E����v�K��� �9�O�2�8�����~�����(�GMo�z��v�w+��N|��aY��q�q��i�pD6�z���=��a"���c�L ݇vt����9?ZX�%o������!��r8���AP�רSG8��t>��I2��� � (c���A�D��v�, �gÞu5�a�MV1���yx=i�D�iNEP�y��Nȥ�6�6ki�~L�|�-��7h���U��,�T�pY@�/y�Eb���ʒ"����k^�V�H1��N�?��#���n�k<?�$Ҡ�(4f�:�z x#!W���0/�?�����7fff�L7A�2�����C"Y.V�ҫ��P�m��Df-��;2�(��J��!���h����E�+K�F�����(��p�rͯ�fPzPw��Bm钵;��"�����[o�p��^M�'m�(bDo�a��C�FE���ε_4\�Z��p^�[��M��w.�ѡΡ��i�}���,�L�̖ ����c5sz�pf�6��jV�l� �a��:�l]":���a!��Ա��r^�=_�J����y#,�ձ I�Ti��� �`������C�Ą�l �V�҈��u-w+߁�28VPo쟇)a2y�cym�r�qLIn��s�R�}G`�,k�GY������`���\쒍z1;��*z���TlAC^7�|m������x�.�'�uII8�y�b��t���vv '��1���-���8��ǜrGM��2S|�y�=�ll>U��X]�@?�<on~H����2�ɠ��)����@��6�&��X��>���< ��f6k%��=��]��)���;�}��*��I��+g-Z��:�op�\X��X%��K��i���{7��nLd����H�^�_67�SH��4����6���|���C{$53���A�RjE�|_�-�)_��|9��{>֫9aM�5SH��3Jè3�.Gdy`O {.9����u츙*�`y��~#���]#[CZ�H�ʮ0�9C1�ķ�w���I���;0�=:3 f6��8�}�sܙOk�?:�ԡ䲟)7#�+ᙇ�O`�_,��3���|=e6u���X��$�èR{F@��%��/��TN�����t�D�Jr�T/���1��!�m��o�Yv͵@%��3O��#��@�;zP���><���]�B��F��MuB��sS��0��孎��>��M!��s\�qb�"�]�}y8���ܣ�����oh57�g3��K���ж���!�$,�:ô�Ƥ������!I�$�y}m/?��d�|t��SX4ly��e��-��v��E*��,_[�iv��a5��hWqg��gٓ4A�C����->2��Mv5o�I��^�II�eC}N��}u�4��ؠ����1��_��Mγ#G�50mrHѨ�Ąy�(��S<j��n�R�&�pZ��7 >D�a[T+�}��L��j�o����)���T�(gxu��36sO��&Bhi������ �����2iR j��m�W)�_&%�\l�4¥h(FK�P$�ߡL�q�F���=Iq�&�ġG��,�H����E�6���B�+����C+%s���5ői=`?6'ҁP6ͼSҫ���|���Q�G�9�"^�4x)�{��&M��*�v�&�n�e�R�~D0(U����1P�����ɲC�R��i�O�lE�c6?T�z�C�'���\�G�=�y*�x�O�e*��n�A��{� ���~#>xT�g2\�����B�sSg4Øxr�%d���� ��� b� �X�h���Z�B'Sv����>�S>%�g)�1�U�����KV�8�߽�(~,ިϠy$U/����*d���9���\+3N�m�VZE0v{ H����D&2��z\��WE�<|Q!���*|�!>�/���T�W-���̒��Åߕ �vj�g>��W�0���R�c;b�R�zxH3� T��@+�b��Dj�*�;������ W(o�[��M�t�������heO»{?<�Sp�9df{�g���ݎG�<±���7h~b�bA�#蕈��"ïwϔ�$?�ژ��P��<�yh�s��{/���_�{.��=f�_��!�B�/`wu�����!�Zv$b%w��*e�$��-�k@��y1bK�ZQ�fF/i�x�6"�<�X-Y���@^�x7��{���J!,'��|���ӗ�Y����B��n���w�ۖ�f�Z*��7��=�p����Q����ϒ%��ۏ���/K���'?�~x�a�n����BTc��xY�f0�[@K�h¹��`��K���s̸��ˌç ;���V��el)R�E� �jϫu��1<�8�_la���R��{�)��z���$CTl`�<��V|����fQ'�����m�+���]$���_��Bt���+�9�R��h�� ��>]?F�S�9�w˜>C����|ڤ����c����B�isoya�R�@1Y=�3�B�� �?�a�0^����'�c��4d⒞��/�%�+:�� ��$�T!�͔�2�^sW� ��"9���X����Z`������2�[�v��^vFby4.�u�GuV�����Q�h��J>`N�o���dέ`��� �iԝ8U;�$���0�߭��X�^�g��-�*���RX��z�1ѭ�V$�A:�A1m�����C�8����eQ�^B���p�-:!ca�i�B��ᴁ���N�+��g��t�iX靨���a,~�b�_�y�,����ͧȎ04�y�≰�~3�S.>��E�����*�R��_�hdi���x����^y�)R�x)���#v�.J�g��dL1�`?(l��n�d���*�r'�*���扈�% �n�q����ΡܩQoOr3��Ϯ.�mQP囵$�k|l�J�����\2N8i�_�tY&;����6͋������?\ZlP���ڎ��q��F� /��'�[h���7��&@UU�����/0� ��fH^*'���?���� C{f�>q5F��_q;;���9}���4@�� D�� ��0�Z�l����|��xܦ &Q���T�����)���l|~{��-�3��N>�S�z `
Behavioral task
behavioral1
Sample
149eb6ad2c205597374f34f5bbaad75f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
149eb6ad2c205597374f34f5bbaad75f_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
149eb6ad2c205597374f34f5bbaad75f_JaffaCakes118
-
Size
84KB
-
MD5
149eb6ad2c205597374f34f5bbaad75f
-
SHA1
2ed6fedfa9a059d2c0c74d50d306b4f69ee554cd
-
SHA256
609824b1147019c40b2cc2cd130b6c882b6f0ca034bf5b1d8bb2f4e9045a5d19
-
SHA512
bfa33f02b0df916605879a8996ac243815418fc5b50dfe2404100c6a7931915c4a7edf6357e79ce9fad9dbc8e98cf33dd17a4da5ceb981641f8804833dd0353e
-
SSDEEP
1536:TD4qvVNcZAKEVqIK7f8pWWQdzqUJ6jmbItzMRrFl:T8Y2AKEVC7UpTEzPMtzqF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 149eb6ad2c205597374f34f5bbaad75f_JaffaCakes118
Files
-
149eb6ad2c205597374f34f5bbaad75f_JaffaCakes118.exe windows:4 windows x86 arch:x86
4e1f9c837a4ce7a9981d59cb0f398296
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaLineInputStr
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaExitProc
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaBoolVarNull
_CIsin
ord709
__vbaVarZero
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
ord648
__vbaInStr
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaVarCopy
__vbaVarSetObjAddref
__vbaLateMemCallLd
ord617
_CIatan
__vbaStrMove
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE