��><��.N�j>$w�2A�W3�#�T�ƋqKk���8�����">��e�e�A��wuY|]kWO����ƥ�����PH�=qp�U][���������cΡ���/ �L��M�r�@�=UK6����,�9���������}�p��mB��ج�]|hY��xºy�;D|h��/T��f.d��~x�~��-�����4�Yd�G�����g�2tT� �[�;�%�(�-���@�V�_�BHGK$�o5W��(}���8��w��x��;�����r���'���S�U���E����ޭ� ��6����`����/Q<����eI%�<ݗ�l��FJ��~Rt�����e���5j�B<��yx(�2RTGӃ;��;q��6�|� �O/=|����c[s���]Y �:��Λ�y0��2�� �oz���`�r�<�87+��@��e�tn�c�����!`�}��B��XKL������ ��j^��}:JG��K��"K��� �p��}���╦d:q �� F�������J�2����8ͧe������m�ɉ)s�f\��a�KĪ�A@��Ÿ��2̖�qd��E}�G��u^��jOH����e�O��! vc���r��XU�L�B���%�3��ț!Ǥk�X�z��O_w#�Go��~�(1��^TN��.�'r�7��j�S���N����k�� ��F���3���+�A߅��b d8g�ک�D���iz~~=��x7���z��ڠ���b�����{�}�d��)x|����8)�����!�� �k�h��#(db��a����.`����R���@ī�o��}�T�&��㯫"� qj�/���{����i����Yqfe���k�6�?Ҟ���c�/+NS�C�`X�OX`fK3��S�(������H/��&eZ`� a{ U_ �Z���,������m�IS%l|�(����Ŋힲ�l۰A�K�Ĭ��r���ߥx������BW\=�p���O$F���e*�)f2�R9��ļ���-$�dFj%��`��8Lfv��a��!��E0|�)����X����4VH��8w��v��ʦU�<OZ����� u�D�gǺK��B���_B0���!R��%*��[�=x�Z����_Oɰ�_�L���k��f+�Lš�-ZM�*Ż&N� ~D��j��c��A4?�vDD��I�`��4R|��|����|�ݖ�<��l�pƥ�|p2uh��'�Y��/rY7Y(��rn�����8��O:�m��'Z���k�/�Q�G8C��7��hI�`�ܠ� sѣ$�0�U�B�W��L#�D��~i���?!�aT�u��G迆ǔ����C��!X���y|a��uc�L�l:.iYeC��Nf�SD�?�0��y�xSV!����&nʠשm~Đ'@�Df� ��/<�r�A�7�va��:\����"PY�_���0К��MA�K�GՑ3�~\I�͝2���S8�N�p��S9/�X��2A���u`�s����6�m�"��,fMy�Ȋ�k��C�7Փ��'�3̞M��-� ���x�P�Im$sY���>�4�=@@���ȴ�a���t���Iqj7��h��W��O=o��eĭZ� Pa[������#b-pާ��7�R>D�\���l���h��sgUs���|�1!$�"ҨR,5`Y������ŕ�O�{����W�N���58]�#W��H���ΰs=ju��7IR~�׃9�T�������i$A�]�<DvΗ8�Uf�}Lە���,-��-�AU���2���S"X$� 2t���\����¬�T�o��;��h!$ecPA��zD�+Ц헋��&lTp�y%�Aw4���p.�<��)1� j��w�����!��/��tT:7;$MT�Z�_�5��=�Dq��p9q�������m���@ zXRC����z'II#����wၖ8>ԓ�x`_���s=�S+�W��iDę�+Yz���iD[ڈ�'YP��,����)����(�t�T��v��P�(jN�@�ڞ)m �2o̕�>���d�ޖrɈ�\��Ҋ���3�=��݅G��P��K"���J���K���5yP3���R�d����|.�8`�aZbӾ���c�iљ�na����;��W]S��]p4����vHePT[d!����s 5�U��c��I����q���5��x%����'�B4/�ZU@�֟�� OۄT�E���k��dqEqR��{2����eJ<z�c��7����P�K � ����� t,z�8 �Ђ�:y�r������+���&�77��\�W[�t)l�+��x�&�*���v��O��k�b���#_U�_�lQH%�uY�����Ȣ� u'����Y�� ����bx^$���0��9�k^�@\}C����8��̩�a�bfo�uL���8)�σ&Qk �^ub��e��谫�Pw�.,�_B1MX�n��ޠ�)���Q�#hFտb� �%�4�J�B_S'!��7�i���AI�0������?-��^7ޣ�s�F����÷�l�����QX�4��4���# O̡��aݔ9��;w�N�3��`����3W@�Ԍ�l.�1�O"����a��CV��k�#`l� ?'��0�K��D�[:gK���j�|�M��cvxzI ��(�?��O*tx��Q�;�ɣ����7s"�5C�� Ie��(�{�)�(d�tyi�֎����ЋrU��,�Ӹ����"�h&�}폴EL��r�5�0`,р �y3=�ō (�'��n~�]Y�F[5�\UCۿ U,_��S�q�XD:�ڡ4����v�i�����̦��kus��*��s��j�R�HM������ �F�(ágYLILޯ��:��0i~w�G>�~C �=���u�o�� ǘ&����kX��nw\d-mGÄ#W�G�Faey}{'���^|�N�j@���6.� jP� 夺��?��٨@�\"�dq���\PD����@�UY���x�V��e���SW�Q�,
Behavioral task
behavioral1
Sample
161bc31d6bcbea852f4ed185536fa4c7_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
161bc31d6bcbea852f4ed185536fa4c7_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
161bc31d6bcbea852f4ed185536fa4c7_JaffaCakes118
-
Size
128KB
-
MD5
161bc31d6bcbea852f4ed185536fa4c7
-
SHA1
be2bfcf3f9784055ffd27f8cfeb97b7c031bae93
-
SHA256
42039011467229067fe0772057a60515d3833922b42c2e39c30ebbc2d3595de9
-
SHA512
6ee8a577bd133ef8c7718715274c19566bbd00aadbf1d430f8c06f8b7a7deda49b5f3b8a591e6d50e475066859570a41a9eedd6b81e815ce8dd1bcf2956c9c54
-
SSDEEP
3072:fQxiKqdL+HurHoBZahrnA0b+H7y+wK3g8:fTY4IBZ90SbyJKj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 161bc31d6bcbea852f4ed185536fa4c7_JaffaCakes118
Files
-
161bc31d6bcbea852f4ed185536fa4c7_JaffaCakes118.exe windows:4 windows x86 arch:x86
e13e1c4b581fd640882a2a5b86059e78
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaVarForInit
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord520
_CIsin
ord631
__vbaVargVarMove
ord632
__vbaChkstk
ord526
EVENT_SINK_AddRef
__vbaVarTstEq
_adj_fpatan
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
ord710
__vbaExceptHandler
ord711
ord712
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaVarDup
__vbaVarCopy
ord617
_CIatan
__vbaMidStmtVar
_allmul
_CItan
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 92KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ