�{o` �]�Y_ ^���j�T��ܳN�K���w�Ǔ5�I#)j/7t��at��p�%Sr�����b��2�����(��X�f�Й���H�Ǚ�O�D�H�ߗl�4@���?���TG�� O��^��?�A��3�1��0&���%���C��2�����.WT�cl�uM�B4a��@��ֈ,�?��y��u �e1R�&��]�J��둬;cs�j��*9F�ˍ�$���=���,�Ĥ��~�]�u<=Fj���$OL�ߓi�;�Itg���"m�L� c-˝cf����|h�lS{�ˋ��z�/���B���bJ��jؓ�e��������+`$7 ��]�ZK��^*8җ��n�}"V�D��]����i�t�IP�F�.税���x� 0O�[~�ڴ>C������~nI��6."ޮ�x�ݯ���@M^�=�QEQyS1_�<f�@L6���%������汓��+]ᣢ��)���OQ�ʧw�1QdC�$s��8���M_��ޗ�z���oZf�p$�f�"�,�׆�p�l� ���Ck����1Ƃq���]p����p/;�&�j�� �6��MzS�qi�SD]���1tYv�@>6�o�#��&�J�X���@�Eڏ� ��k����5��qعU���|���\�G�Kų��^�>���_�4�|��v|UD��{��*������xǁO���䖝�4�6�ɦ�3{�Yg؉������7|Ad�8�Hi�u�������֒�H�� >i'�[0�K^��ut}�������!\f�i+q�[gr�����k�u<�owVdS%���_$�6W���z5�&��ז5�a*wg�3��`�,D����7F���p' �.��\Ahڞ�V{$c<,� �"h3I�v;{�v(��{�-0ܗ���]X9�O���X�=�#��M�W]&KY�& }Y�C��vNVޣ�'�趤L}�t��H��=�P��<������S�&�������*S5�_�X��Y��4"�1�?H��ڵP_9�g� N�w��]3��`8���E��>��h��W��3̓��-�.�h��+��à�R 0��%]E�G�y�Ta\�K?�p/���S?��e�'���C�j�~����Q��xo�>��Z�MOQW����n`h[A͕`��vR�R�W�y�G;�����u[��r�nR���7]VMt�Ct����ϸdrB�Uv�^�2�f�dg�\0g��A�.ڥ^�4G�L=P����d �g�j��*�t�G��5�h�D�A��,4�`O��R�ź��d���:���@/����FaoB�I^Ҏ�F����gҕ��;#�RF}�݈��wb���������n��y����'�ڍ9*j�04S���~g֨� ������p\AWX����f��J}��[�T.�� z��fwI���x�,��S�ϫ��w1 �H��� �"�A$�n�+�Q��7�C���c�Efu��� rv��*������6r@?�a�����0�"ô��W;v&v~�ik1e!Q�,�eT�]DV��#�Z��]d���r�v���ϣ�,??�+���܄?�pM'�pA� �U�б�c�!�k�dk q���^Gy�����;����金-l��JRD�K���k&rcm}ݒl�E{$]MG�1��p�h\���f���T�~�[���e�y�Zt��x��,� u�lk߂X��y������`�f^����J�2I���7FB��?��驶'g�%�~vKd��v��~"��l��U���͎rVF�o$���w⟕\���aG%,b�ڋ({xD���)]���mn���t�5��i��2��p�R=�����+�WMU(\���v/���O�^�X�]D��I�=��C�7�!'���y�-Mz�5�Qg�?�H�.������������@'�P�q ��i�y�6ȷTI~dt&�YL8��j /T��A���*&�oG��-2���ԁ/iyS�g9��.rU�Ԙ�[Gǁld~"i���$]���� ��L���&)�ܳ�z�=����%� �!G�'�f��D��S�0�ڠDZ�)����ӽ8��¹(�P7�M���X��~��'y4����J�� Ϝ��;�A�.�< d�î�'����g�j��q��9Q�Җe�ǝlSnGi��D$[ �p��3V�rZة�Ť�i`�/���c%`�K[l�~3�~ ��:���p?���Jm��kb7F}�[�x����k���ۗ@�C݉�;=ݢ��:$��$"M�o����藆������a�lhD�E&�F��?R�I�T3��jW����=�o.�Soz��mz��L~�A^w�V?s���,�l���x���Oy���De�y��&���^!/�����m�`�c��`�����z�s�U�H���bTw%�o�����ࣈr� ��f�4 ��_a��K��DZ�v��J�,Z璻ͥ�5�iF��*����4?(���y�XwU���s|����P�f�^�1��@����I��d���J�졇�a��,��k<D��&�*�˜C}4�37��>����q���jh����?۽��9T��X}n3�&�OMF%�2'��Ld��-]��"��#�u�mn5�i�j�,��.�]��SD������ſ��3͒iK$k�����ڙʳ�� Q�~��91M�Wؗu�G����u`���P���Pۇ�7����E���<g#c%�isN�6\H/_#=��b�c����GF0y���\&��CC$G/���sk�������?m�����/��|�������.�������@r���<8*����I�0_uh�#�K4#�)2}FW����ޞ��pT 2��r|��onE?��w��)�$ ��ΐ��'�٩��9��%yR��%����)��ޱ�Y*�@ٱ�%݇�T��� KZO��q��wGrD�u���e���q�ꦃ��q����B�|�Y�$�d��$� ������@�c���ue��4Cu���L�!rq� t7�"��y�Y���P%ѫ� ��D��~i�5��d�
Behavioral task
behavioral1
Sample
1764e61a73e3c70eea70d11e1038f620_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1764e61a73e3c70eea70d11e1038f620_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1764e61a73e3c70eea70d11e1038f620_JaffaCakes118
-
Size
792KB
-
MD5
1764e61a73e3c70eea70d11e1038f620
-
SHA1
89c8c3e68cac0ffc215ea2fd0114cd9405e5f81c
-
SHA256
da1fc973fbcbf4aed6522d31d4ecf3c6aeb2d9533b463a8cb84dd6a3bb20eb11
-
SHA512
e4afcd845d03ea753b581fc8007e518b7782b2140f895c990c19bef66cc13e7a4d53bede3926a7785c16a4d6f0b534722c79d6cac253df758946fbaa982dc552
-
SSDEEP
24576:BxTygl6cpnLmwTKXiDty93NOvmIUB9keg4A1:/DFawTKyD8FGe
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1764e61a73e3c70eea70d11e1038f620_JaffaCakes118
Files
-
1764e61a73e3c70eea70d11e1038f620_JaffaCakes118.exe windows:4 windows x86 arch:x86
752c05b8692d5ea9efc0d092bce65262
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
ord693
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaVarIdiv
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord519
ord629
__vbaStrCat
__vbaVarCmpNe
ord553
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
ord661
__vbaHresultCheckObj
ord662
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaVarCmpGe
__vbaVarXor
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaVarForInit
ord593
ord594
__vbaObjSet
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
ord598
ord520
__vbaFPFix
__vbaRefVarAry
__vbaVargVar
__vbaBoolVarNull
_CIsin
__vbaVarCmpGt
__vbaVargVarMove
ord632
ord525
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
__vbaGet3
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
__vbaR4Str
__vbaObjVar
DllFunctionCall
__vbaVarOr
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaExceptHandler
ord711
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord535
ord644
ord645
_CIlog
__vbaFileOpen
__vbaVarLateMemCallLdRf
ord648
ord570
__vbaNew2
__vbaInStr
__vbaR8Str
__vbaVar2Vec
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
__vbaVarMod
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaVarTstGe
__vbaFpI4
ord616
ord617
__vbaLateMemCallLd
_CIatan
__vbaStrMove
__vbaAryCopy
ord619
__vbaR8IntI4
__vbaStrVarCopy
ord542
ord543
_allmul
__vbaLenVarB
ord544
ord545
_CItan
ord546
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 396KB - Virtual size: 394KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 336KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE