�5�{>��-�aK�u}d���Wun��[-���6)l�quL��T�Ās��#Q��<�r�f��"� Vu���;F��rG�� i`f)1|Gʂ�y�Eyb���3�/!���+{��!�u�{�2�C�'4�9C������K�̓�r��o e���fQ�ѱ�BB]L����-�λ0ʻ��n{��2=��A�� < E"��L���/�R�\n�0�Y<��'�iWΑ���9�S��O���)҂�}a�C��8��0�!Z��x>�F4�F�M0j ����Pݶ:��<�-J� �4?�������+���.n����J'�f �LQ�j��>J͢�H�n�u��� b&�p.����ߑ����p�0��]�`�Nk*�,�����>Ȳ\�Y����V�^k�B�L��8�d_nW�gR2�Dx��z? rn��f�E��M���(��"aO?!�l�ܒ����(+ E6X)�eG|��k��˯�j�}Fi�n�3��{�H��:Q���z(H�?�D�4��,�ti;�q"�n������6`�_��CZJ���S������2���ka[�2/����:���B�(���Ư՛�o�nW���kޟj40ո��Q(����*�|U���[:R�"Z�����6K�y7�J ��$��z���L়��bB������7.k�V�w�ޓྥ���l�rC���@��#7Y�$�7}h�V�����z_�y�`�$�:nQ�P����:�x;�� ��%^�:����rz��Ig6��e��KS�&����KSdc*�����R��)6A����hm�_�\�蚘B�GN�l�����q�V?��p�ns�����Z��2��z]���D�X��L����KA�+yzC�!��߂X0k� e����.�U��*�3vj}e��ʹ�*<W*��������8й~�J���P����gjT�����s��rv�W��%+�U~VY��ڣ�G/��|����(��G_v�}��\�Sc"���j��#��P^z�:����Y�c�C�@��䉊å�U��w�>�kS��-�0�J�M�\"�t<±:��1.��=�OE�&�+��F��p�?>vm�Kf�^��<0�V�e�3�{��k��A���/5z�1=������-�j*��k��� 8�a'rO��";bc8��N�f����#��6�\jURQZ�c<u�`���`RGz�Ҡ�H��*y��`�_��ުA��j�����,+�ʕ��u�)�%tDO`А����� �ȼ �Y��E��A�k����i����B�O�������3�UpS�P2�i�s�3���A��%no� �rf�+���,`�:堌4��H �MN��m��J�y��,���XfK���/] �b��@�Θ����pVU��HX��E��rk��1��l��r��YP�*K w���,����5��� ��&�pg{Ѳg��Dj��K���g�Z�d�1���:`M�mKQ[n9^+0e�S���hp &�ڸ�a�m,�SY�N�%`J����ؠ���&1���d�@��������b��C�ږ��֯�ć���y��L]���-^�w�z�w�v[j{G�wK%O�C%"2���_�ҮI�Ŋ��U]D��q5ݗ�<tcj�q�5�,o���k���<m�z��J���MI��Q8�/�`"g���� �<\�a���&Ԏi�.��sU7;C|���$�& ��ShA������m���L&���h��@{v�xa:���u�a�� �yw6;o"��2I�$��� >�֩&�ݰM�� {d�E�6de�88j�_-���ck���W'�yI����rw3�S�t�ˁ���z-�mU�����D�Q*��p�tjO{K�r���T14Ŀ�[N�r�Hv@KqV6� p�Qm�1w2z�[Z6��x]�Ҭ�9r�|]�A�4�I1��eT�����p��>4���6�};~53��4��({]����cc��;:l<QR;�X�m��'W��*�Ӈ��ɣ�)~}�d�aPbl�CG�V�i�"���.D�VU*��q��G�@`=+)�(�~JS�9%D[�ΒRl���8������0��S��lT_?0��b) � H��|X17�S��N�N����֜�f��A���C�Uf�;��r����uQ6�������"��p�vv'�ߔ[#�)���������Jţ*��_�� ��F�R0n��E�7�"c�^�T?�SF�;.@��=�c�OV�f�(Y(�J�}��s�=���O��+̽�n�n�Zc�k+=7.� p) �7��m$Y��8U�E�|�e�ѽ�74ϵ�iA�kJ?���T�,�������E��V&��������t"��*4Mh��l�e�u��VVw���/r�j��������������j��hxh �0����/$�%AK�A�)�d�:s日�}���_�ct�_�|�3��2Rz��G�~݆P�JK��:�ۙ���d��gsI�H��(�@�'�y�1���b�������:��i�[�'�BV[��vb��x��d'8�'��a�ݗ�Km�5Q��1�oiT��i&��8�- �5҆�^�8)]>j�b���ҽ$N�o��n��u�wd��]�v&|�����쐀-���!e�ӕ�IZڃM�Q����7vX��s&��8�� ~��YmV���81��a���4�˅d����ǜA��$��$��ZgB�z���P,�Ð�Ko��n��t��A�v�"�B���Q(���3zHY_W?�E{؇T 0���ยUEP�O�zO1�99� ��n2>���-�@ً������Os�&���z������9�,_�9���݆{&���a�(��f���~��8��cS����?!.HFm��@5T?�H�@��-a�Ujإ���X�Ȕa��Bc���i4ٺmo���>o�{JDҦ,��ׄ"���;�ӕF�������}�Sѧ�Z��{F>��������'��|g�F��S4<Hx�#�#ž""Y�9&�ךt&�O�X�V�\����k g�P�ed�U�e0�k��X2�[A�
Behavioral task
behavioral1
Sample
3ceaf1b69fa2053ced5c83921210ffd8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ceaf1b69fa2053ced5c83921210ffd8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3ceaf1b69fa2053ced5c83921210ffd8_JaffaCakes118
-
Size
320KB
-
MD5
3ceaf1b69fa2053ced5c83921210ffd8
-
SHA1
c73b66f1c3ac0c33d723dd727efb1a4b4507ec1d
-
SHA256
71f98a028e12f61c27ebb09faad65ac6bb81cc11aa3da849a9c5932708a709e2
-
SHA512
ec2b1430ee627320679ca8e0ab0bda05a9243a9a4e214f9323ec556bfa16b9ce095ba8f13a2f89702a81406b6153d5d4470775d79f565999aaf9f998d07ebdd7
-
SSDEEP
6144:YSoVUtGx/+2ykUaoLtD2RH5JUO36lhH9eZCIbXsDjYNxZ:Y16cx/mkUa9ITH9sCSc/Y7Z
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ceaf1b69fa2053ced5c83921210ffd8_JaffaCakes118
Files
-
3ceaf1b69fa2053ced5c83921210ffd8_JaffaCakes118.exe windows:4 windows x86 arch:x86
d5658aee1d8d098223dd80c2e16a7595
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaHresultCheck
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaLenBstrB
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
ord593
__vbaExitProc
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
__vbaStrFixstr
ord520
__vbaFPFix
__vbaFpR8
_CIsin
__vbaErase
ord632
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaFpUI1
ord564
_adj_fpatan
__vbaLateIdCallLd
__vbaRedim
__vbaStrR8
__vbaUI1ErrVar
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
ord608
__vbaFPException
ord717
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord537
ord644
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaNew2
__vbaR8Str
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaI4Var
__vbaAryLock
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
__vbaStrComp
ord613
ord614
ord616
__vbaFpI4
__vbaRecDestructAnsi
ord617
_CIatan
__vbaCastObj
ord618
__vbaStrMove
__vbaStrVarCopy
ord619
ord650
_allmul
_CItan
ord546
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaRecAssign
__vbaFreeObj
__vbaFreeStr
ord581
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 224KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE