g�J��k5މy�ҏ���y�i/┇A8������T�+�E������Zº:s]���1���R�vӋ�ߊ��O,w՚��v�i���ڱB?��xa���^�,��n�@�1�M^��3��@Cd�6�g�|�r��d5ߍE<G\�W{"�Fs��9��C�B7��TS��l��@�6��@�� ��J��b��0cE�X�,u��XP���9��K�$ʸ��%�'��Y���?��n4��x�\ s��=T65���5�K�����I��8��ν��Ũ��܋�?�x?���}q�=˔�9ɓ:�l��k�L_h��Q|��Lߘ���/33����N��K.X��������ȏ�:&*��p�Z�u5A� z/�+<~�n@Akf3�w�m�a쌮P�J�� �~�c�*dMA�u�V���=�+�;��\ؿ����D�5ɥ aþ>$0�c/F��+�lW�/��Gh��(�t��ϲ�c/�0�h������_��Z��k*�\ ���wW���w��*2�z)+!l�Mf4㇃9|=�l���VYX�Jp��"c��դO^���1��+r�O��'f93ޓ��$���ٵ~x+�����E �����4�/����Si�y5�����2 ��0�:���E %����N[��V�4��L)X��T��`���- ��ޓ�9�&�Y���T|��S��K��B,� Č~�m���LJ�Cf�1�����bc�q��E�X�,�/�a�j���0B�t�,H�E����+oaΟO�\��9k��C��r2Pm"��˲��N������d�т($A�����7���p.C��xo�>��.S�6���5]mve���$)/��:~m��7nV�w�� dd"��a��KY�N "��>��ˆ6��k�FGiU����s?&j����n;q���P/��FgTL�пc*�xu�;wP]�f~$�+۫��Q�Qq���t�297��g�S2_`{�cDF�O���ĵ�_1ݕ����eT^f�{��)�i\y�i�=4�}=s�]!ts5�損O�[N�50�4cg5,wf,��`�����šO�\��]FT-P���D� �:��;xE��T:�ΤG���~.��%,�;� l(U�m=�����0h�͛��3L���^&�@���)��z�|'���;�� �ڽ? �Gq����m�t2�Z���+���K����R�gi�O�ueD3@TŜ'˼��p��Y�3��{ɖSK�Ըݽ~�D���*s��Ƨ�Ց��%�pÁ�1�U�S{�k� �2����Aq3d��������@�Melu#1mH�E�x�01���Sn%E�`�k��9H6�+}�Z�+'��i?����}Њ����ؿ �5@*e�:eϚ=�5{RaN�qG;c�����:ɢ]]�P~y����w�Ec�F�����|CoY(�5Oz'ko�\�"^h&�)��.3�����dž��J}��>����\N��[�ѽ�P�f;Pj�Y� �1�Zp�:�ٹ��*I��ݲ����5E�gY 1���*&�:��p��l���������ykT�}gv��d��b b?Xw2�z�&�?�j�k�DVi� %�&���6y��W���=)��1ղno�� *�G$L�h��P��ր�Q\إаޥ1�+=!��P���Je�,��� ��.���}�^���nߨr���î����?X/yh�t��T�9�nЫ>Ñ�I$�u1c��������&n9��t���)M���"��?�ͽI��E"��}����V�!�TW�ߙE�rot�K���kcz)6�R��A�J�!B"?)�Q��h.��<(�mT���z*�}B�d�ʆ�+ �q�S �W��q\1�U,�Ȁ��u���F��(���!�<���L� �GAn=�><j���ٔ�`y���,w4���(�7���:�+������X̻�`YJЭA0)���e�:� qDq]uL�&XXW���K�����{SQ1�u���L��fg�t��i�e��̥��h�"��ޒ��7�*V���A�i�@�Tf� ]iTQ�\����/s�(�Y��fB����-x�[E�Mb�+����Pb���/�qk��z����q7���y�6����͋%�h��1����uW��fw7� -S�f(�� ܻ��e�Z� !e� ��M_xͷΎ��ЪqA�����\u���e�ŌCzD�5��$bfw�FM�r +I�$U�I��B8������I%�V��� �`!d�+v=� G쇠{,Hη:^��x���RT�i�D�<���؇ YG?z>��Qi0���̼�l�� t��eĤ� ��rk:��Թ43��Fq��b�)e��i0�36"�cC(��ч^O�ߗ� ��;5�d��V��X�w�e�L�U �x�D����@��G.�$iJ��H��n��f�0)'�-Jy���|G7RJ�CuP!9P�ͺ��pʁ��mºOt���&s.&ջp\>:�@ ٺb� �ߴ�K� w`D�{���!�O9I�dz�B�t?�c@*�B.�z,ȡ�T�G�$�E�x���-����^I�X�̳b8�$�g�����fMޒ��"h�qp��A�1�ro0���F��!�$��]���s�Ӝ$~�sEm��s��Ua���?d&m^W�'t�MbAz�H�4ݎҩ}h�����T�H������nY�&8�l-9�k�>��!�k�/1����]ڎ8�?;�r�l�ks�����S̮� t����/6��p*���7���`Vkw�Z(�Bz+���:RR�� ��3���F����qkd�9�bt�]x��� w!+��ӥ���.�� nOG�S�$-N�م�.,-ʥ"&{�'�*&iEt�<5��dn��xJ�*�@ ����E�9�����M��j�wqr�8����WCDc�!��Ff���2jܕG� �����>7��_�3D5 Z�ԗ�o��.kz=#��� ���P� 3��r��X("mKu(��b檄9Gt��B��9ӯ2_3,��t�U9cӄ�YU���qu d� �z�C^�I��y��>�OVSq�U�%��ryd�����v���G3�R �y�l����
Behavioral task
behavioral1
Sample
30663c3e0e1a5694aad9f07bead1c2fb_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
30663c3e0e1a5694aad9f07bead1c2fb_JaffaCakes118
-
Size
132KB
-
MD5
30663c3e0e1a5694aad9f07bead1c2fb
-
SHA1
bb6181029de9ad045ce287d779d614b3ed94c846
-
SHA256
e9fc999c5f3f3e3624596d7ad2812340cc1620f7edf73f129a952cc2808f8d19
-
SHA512
27e46779cc866c5b2dcce699f5074c0945600f704aa4fc3843d5853fc64d53e0f0677b4fe36b0bd928b73eb3a5d5ca69556500b7d43e325f02d20504c9133f8a
-
SSDEEP
3072:KfXmOWXBwFIOqrkSAWOUkX0sER7fiH0nHaW8e5jlENAmHQvNReal+:K/OXBwFIOqQIkXsJXHUM5En2NReT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30663c3e0e1a5694aad9f07bead1c2fb_JaffaCakes118
Files
-
30663c3e0e1a5694aad9f07bead1c2fb_JaffaCakes118.exe windows:4 windows x86 arch:x86
67ac417eb2c7047f85b8f6f2696e1dfa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
MessageBoxA
comdlg32
GetFileTitleA
advapi32
OpenSCManagerA
shell32
ShellExecuteExA
mfc42
ord561
msvcrt
_except_handler3
urlmon
URLDownloadToFileA
msvcp60
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 116KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ