���i�e�\H*�� V�;���h��ݿ���舔W�Rr�F�4r�@i� �(e�4,Oh=9� !�)˭h��6�,�J�[�~�_PGwSY� ?p�(��͉h`�q-"}����G��P��ykH�F:�;��9���3������S9���a9W��t�s&4��Fw�g � t�ݯ#��]`r�M��_P(Ƨ ����ёoJͻ��Ř�2�⎣�Iב4T��t�a42���ra[lۧE(��1�W����k����r:O��m�"Rс .��q�v��#2�����$����*I�����+�C�)kw��>�V�����g��^�#4���ie��?A�p%���m�W0ڔ����>7mHB�5�3k���,�V]�R�F:�Q���#Iڡ��V��]w�$��g�T�%����Ѫ��<����E91$��dh����ŏ�_����7������f���$���c@�#W���.�ٕO0�I]S��嘥��Z����9��%�ѝ��q�b� ���y��}�l��zŅ��v m�+�������i>.#-�K^��r$�5�4�?�p�+��?����:}g�N�䉋#�q���Q� �N���*{�6ʫ��Q�����H ���U�~ε���b��N��Qh\�����V�B�5A�����{!*��F�Zq��w{���1pd�mh�����G��~9Or�lb)!�@j��V�� \��[�[\z#�*�������%4+7I��.w�%6*�y>w`�U��\q�Uwy��߹�g1�:51��jk��mu�ˢi���^�]���؋$Ϥ�h ���"��R�x֯Q[�P1����$�l1���/�/���EZ��@�ٰ�����=@`�ᱞ���`�6�'���ȭ����:;�(Z��W���Y��a�m�n:����9�d8�ֵ�F��4�@I�k��kCÁ 1]�:u�ބ��(x�d�l7��m(Ns;��X?ۂT�i�ǃ��Sɵ���^��qk`Pڜ�E�ɠ�r�V�St�Đq�D�-A����v�a~V�˳���9=G��y*���YFj�V~�*�,G�!3��{}ٹ���.�s�v)?��i&��"���+Ͷ��S-�"��N.�����_�����G ��1����k�z+� ��fN/���ul��` ���#yH�Ġ�g�S��y�%c�W�:B��t������L�証4tt�&�X�;XQ�E���/\ ��z��.� �� �-��9��C�V�J�^�cÞl��)��T���+� �,���Ka���NJY.�:��-�J���5W*yPX8-P�X�Ґ��&:��:B�#�1>��S���P.�jȲ'�����VY��ѩ�L^qX�E(<��1��<W��tQ�Q� ��ɱ��� T V�aS>5F�X�Z�^�E�u'n���3�Jv_��� ��2A�/�5���1�`�?�Ns�0��RG���i�]���*�S�~N���Nb�+����S>#3Y�2�e`[��Α'�w��40�#gA�-�����.D��}�C��17ك�4� �����]'|C#%()zs����x���9��W��+2,qm %�_(�!�"J6�"�ݓ���C��O��Vhaԟ�����\�lE�Al$��2b��ۈ:Ɖ��Q+"�@�{�Q���Re,�fxY�y�&�HQ|��}��r��*�+';�����p%����#�"�me�5߭,�"���/eu�n�����2��~�5����`eQ%8�m��j���@rOb�.�S|'.�ɞU8p'ԚR�d� ��O7�:7y��@���5�r��~��4f���.�K<��k2���Z�ͧ���t&�o��h�ӱ�Ri>C���SQ1�Rx�a���J� qT��ҞL2=c��� ��>�b_ s0�I�VdB{�֓rp��� ���2(���n���V�I��x��pM�s|f�+���dU� �=���̂u��i��l�Օ��źd�i�N o�i��2^������n��id N���)��/9\����K 0��i\N���F �t���NL��y��|:���Q͞И��a�pcm������:�)�B��x��֦��% 6�VPף���m�t� u��6Ծ`;����� ��!��;Կ���4FS~�a�0J�|��{���˼e�b���9R%�����L� r� � 0�k�+\����s�Z�)b���6�Z!]߿Q�ݙ%ى)�+�}>�,L4sp�����D:l�g#e�������f����=JĀ�n>��8����M�����⚯[��| �_rhW ��ʸ&76��+@"+�n�fJpl���h�J�����%���+�Dή�6em*dS}��� �8�5�f��~GmE�d����L��b��4#]�},� ��V-�$}-n���0��Ѫ��k�F!vi��#�+�+ch �Ggs���D� R�EB%�$�\==NF��촶��n��?�ssf�<������iW|'@��Yw<X,����]��Z�֬"��(���j�^h�rb��Re���ϓ�P�=��-)=*N����锪�Aݞ�C���;��غlG� |Xn�p����U�O�ۡ�v\�ta�ς߉�<�R��>�����d����Z8�M��G��k�<��Z�3��Fap{��� ��@�w���=M��䬩��5 iuq�fy��T�Q���T6���1�Vr�����~�Ì�SA�g�0b��� ���R�q��Vmg_�Ku�˲~� �~j6Mˎ����ϯ�&�n$����Fڥ��x �21�:g�jt���k�d���|2��\|�zʨ��ƌ&gk�<�,�t p����� �&����z���8�4�1�O2Q�Q���i�X�����_ 3��C��b?����tEQk�����J��I�������N�`�Ń �I4��s���u��R�m%O-�s+�_|}��Ɛ�u�L5�<@�q�����u"�M��gp�����.)��N�ek�5����Cz�Ј��NX���Co ��BJ�,(JPO�%�P+9�Ok���Fd��ZU0�A�yRtȗ���r�0gͷE��EXb
Behavioral task
behavioral1
Sample
3f97adb68cd19f188b3a6e36d95bc0a3_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3f97adb68cd19f188b3a6e36d95bc0a3_JaffaCakes118
-
Size
100KB
-
MD5
3f97adb68cd19f188b3a6e36d95bc0a3
-
SHA1
5cd377055f67ecaf43facaa61757e95a32925924
-
SHA256
9d2330f435a0af4294ac6cacee2d51dd62709fd67a6a24a8658af1c388a4448b
-
SHA512
43d8f823239521dd7e732c19529b37a8825da0e85cf09e64f7171101752cc4cdef2510eda75563a0b6ebcb92a0f7be451870c43cd21c946b79419265584b0a2b
-
SSDEEP
3072:NV/DT4iuOb4DymLuF9coARqkKW1C1D50Z+4EA+OcxT3x0:NVXV5VmaPc7qKA0Z+A+/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f97adb68cd19f188b3a6e36d95bc0a3_JaffaCakes118
Files
-
3f97adb68cd19f188b3a6e36d95bc0a3_JaffaCakes118.exe windows:4 windows x86 arch:x86
2dad8dcc7e67aa4818744dc883db5fd8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
FreeLibrary
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE