>Q���}�.)Y��N����(w~Dr�v �Bg�Ə�e�r��ߙ��wW��{����d��4 �}B���?N���V��#�%p���y��1�o��gq������Pg=lG>|��-�h�ʪ9.x��{�x*.1�A/*���c��"冣��XNj�-�$pG�kooC���yi�zʓ_!e�y/ià���R}�zF�܍ayY~uQ-���a"wdç4�����E[��r%���9yÎ�L��cs�&��GC��� +�=�X5uΜ��:/�J�i$Cʃ��S���vcZ����T�T�(X��nUׁ��D��5��P����e��qj�+GY8o b�zBe�)..�ږ�#�����B�&<&���"��Ly�S��< ���V� ��V�� ��DX!�� �v�Vr� �X�hG�c|2���(��'c��S�*���j�� s�L�t#�?���Ɲ�P��c����=�bQm�F�;v�t���G,;��eH�c��(�8���n��pikܪřO�r��'��z/�Ex�q(��_���qH����܄���Y��T�?�����$I��k7��(��}�tN������jS���-�dl%�a�a��G�e��$a1X � }��.X}��˵E���S�4��Z �R��^�g���J�"��4H~2��2*�U���#�Q�<��j��LWpO�QVh���:���e ���B� �F�3��:�v�E�]�t}�)n,m^��cCK{՜�����a�:�%ΖWÝ����&�-���~?C\ܿ��0��92��ܟ?`�-�V�� �p��?c��:������(3k&���L{���{�_�tw��m!�E���=��^����^��'qX4�;�x�ef�X�jE� I���*C���q�L�����FX,��z�犡�Έ��)��81�Nj�y�V�i�߹]��J�'dld7JFU����c2�GAO��"}�� �b ��&�R�����%r��"�m�!������z�<ִ� �2 ��-ͱ��ج�$��}�P�мF���Q%�����h���G��&��-.�H"q�\��� ��9?V�����a�q>Z�)m7?&l�"@f+��=�Q��ے�-`h�+ᘦ�ɗ�`>z��J�f��n�h�����+���I7�g,8�J��ޖ��IZ���;��;��5�k�k{LSR����]�_bw�>dk�ݲzX� Kh�F���x��D'�U�ϥ��F�ƪ��(��۬"n����t��u�S�d����d����kjPp�����k�yK_ l�U����6(㐧�%��p���j����'�s^Wyq?'�~�r�t�2��!v��ڵ��K���?�gE���+(�����ߣ�a�`�N"��'=�� Ǜ�蛯�8�A�����1^��B�<y�$�tFu���f� ���UX�N���q�D���w.6�*3n���P�(���:��4��|E���\ӈ^I�R�U���� -e=yLvXlY��= �[P��Q��8�p_��<Ϣ?:=��(5~�#��R��G=0R�]�V[�R$�`m}�J�w^�ST��� Blϝ�6ZH����r;����^�ŋ�����T1v��{5��R��i� ��C5Wot*#+6�=f)O!8����bs�$l������م���0o����p����,�HR�%]��+�\�=�a��x���_N�6ٿ)�����y�-&�v�ۄ7����0S��@�����[ ������.:�߆|�\������a���C�Q� w�<bQϢa��k,�#�UX��w0�P�A���1H;���%h8�Y�g���c>Y�qہ*u��#&�ZM���oď1�����"�����q�s$颠#�|u�Eݞ.m���o�p~]EwA'�<��c�p@��lғ��$�yb/?�v�jL��f�� ��*� ��`�V�A�|3wQ��e������pOS��Nn�0��*m�3!hel�ӗ|�������&iO��ӻ��Ik���b�?� ��]��V� ?���X3h���������_'2��)RG�[��������n�3 k�����W��R�����Î�?λ��!�Xb�`�Ǜh�^#� � ��Eн�w-@p�� �F��J�Hբ��5���_[��l<�� ��W�7��!Wc-��0�����OIs���Â���cD��UB=h�q�V��^�N��&�Gt3�Hg �FIJU7._om*� Iz3gσ�v�M��+G�d����3fHIP���o���T �Д��.��:��2�L�Q��\�z��]���gfe9�`��u�sz�pZ*Z�{�llj=���ũ���6^���_����>^j�rM�T���Q"�=?���Ŷ,)�N�e�c���7���K�v,���,Ȁ�\�@�j��%�A�A�rº��wش��)vI~F%lP�Yݠ��U�K]�r�@c����2=�ڐ��L .�:��.Jc4�Ż��*B�4�"%��뫉��y�w���/��2��������=��^`�M�C�>I�9-qi;i�D�~Ab����i��v!��@�Q�Ѯ�j<�V��۵��,����0Vw`f��0+��Z��n�I#՝?���2]x�����6%;�d�f[}��<��jto9�ɻ�����u��O"Uٔ���؆�lHqkF\v*�kp�Km�ၡ'�,�#�]n����z�w��T�|�h̝&�����Â>>d�Y���A��2��l�;��b�c2�9��1hb���0��SЎ9W��>�.��dʮ�fM�J3l�A� [P��D�� �[��w�x�}w�uO�x{ifX��RG=�-�ޔu%��=�g;)�� �����o�y Ba��j�`�>��~�:Z�n9�GY9���Fh��Gl��Nu3fF�N���n/��8?ÎJ�4��0O��{.V����! G��{Km��r�2$��Ԯ��BSx6C�����=R�j���0�f`��.�+���B̯0�n��)�3�?7���M@G�,d4�Go�i��U7S|X���(�'dh��v,%m6�ң؝ã��D��|�����zA'�f�=��rJ�����
Behavioral task
behavioral1
Sample
32efcbb990ee2b104115ef2b5513c055_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
32efcbb990ee2b104115ef2b5513c055_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
32efcbb990ee2b104115ef2b5513c055_JaffaCakes118
-
Size
92KB
-
MD5
32efcbb990ee2b104115ef2b5513c055
-
SHA1
195950e3288593b3d39ce14fd520ba7e02287304
-
SHA256
60466b80eed546e0e578b36b1881665808ce377d330ddae8a892f2d144c39573
-
SHA512
7fc1ff30044ae4c94186913b39490f7a7e0bc0ccffa9166556d05256ec618f127831ba6057c73c51b2a3ed9286aff5ecbfd712da2d89ff378a32dc0b0932ad62
-
SSDEEP
1536:DWT5vFWRcPwX+I2hHCuwozU6ozAjrYubYZr08UToUz+4tYylHnmcmrSOy:DWxFWRFXi9zU1zQmr08+64tRnmcMSOy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32efcbb990ee2b104115ef2b5513c055_JaffaCakes118
Files
-
32efcbb990ee2b104115ef2b5513c055_JaffaCakes118.exe windows:4 windows x86 arch:x86
79eb4a6e42182791a8179d9c017bc61e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaFreeVar
__vbaAryMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaStrCmp
__vbaPutOwner3
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
__vbaVarCat
ord645
_CIlog
__vbaFileOpen
__vbaNew2
__vbaVar2Vec
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaStrToAnsi
__vbaVarDup
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ