#���nİ,�+��<�W(�2#�#��������U���zq7��ͯ@h�ւ�/%�Vx-��&���p��^������b�ŜMa�ü[}k(>��ҩ���cD$FË%��wQe��O����O`|�n "��L� ۥ�^�⾦IWa��(�b��U-�L� �������o���e�Ҙ�2*���m:m�A����k%�<|*tt��-�����x$B!}۔>[\�9�] ײB���8����Z�rp�V$g�b3�!�#��Xɻvp�ݏ�j#�7�~����2 &3��z(�] �ʗKRR����φr� ���g�T�r�?���4H[E�!CY�VM0�A�|P��q"p*!���t�\i�5Ui�_����x['�.�v �~�`��5����R{�)C�yY��1��hv�b͈"(�0<� ����PF���p�h�x�D���:㉟���a���x��,w0 {i 8Pnݷ�CXz D}HY����L5�p统g�x�-#P���*?�a�g"2�j ��;�l���F�D��kǮ��y��A��^�?�4'd����=Mf<��)cw~�����j}4?��pV��s$(�g+H� �ѧ�fNPS�'��6Թ�]7 ���`�u8>ZzRy�jS�F�*�6>y������)d2�`z�`='E��9k��G$;_̿��b`l�Z�-��c�B`��&h�cݽ����&�.'���O���6L6�w��BS]��kF��������$�j+τc��Z��_����;�C�@M��h��X��5�s�K�z��B����#�0� ö;u��N������(���fI�:��(�)kM�J��c/�X(��A=��*���<"\��?e��(�qks�0����j� N�.�����NCa���@�/W������x�b-"�7F�Q�ȴq%W�+'a�����|�T���R�r�����j3E ��\z�`�j��$�>�Τ^+Mb��T��Qң b����h�1�)���0ճ_�`kJ�n�����X�J��{�p�H��E�a�~�Ȩw$x���K���j5s�x&�)����(E�B�(9�FBM�P��?����������k����z�3�8�U^���މ�_wx@���s0[o�^��+..ݽ��Z��( �����R_�om�� Ru���U�`7 �$+1���YW��q�3�8*g���q���Pr�m������!� )���?zZQ���Km�=�5�y�V!���hP��ԇ� X�KEǕf�1P�N�ù �Hi�cUm��V��Ė�K�����X'h�E�����@��������R��؛K���-A�gK�����������W�r�^�8������C��<.۴����Wj���ٓ�] ���C���묪�vK3�vH�����a�md��^]�K�t�>o�X��L}i�\��o� dž�_1��D�2���K:Ԑ2c��wbC���ƞȘ���-��OAMR+���q�����'�6_�GNh��^ϼ�-C�����)��ι�O���5�i�.�v���4�G/�!�����VȈ&���{��������l��K՚�]��-:��8B2����p��?��G���w?��9�;;?t�d�>4����������.ƪC�FA���(�| Eٝ��) ��f]� &|(��+��n�i�Y��q7��r+v3҆d�ɏA�n}����M8bY�Y��}h�6�eh�WX��5�HKvsN�2Iu��V���ݓ�X�_����|�� �����-6���]��T����J���!F�ɇ*��8��%"�/z��2��r�16jdc F�����\��p��Ps.���D������-��|~��)b\*���l4��Cw�������MC�iƢ��lL�L�VO������~�{U�d&i��eP������X\_1����VZ��N ƃ\���x�y�%y��s|&���@jϤ��z�:����g�&8Y���OB|���?��Y ���=D2���q�����y�M)�I�h�~������p}@����&�M�~�r��]�2���2_z�^�����JD��A��-�Zk���1% baWe����������"���� U�D_�/��d'}�&�C�s{���lኩ���?���c��R�:'N�yE��n��N��~�"��+�������9B���˸PJ�n�rJ� �Fg�a�%�� lي:J�*|J3��� E� �K�,2Fd#<��5�>��zZo��h�E2Y4��q�l4�u ��5���{fz���h�\�OT����^�8o�!�vh���eۏ�Z,s��P��A������� � X �8�|`p��j���bt�</��'�zȓ��>�/�/���"�M��#{�p�lu����(0A.�O&����nis �|�ί&"�5K�A$*8��e�a��$%�f^C�8�$L´��w������%#�P\�Bj���/O�q&�\�c����!��<Z�ҏ�A�?H5tj��2|hMK�\8r8|j�e [4T�Z��5����*�$"%����a�/��&�C���~���D���9�f�1s� Oʋ�%���E7�S�� ���a}ņ����:�E��<Ud<��f��l���2\���/}0T���D�$1:J��rXn�����L���a�#l�<~���t͎' 8���>qpa�,uZ[H����_�����P�xި�R��X��F������R+���S;�No���n5��!nB�P��9f�T2He�v���qş����ۇ7x����[Vnʘ���m�)>�N �����\o��"��#��U��7gk�Q�>^�r�P��#%�����L�_Yا�|$�O4��41*E8gijbO� ��ڑ2;��D�(Ў�O��F-���!V彐Ŀ>�ÝD;}�R�����^/�_R)� >���:��U���ߏK�:����:��A���2^�H��� &��u�)���۱�iwq)��c��Ѥʍ7���^��;}� ��H1Jj�r��HjLx%����[�[���٫틙m�(��Sm1=~P�VQѼ���
Behavioral task
behavioral1
Sample
1a8c4d88c4fa380ff11f201f8ceb976b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1a8c4d88c4fa380ff11f201f8ceb976b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1a8c4d88c4fa380ff11f201f8ceb976b_JaffaCakes118
-
Size
85KB
-
MD5
1a8c4d88c4fa380ff11f201f8ceb976b
-
SHA1
f41a3ae18c30aaf2724d6b71702ec3927464e6c3
-
SHA256
6e9834a7440cb1a6b2b1ee6bb57b3b396079f81839c689c0c4a065f12eea6869
-
SHA512
33295b759344db2b1e6fb342d1da01172cc252f4097f63e6ae9fc76e30e0a2ec91375318293ffca4e8b928ea0f76ca78d82bca6a3894e8ce918893f535e65ae3
-
SSDEEP
1536:tzTV8ja1LqV51oLUQutfTKR/kCRu2Afl89t4+7o7GT8ER27xXWuTDPZp0a1FcJqT:tvV8ja1+ZoLUQUf2/kCY2Afl89jFR21T
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1a8c4d88c4fa380ff11f201f8ceb976b_JaffaCakes118
Files
-
1a8c4d88c4fa380ff11f201f8ceb976b_JaffaCakes118.exe windows:4 windows x86 arch:x86
8cbaf46b8e7631e4b81a8e2fa8d53da3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
�����ש� Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
���ߡ��� Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE