(Q��t��[��6ꬉ�(Pu)������8N��|z�K��4�?/�u�TZp�Ψ���1�BN�K�D%���x�]�i��ު��]QD[�O+����~�oق �$]�h�a#�� �[�/(�צ��� &t=A5�ZiX�4S�9 &�7���{R�e2�U&2�� .7����LJ� ��k����>8����N�{��������x�@+��W� � �Z��VP��5(�����0.u������{M��Gj�}ۨ�Z8�i�ls2����-��8vh:TO��MK��e�����8��9d9<m|����@cB���f�Hy�O�A���#��2K�P��+�hSg �״�=;/VdR�φs�=e��_�+�&�t�Q|�b���o���p@ ������"杼X��b�b��,����OO̹�fWB�Ļ���W͢�V�V��&�r�R.G���S4�ޜ����P�s�������ҏH=U)�lXA0����9���:�*�j��A��z#�Gt2b0 e�C걈�< �#�s8QM��t�9��1��l�Ks��b��J4a��'�-��ks�u������!L�H�CtO �rO]eh��>���c��(:�߿=V�p�A����4F��u6E���H�}J���mi�~Ĕ�ەj:�U��]wBR>Jub��2�Ė� �F2��4��r�=;!R�(ă�C�w�v��y��F�E����QEg,���f�#d��E�$�PT�$��-�F:�vJ�W��@ -3:C"�Bծ֔��Ŋ�z��f���T���įn/,*�_Y��J�w�S{��������>�ض���ի便 >�>�W��R؛Q���9�T�ȏ�]�p��ٖwI�L�"de_���50�x��P�w�u����'��*@�3�$��F,���*�Dv����h���Pd��zB�˃R�s�FH0�F�<E��!����Ws��������/Z���nn|2�¾�ci>�0u�a��Jŧ�'rX.��v�{�WR�����β����Quw��#єF^гqhI6��]g�}�z��(�@O��y~��E�u,�vK�ePr.�!j(����D�I��/�&�Ċ槗��"��h�>����u}:���RN����Ӭ�8]���A%� ��b�`��ٲ��6#����ܺ��Ѷ�@��� �/��An�|SY䏔���j��<��ߵ`I�m��,�/ h(�R��l��VoՌ&�q��H#H3H�yV�^ԜW&q�����7f/,1��:���4�"ٞ�̼�sN��k�$�<�6pե����>�iM)����� � 9v���M�kPI��Rsp����CE�= ����F2�+�X`\?�������c�|�����1����L�8�}�5���������!�<u9Cx�=�ɲZJ.9�]z�(�Jq+.| /�7I #�^���>��vn��H��Ͽ��2d�žD��SY[*���i�>�M��L�V��d;ݼJ�aQ,2������=�\9s]���Ozj����Zn9)b��S���<;`�$�=�� 1^�h'�jf|\�����x
Behavioral task
behavioral1
Sample
2c940fb683a26247bb63e331802e74b4_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
2c940fb683a26247bb63e331802e74b4_JaffaCakes118
-
Size
208KB
-
MD5
2c940fb683a26247bb63e331802e74b4
-
SHA1
bf873a8319a7a8a29608172335c3a7c3b15784e2
-
SHA256
ad6597ea24b999bec0399b255ce03665076cf804773791232ce097536c8c6cd6
-
SHA512
633ddec01b5852decd7c8a18081498d9156cd105f7568070242238b1eec08f20e59b77c1d73b974b9ad682e2c8634fbf027a266e47bb1f6adafeb0079c377e54
-
SSDEEP
3072:cxr+9QF9dKqpGfeMNqfGQizdEgi2QwiQ6Zm2nRc039MAftb3zDk1HjcsoZPRVoVU:3e90IKVVQYEgi2fiLEl0tMAVQt0NR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c940fb683a26247bb63e331802e74b4_JaffaCakes118
Files
-
2c940fb683a26247bb63e331802e74b4_JaffaCakes118.exe windows:4 windows x86 arch:x86
b86ced8451e541c2dfe05acf9405371b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExitProc
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 192KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE