fAL�{����p&��)���ʔԅ]��-�J��c�s�7>��*���w�J9MR��o!�A��<]��H`L�@�zYZ��iP'd�G���Q_ks�<I5��� sT��Csj0��\3\����K��� ��-�� +3�§�`x�|�|�}���~�~��h ����c�@�:�����+?��?2��l����Q$� ��[.j�?��_�����1��'��e���ۏ�!�S�NЏh�x5Nǿ��Հ`~\��ĮV��&��<F�I�����-~R�]��2B��B�6�R���PuW��jq�1�K��D��F��X6�p�����okr���,F����l)w�Ƭ��O�2δIǒS�=�F��,��1+ֲZ�oFuxV�������߰�[%g�7P�P���C�� ���r7҇�����܄�Z}O�f8Z{�T���X�O�'�L��/f�=���*j6hvukL6˓z�r}��H�LlnLߵ�Zh���K�������/t�����@@�����E���<9.V�Z'y"x ����1gMHUu�T�~┣��K,mw�R(Ė��j*;����kG���JD��g���;u{��![�`fc�w��wi���8ilJ��l]X�ํᩇGM�N8;������W���ܮU�.�Ǭm�P�Q��.�S�#E��V�揋�vԁц���A�P�}Y�k��>�����<)��p1H��=� -P �;dC�:�R��R��ۍ0V�ϯ�z��4v�����"�@�߿l ��������E����sV����ɞ��3S�P���O�d�h<&�5���b����I -���y|'`^yɳ�ā���M�BY��ì����.�9���q*��R�Cd�z2�ӝ>ݲE���3W-�1�9p$��ڨ7)����/�'=��ZW ��4E�[ ҄ ��49�T�yM�-{�� �6׆q(�}i�μ��_��a�hZ�FM±]iXp��p���u�u��l�� b�'��S�Էx�����l�B<q�@<� �$��x��M��>��fc���[�wM��$���UP��kA�8�q�W$�����3:�7s��){����T y���K<سR+5VWZ��p ���H���96rƽ~���r�j]-/Z�|@�����0j 4���z���*(&[1�����bgu[���Hn/��!"�`v ��U�g8���__�Բ�OHн��j�����������妎Fv���;�5�;�N�ҏ�B;KR^�>LŠjtO��7���C~L�Si���\��`P��o��}�(\���u?ʠ�mܼ"�&J���)��:�^,�79ԇ�}Ѹ����0����p��˦I��<g� G��a�(���:���V����{K�"qE���h��'��4�t\���I���}��nz���+�a��KΧW��r+G�q�:ˍ����{Jj�w��Nڿ��[L�^r/[�� �O>��p�&0��,f u��&YĺO ��^����~�z�1 ��;� y?��Kd�T�KoiC`⍗�f�:J��� ���x}q^;���1�W�u(c�����ё�������&Pj�Kf�С���hW�Q�TAL+���0)���� ���ל|1 >&^����y1�ն�ᐞ?��&8�4�V���ԃ�})5��d��v�nPd\R���^9έ��S0)�w�Y�)�bgQL�{!t�E��j9�lc��:|�A^ X`[+�Y�*ܐ���v?���'ۃ�Z���rw�I�,�����$ÿ�Eɖ��@�{�x��Q4�4�$��e��� m�1���_]�i��rN~�����Pw�c�� <�n4[�Ċ�_IG�-d*�Qm5]#��������,=,���E$Z^ ��Hy�����e�A�g4�ۚ\`3� *.���ok*F/� ���m������r�^����@�N�}�N�@�}�Q>�`��k���w!���_&��"���a-+�zYQn�l �]^�܁��^��@I?�Z���s���@,̻Sk�VK�k���*���ޘ���ݸ��R��|���p&��Qr���i��Q�+҆��%�`�͚�O Mv0w����Z�nXt#\�?zf�J�݉/y��D��+� *�4��_���D�F�_����{�D��(eVs�,k���\�{���')�L�4{�`&h��-!(�t�����/��w����C�gѸY��<�����^L�z\��h��1������Kle2c�$���k�$�~�\ O ���o��c�������m�U���$�:}�j&|��Of�("Þ���O�0�;������z ����!�@���� �k�v)�.�N'O����c�k��v7�N�vMg@���t��\a��F���A�f,FKb�e��f�mˍ/|6�c��`G�̨������1^#x���=@vI�e��UR,d��'������ z�`e���$���d����M�����sB����k8�KҚhNm:�ق��o�u�������pRI(��3�&�~�:��³�h߅5����P��E��D>B���9��04��4.Q6�(�go)�����ly`Cu��R�X��m@�}t��='��aڛ���E=9f S��U�jȮ��u�TZ��p�����sGĩ�44�����aۺW���T�l������)25Y�e"�����?���:1ٱ�*17�1v�bJ`��_� P?t[=s" M���_?B;��8����'���Ь/�,�ڋ�\|��l��q�`"���TR��Zx$�L��-a�"!6���c���Dk�}O����_܋̏���ZZ��4M�kTD�Ar��v��F��9Bq��f/s{���4V������YN�&O�f5��o�g�6���l������{�OW��i�O��� 6@G5���mOȤz�� ���厉����u���#��aBY��X���������Z�V�cL&�!(�w����$��J:s����I|<HM�<?`�o5s�Pa�O\���̥_:|\�����M)�H�.~�'$@�gn.A#AT��!��
Behavioral task
behavioral1
Sample
3b98d38042c9b95bfd6d860a2990f2ee_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3b98d38042c9b95bfd6d860a2990f2ee_JaffaCakes118
-
Size
294KB
-
MD5
3b98d38042c9b95bfd6d860a2990f2ee
-
SHA1
30e101b5927f5b588873d8847d2626f2c1924d00
-
SHA256
a044074dd0e6a3b8d919c20b0c6d0fbb1fd10977efc6ca2625daaedb535c6b04
-
SHA512
fb0f4603e85c9774f501c5c1e1bf5f114347c3638de1c57e007ca60e16948b26b7e8bfa5203a0df519b05fa456b17f60a8cddb5183ba87d1a91d6db2ae0cca9f
-
SSDEEP
6144:ixUcorwl/H+ytdSqWkpv0ddU3ntkZNn8tW5NMHW7ZQfwKUV1lzU:ncvntmkZad8ntkZNn8yMo2wHl
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b98d38042c9b95bfd6d860a2990f2ee_JaffaCakes118
Files
-
3b98d38042c9b95bfd6d860a2990f2ee_JaffaCakes118.exe windows:4 windows x86 arch:x86
dfa753bd61722f30018f3af9fa7f3c5c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm50
_CIcos
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 688KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 289KB - Virtual size: 288KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ