3�o� �@A�T�=q�ѵ{8!FG��2-�d ��M��οiFX ��bQ*<���9���T�8�� �?Dw�V�l ٝ� ��n�5e�f�PE���������e�1�l?ۧ���H���#M?�j��q|�qp�j���3]i/1���PP/6�D�41v�k�0��e>�i���`�s:���������.FI:f�� t~v�ڿUD�V-<�L#t�:0 R������2�_�)�2��D4D����W�ܩ>Σj�K<��j_�J�x��~A��ӌ�d��%��� ��z�ϟbX���+R��w3�Tp>M�[DXl���L���[�#��lZ]���{�1�ciMØ& ��u�2D��Sߐ����Y�lX���\.�z�t�;Z�l'@����.wN`-��[� Y�����m'5�Q�>�����4���c&c,8T�L�7�Vʖx1\�* �]�͘>��[;�����_��]�gp�U��al V��%q��"-�w�մ��3���!���1�G{�vL)�n=N"���w�I�ʼ���a^W:,���f��o���[?J-��)"[NH{��n��Z�!t�� ��z�e��b��� >����Je�#B3�^dT2��1»f>�ض)蝳'*슱��3���L��O�V�:���'�^���f雔t<��ԭ�CDN�3�V��z�tg�������a=�Bj���ʺ��zz�f6hy��gj�Y��ʻL�qӓ���A�����k0�"��c t������\"�4_4�����%Ta5���R�b:e�,��#�#��u*{k�+�\� L �1�R����>��q �3�"�!b���kg��~e9I��<�1���w��i����0��[,U�Zpa��� �m6�@�a�&jT?�p�G��&�� �3�n�R�ZXq��Ŕ�0y����o���z�8W�p,���?h���(��`�h�(]�V�R6�r�;��G�y7}z�ք����(���4�5S�8�{�w�7@�rUG��`�St��>�d��Q.1�l[�@/��ᎊX��MP~��9���e�Y&�����E�;�+t��9鈤Ie�{�@��f���U/,��ˮ/�u妒'6�Ț|Yb�� ���u��}��p>��������}� ��"���t�G���љ��h�g@?#���r�Ʌ1��w>�'������:uTC�l��o���_Գ��o�J<P�!��q���+�� �E���2+~t��[�k~gS�^F��|9DX=���ÜN1��>_��H% =�֥$�ٮwV�UH;C�hc^l-M�ߍ���^�so��B�'�@L� ��y��Ǜޱ�m|�'z^�J�BӚ��#��o�*�1�~�?�������|���-���������p�����ka���os�Z���m����4>c+�J�x���5KAz�Wv��9�o�;�)�ȠƉ��>��v���#EDZP�GBk�����b��&����N sX�eB��~��Ehg�V��w��Ո�8V������FXm\\��x��"&��vɿ��t�qK��|u>[yu���^V�a%q�F��r��v��S�á#��(#�2�N�C3�.�����r��-,��!.YX� Q��x����:,�FXB�%Hȥ;H�=�01�++J��Q���Ӟ:^�Ӭh�jhA|�~��s ���W�FW�y��c�6���Eu�w�̃��9��?�O�s� ���tËƲ6�i�����������U�07}�pJ+@������ �o|��W��V���Y����w8B���ț���a��ͅh�_��*�}�JNou��#P:j���E~���sF�|iXrh(O��B�,�C^h>_������<�H�wkD;&5�L��x��k3l�ks��X<ψ�� I�!�ފ�"�OV���|+: ��L6��M��N�]cB��R�9K���ĴK�Q~M��ʘ�#?�N5ċP�&˔�]xPf���@�@�����B�Z�~����ՙ����0�$$,zy1�A�x��&(#pZdFC�.���Ǟo�랋��3�����p���.�c|��i/�:aw���V�o�����O�#�=F3��n�'������a4�KUSiՠ�_��HE��3�^� `ȵ�{�m�����<1��=�:�H �4w��p��Y�z�B^��Td�������z�����0��j+D�0O��X�P�|U�{��V�~���S�'=��y��>U���v���΄��z#U�1�����r�/�fK�n8�ꄝS������n�P@a�Sk�|ܵu���}��p4k82����3�����i5�o�(�r�;�A��+N|��<=.Yw뇠K>F����'��t?:;D""/��ՋW�.�'S�gg�n ����[��q��4C��hL�H�}�j,T��<��!C�_���)�g�B�W���b�� a�B�S�p�����zG��.� �ѵr� 6������L:3��L�������8tN����=�)1+:�3�2R�3���,7C^0��hf�N>c�W���*���2�9\A���>��cn�3 �7���X]�$���+w� �#+/�D�нV��5�����+�f��yɃ5�K�b{�����������YG���G����\Q[ՕSOt����6#�����Q��<��V��2c+)~u�ck���O���b`?�xd�ٶ���I��|�Y��T:*����2����G��DW�"��Dg(=N���J\��1�[�o�*�lvJ�Y?@˶�NLGj>F��ŕ�k���"��>~L� *���o�1�S������t�~��?����D�#ll��C��ߔ,��i�T]Y�(^�";Ė7fۀ��6�tS�t#��)Je��n����$H��I�? ��x�%6��� ����E����� j�Gu��W�$=˄U$y|���Qڌ��EV2�c:�-������ѹ_��<���:� �ȡ�\X��e�=##�c]#8���&P��.��]��q3�����w>�8���Koh9L���(j/�@�W�t�]9�<d(,�0�|��
Behavioral task
behavioral1
Sample
482eb106fd3eae169bff95e9451ce808_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
482eb106fd3eae169bff95e9451ce808_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
482eb106fd3eae169bff95e9451ce808_JaffaCakes118
-
Size
204KB
-
MD5
482eb106fd3eae169bff95e9451ce808
-
SHA1
a371d34464a2681703863bfa2ccbb2961c6b3e62
-
SHA256
5b09290a4950e32f27862e554bdc692a729dd1753b5991afaa99005329d34b8b
-
SHA512
d507ffb2926d1ee7a7b75c62473ee3559501eda7325858f355507a36e614849d80ed4cdcb182d3e5885c53389f3ee209232e7342b2937e5816485ecb26925a1e
-
SSDEEP
3072:n6MIb0y+sINXOvsYPAMrnwpAxKrjjyAu0fxwcs0SRBumEyR1R/J8k+AcU+:EQXOEInrnwpkujzu0ueeumEAjud9U+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 482eb106fd3eae169bff95e9451ce808_JaffaCakes118
Files
-
482eb106fd3eae169bff95e9451ce808_JaffaCakes118.exe windows:4 windows x86 arch:x86
b21de1dada878e06810b90bff8dd5c68
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_GetIDsOfNames
ord694
ord587
MethCallEngine
EVENT_SINK_Invoke
ord621
ord516
ord517
ord518
ord626
ord660
ord666
Zombie_GetTypeInfo
ord592
ord595
ord303
ord598
ord599
ord309
ord631
ord632
ord525
ord526
EVENT_SINK_AddRef
ord527
ord528
ord529
ord561
DllFunctionCall
ord563
Zombie_GetTypeInfoCount
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord606
ord713
ord607
ord608
ord716
ord531
ord717
ord319
ProcCallEngine
ord537
ord644
ord645
ord648
ord570
ord681
ord576
ord685
ord578
ord100
ord320
ord612
ord321
ord616
ord617
ord619
ord546
ord580
ord581
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ