��]��>����k�r���%yԫ�%y� #�C�+30��3���p������[X"�6�~˺D�!m�Ґ�uθU�#�������9ry��b���;TB)��G��H�-�vGRK�R{SɌM@��e�1���JM�9���,�ӆ���r�+��d��R�E�C�N�D�):~ϖL}{�L�� 9��zOC�) ��Ƥ�o�X��0�>I�DMz���� �@� �_�B���b[H�Ϯ�bjB�C�Y�����4g�6x&��������F�'�76����R� ����z��3 ��.���#*��0��.a��������s�x�!m�Si�� eȲ)"}̏�����i-4_3�y�K�u�]~v�Gxz}}2{��L���8o 21�������%�Y�_{���}k�lK�a�S�$���J������pL@����}���^���%��aJ�k2L䈢�Ӛa���qȜ�t�p.5�`W8��NR����Om�W��l�k�}��Z��O�_L��$h��ϋm!�7����M{Bm�a���?xn��Ea��u��Wj�a�#��g8���o���N4����qc#c6�r�ޡb'���������wt��`�^02�IݶT K��K����b;�fP��Q3� ��E1R�e\�o�q��n��h�\WvT��s.jd���u���u1��I����Q��i���w<O���_�� \7�TD��k:�GS����.Ѱ�����D6���i ^������(:������hf��^ 7���i6y46C&�;#�~�w�&�-IKef�V���%Wۨc�PN���i!��H�c�D�.$�:��A���{s�V�@��Y���`(K�d�N����SwHj�Q�������ޘ�P�Ly)�I�Dbʹ�b���c$3\���ha�BV�c ��w�=j��p}w���m�� ֿ��$)e�eQ��L�|L�5�����\S����,��!�ˉմ�A���Dd�"`��A�ꏣ�FAӨ��c.$y�,"*7���<A�p�խۋ�X�`��I��|��J����ê��� ���*�����v��n������k�^�x4�p�%����\3�b���`�����1m�����A ��w��]�h�L�}ME?��&�{�UL9����i����՟��@�)�����:��f��w���K��Uz/ h�F���U�Uu籀A}v%�{5���p��ʛ7���.�C' ��Bӵ&�$�|��9L����j��p�^�p��{L����(_�8R����f0X����=�J�gJ ��;�2P��}��R����N��ڦh�%$�\��>�G'�ڙ犒 yk�[���=����sj)�I�w�8��x�Ӏ���oS�,���e�2���,9b�T��uV���q&w%�F��������Ƹ�����"�����V�������� �n�����Ϛ�2�}�M�ѕ������,�5c�ұ��'��)j�;�.����ұ=CK�I�T�ei�v��Z�w6-$�6K�@�����7�D�0Iuh���Y6���Տ�c3���M'�o�t1Tw+�4�v#���CM� �nG�=V4ڙ���r���:dc�B��:���"���һ �TC�1�c@�p .K���t��ެ���ӑr��P�8����;A�O3��H�����r������EV� �>�r���9mcG�b�t�J�ᠾ&E�Bi�|��_-��%y������������VzV��Я��n^���d�Yy��D���7C���|iߺ��(Ĭ-��]ay�����d���EV���4[�\�7��2�Z�t6ɂ7ϾK�V�~��_UXT���/ko�.� �����f���$ў�ڞp�vx���X~;�2�/�6�m�������N�yأ��S�u.�f�ކ�{�"uㆁ�9<B��7�r�@b��~@����x߷� �����oIT�_��_5[+D��>g�|+���jtx{�nf�>A$�X@V��/��û9�ھ<���� ��˗q*XH���*��V�b�d'�J�x�E�wv��f��qh7jC����s�f�v��y�\r���Vb���ߖ9���E�[�<Ϭ.4^7t[o�Կa���ݍ���(�l X5����N h���Z��c����DʳB ��\c(�fgWh�<CZ��DL�1Q �:K��*�{ܪ���F3"��q�>�L������r����{?-�rD�����ZYU��U/0��� q�^���=���a[�'C����U�������;Z$g����,$�dl��HT��I{��R��YB|��Wz�硖���� �J\ig%t �6�w_��ҀX���2��Λ����3�`Zi=��~�M��-j��p�R�K���q��HK�,�YW;������8b'"�������2�~�d}�⮲rA�%8-/� �?t����z#`}�`SQ�{ry�28��X�Q������~�b�@�������k��9i�3���� �6d�����G'�D�Z W���D�s쬡*oX� n�w�g��E�_7�Fv�fiRAFu__��2 S !z�Ҷ�5��"�+n�J��N3��Ju\�����Fd�G�yBJY!d�X�)-}I�Uk�����K%�L��<X�v��iw�vH7~28��4��� r�x����#�A��R� �.�%�|K�=�O�����s�v�u�H��]e��U+I�^��陵;���N���G�+��R�m�Ciud+c6>�F(���j�P>W�5����)R��GS0A�UT��g���߸�͌ �6�k �F�� z�8�B�d�p>_t>P�B||��%"�;j����i�c�9)��:�b.���-����q�b}@��,�k1�(2�k#�t3S/�C��}���;� �y�P���i�V̌&�f��o��m���Y!I�������Fk:>O`� !Y��� eFHL��Q��TQH�o��3�4Й�qs�tE��Z�K'������;hl�j��,�V���); "� �C1��� �^w��u �q�knE��c�K��� �(�` ���R�s����ԛ�� k�Wl�����¨�Ɔ�[?�0l���>Q�
Behavioral task
behavioral1
Sample
5562b76ca6879ea648a4d4cf277bb8c9_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
5562b76ca6879ea648a4d4cf277bb8c9_JaffaCakes118
-
Size
128KB
-
MD5
5562b76ca6879ea648a4d4cf277bb8c9
-
SHA1
e0c2486817e5823ff3453c171e18f8e72a25c05f
-
SHA256
6d97eb05963c093380595b2a5017b35e53102ded75fb012a0ceafb260ba107c7
-
SHA512
d8cffa220732d57b52d65c34415a92aa5183b7d7f7027d0d8af7e42334acc59e5135cbbad08895c90d8a925ee2ffaf85fa75979873d8e95ec92b9d4e2881dc54
-
SSDEEP
3072:1qR1Rw8acK+lNSbpW6eTGHf1qxQTQ2VRRMZxa:14a3+l8tWW/1QZ2VRRM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5562b76ca6879ea648a4d4cf277bb8c9_JaffaCakes118
Files
-
5562b76ca6879ea648a4d4cf277bb8c9_JaffaCakes118.exe windows:4 windows x86 arch:x86
d24669cc89e054bf8e58f33ab2990870
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
__getmainargs
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ