�pLe�ޡ���h����h�H (1�k��������E�&p_�̀ZJ�:�Q����00��e���?6��J��H$��p ��C��C�b\�.�^x(rcM���v/��tZ�fM2�̇�� ���u��y��*U�Y[[�ꩮ�\�u�SK���a/{��b��=����L��q�ƾ �W�,D���?�d�e���I�Laȃ�1V'AD=1�E:�K��߰(G�?_��'�Z�Wp]�� ��^AK���W���3ܓ��V���s4�g���ş� ��bk�,���{38��5��Y&=y�t����*�K�e������a0D�%�� �Ӯ��O�S�뿠4I]ɼD�V:��s��٩&�v�!��ᡵ�t��*��5���.����m���A_}�0So�ԋ2�;�B��;��F��5M}S��_�$��7!l�����!�2�w�'��FA⒉�y.��0����G�����x�.�]�V3앶Ugb�|�lʰ�)�Њr��$4������E�P�O�����\}���10�|P �&P�Ѱ��Y�i�r�i\D�.,�%H}9)�\�{�M���0��#\J���J��+��ڒo���m��m���>Q�m����U ז��ݩ��p��c�����f�v��Y�^`IJ�z�v_�n\{r����R2y����a�K�|z�YU�|�v�n(@�u *[�~Z�c����������0hk:�<�˯["����p�5��M�{r�* JD��{��R�휉�8t㣴C{|��k1r��R��� �n%������܃a������˯sJJ���A����5<Ɓ ��k�QH���.���˶�I��hG%ڎ ��7�1�f��𦬋�-B��k��[pH"d��� ���IQ��'��pNi ��>��U[ �#4+oT��lQ�h�h��0U1�m%��V�MY��w���E]�Q����Q� ��P�����/sh�0�)���;�ٯd��Z� �ݺ='�P��K��E�g��81Ώ�Ӓ`�N �|AJm�M������j��rb<:.,�4κ<������r�H4.?��r��'�2F(�Z2F.�v�.3���}3a@W��[�X��L��0`UD&f��z5��n)��Z�z����[L�R֎1���I(L��~P�5���H�a�7�M����W���)�����9�@D�-� W�=���vX �fRE�6!p����||�>]2�� B��f���j�쿺:�Q��A� �Jy�5GO2��#���}�ۍ��n�w��&"a���g���c��qyLc����F�/\�K(�/��k���߬�?�����2U���\�1˨�����}����� �U\�V����:�O��:�)��P���EFz�o�5;�!�4�Ҍ#C�$�?5S�� þ��"��~���4vͪ}����b��������B�������\��0'p�o�yp����}0-r�\���TI��4�4ַ��w�V�Y�)[x�����jc���*mX�����raܗZ�� �g:�������_�S������`��^��|p�X�h̥E�(�uxץ��x��/8<��e�|�Y�����@���YuJ[���=S"�;����$K��G���m8��t�$}���r�P,T�L�k�-%c�}��r�>0�����ڄ�ό��;b�>�������m ,���hjy���]�C=���b56�����Uבi�O�C!�_G).�S��qw*���Y$T2L����@Fva���� �NCK"l����M��!n�����P̭K�p���r�鮮"���1.�k��'"�,$�6c��p-]�&�R��a���{� �g�f��"���xź:�)��?PA0��<��T~�סO���y�U]�n�q~|��R[ʫ,���Z��7dǰt�����X�HP.I���N�,c_�a�+j�WS)��)��Q!륌<�~\�ecܧ ��Z���t#\X��������J�p�����5�=RT˘,Q�qz�*&屐����RXwy��x��(Db���9i��X���L��.*�+��VwrU�&c/t��j��(�qi��.�Q��IF�����6��%0=+ߐH�6�XY���DI�����e�f;��������/^X����Dχ�Y]�O�C�`����-x��h���s����9���-[(��*zs�B0��w�_��� ����+��ī�o��w���{aW�p��E�e'�GΘ�wT[H�݀L��i���|���3O��ؾ�<f�V�����)V��Z�ɪ]"G�>�� ?������)w�`�ZN��@������������y6�xIP�u�R��O�����A�+�v p2>,�ȁ��%&��ϋ<}����!V�� �S��&P ;���MS��8L�Fl_S��6[/��u���d�Um~�n�����h�h��D��k�+��j�c��L������|k�3�� �v�Z�:S봒^ﮅZ)B��~�,Φ!����u���+��Ig2��s�\���®\�����/a�(f1ğ\�{���Xd����'��u��ւLѐO���z9V�z��-<�,�q��_O�\��6��� ����n1���I>Wִ]0�(��6t�ڠÉYX\4��w>��p���kxh��Y �m��-�[{�}�h�yY�q-c�c����a������V�� �o�h��U������#ѧ;��S+��^ҫ��i?o�Π��E�H_[��B����o����ċ��+#}�xq>]�ʱ�<��/�m��y���ȁ\9��\z�'n)���g�:�?: ��/��WO{����dF�1�j�[V=�쇻>>�c�ڄ9�]���q�w���VuD���m:2�d0��U�F�#h�;Y@O���L���DeW�����2�ˤ�<, �t��v_�em�usp��r X+]���?P$��ގ`������<�^߳x'>,��X����2��]���J��];�<6��w>6dE,~��?��m}l��^�^v�9ȶ��z�8<w5ߎ�"�
Behavioral task
behavioral1
Sample
3d14a5fd0e23c46a225d8eaaf109dbac_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3d14a5fd0e23c46a225d8eaaf109dbac_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3d14a5fd0e23c46a225d8eaaf109dbac_JaffaCakes118
-
Size
796KB
-
MD5
3d14a5fd0e23c46a225d8eaaf109dbac
-
SHA1
4c87adcaf1faaceb2257107aa4d4d2a8d0e48de4
-
SHA256
3bc342b08517f1a905b1526f9115c7c592c04093a34a24a270d88ff94d55c03b
-
SHA512
9dcf12e5d57bb7b89c66398a1dcad952c779af30478a780836aa9bd191421c6158c5b2604fa6679e16449538001fb54f7501fa29fb02dd46b4fc68188dafcab0
-
SSDEEP
24576:mLA/UieyM502nzAyYFw5k4X3kckNja6JD:pTf2zcFwmmkBNjtJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d14a5fd0e23c46a225d8eaaf109dbac_JaffaCakes118
Files
-
3d14a5fd0e23c46a225d8eaaf109dbac_JaffaCakes118.exe windows:4 windows x86 arch:x86
1038739f495102913f5b79bd11cc7c7c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
ord587
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
ord626
ord519
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaVarForInit
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord520
__vbaBoolVarNull
__vbaFpR8
_CIsin
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord527
ord528
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaVarTstEq
__vbaPutOwner3
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaVarLateMemSt
__vbaRedimPreserve
_adj_fpatan
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
ord534
__vbaVarCat
__vbaI2Var
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
__vbaInStr
__vbaVar2Vec
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
ord613
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
ord616
__vbaVarSetObjAddref
__vbaR8IntI2
__vbaRecDestructAnsi
ord617
_CIatan
__vbaStrMove
__vbaCastObj
__vbaForEachVar
__vbaStrVarCopy
_allmul
_CItan
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1001KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 780KB - Virtual size: 777KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ