�]qD���Ɋ���z���[bҔ����,r�}_���=����)�<��+�6���I0x[�\�[���8��f����^\o�n<����+"]��礅T����bo�!���F 2���#r�c�~�<y/�L�.3<��\��ޕ�����-�:{D^uq<��QI4~=J�����>��b��pq�����[vb��H�-k�Tp/��m�<��YJ]^o��7Y���'�h�_G��ɲQ��7t�;�i ������%P,��8��Gb�Xac:��� ݹ�N0Ap#�?nT��G����ri��0 �4�pV�Er��>�� )aW�I%I����#����SaEK3@͖\Tu�ޥi�i�u���k�삛�Z�zj��_Kq67t1���˔��)ܭ�J�)� )�h��JԳM邇���O��X�6�9�`,E> >hYeYd*h�� M���CO����<�kɇ=�����=8�,$)@�����ha�ru��s�Z�=ɕ�p����Ӓz�N\�a.ȠN��d��&��<I�����ʦ�� �E'��i�rM{�`_�,�X֟L��Vm/��/0�ݠ�m��P��W�B��0�q���D`@�}>3[,j���)��G�(?Zj�V��D�Ox��{x�$�l��t���Ja��R j�02W�+Bg���qOl�I$4>���{$�|���=����h�Q�r3�'�'I.K��Z�=�#�����������Q�~�2�3#dY�p6B�l)[��d<gZN(J~�ж���W����T��SI������Gӄo���r���T��ރȧ0 g4�����[+:\ˡ��ڏ�H>�c4�҃��M ;� �gw �0���{G<w����YrZ>>�������#���j����.ف�ʃ��4?d�H$6��/��B&��M�A&�Kq#�;�Ko�6q��O?>H���0�\������ck��W�����{`�������NAp �G9y�'�����8���D�@�Ff����"�-�����K�T���) .'⧎j4�GF��$�mE��pXK�E�x���j']m>��/��3��N@��o�IK�3[#������L�&��,���aA�G<k��7;M+ݯ��/�������C�7`^�>�H\�#�yM�g��TA��o`�y8ЎQ8�]%����W��!�E�7aЊn ���~�/K�/�-�;�h��K��� ��um{O�n?�e2�Tz%Uo\߭���n|5[�T+)�RR�œ�k�����Wg���� ���%��c��%hP���@����}�"�dee�;YGE���ꤢq/�}WHO���4�Dnee^�Ћ�q�t�}b/��z ��}�'�� J�i��Q^#�Z�8�|$��m��)0�yC7V���y=�D�i��Bb��f��b�5��Մ�|�̨Ցɡ�5*&�RK���GS���C�]쿠`�����~��w����"���N����IKA�ǽ5ȗ+ki��[Q��U��ↆ?0O��o�+�-{zYՒ�c�,� �,������C9E�8�C��%�� �����X������.��R�8��}Lm#����|'x�x���9s�� �����`[�l������C�uW�L�:J/�\���*,R�G+'�7�62:��2�(.=���slkV�k�\+ś#�����U�g�b�}1��2��33�P/��b�{� (�:ƪ���v��f��Nt[��JqJ<A��4N7N����������S[�f�G�։���Ȼ���y���m�*-�T�%����'���$W�� C�=[����d<^����Z,������8�$�����:Y\����X������C:E��ƎͅEۑ����^�@�����������EN�`=ۀK`Ս��z}��̟`3roA+���Nˈ F%ɔ�֖=�x�Y��xV�E�m�>R�l! ��"K秇���������=��0�Ot)?�n�.>�Jr[Ć��8� �X�;��Q�2�jl$):��Rj�:<��.������<�"'xAU;�Êq��o��� �C3T�dw`���Z8��TAc� �c!�3��������N}V����%l��q��0�t�8W�M�p�\�?0p�˅2Vg���Y]�Q[��Gp���]2�+� $W6.��U��&3��AcC���з�uɛ����P"M�<I{H�ӹM�ΤB<8���=\��f�c�8�b$i�F�n�]F`�����YG{r�C��t��{�N%�T��#�4AKʿ��� ��z{j�=���S�����-�Đ|���6F��o��güY��h�,�P�X�.�c�i&1�8��^av�k���Xx��}�����H��%��@ڙ��4��xvQ�*�p�ھQ���߃)�Y�Nm�!V��|8�(fN�щ���4u��q�r���x]X?yځ�f*��Ohrō�幪k��n���̢lW���4�S ǎ�1�>��|1��QX����3��� �b����q4A6��'��8����_�� $�`�i�9̒�^�>��O�㜧Q�R1M�oU��6�w��d|��:���״P$Lc��ߛ,SJ�W��9z�A�����C��O���r.�)&z��)�ղ���Mˋ��.oJ'��G07������$�Q��]0 P(�(�\K3{q����5���m��h��$e�����"��1��B��BG�������L�����iP�U"�z��B�� gC�����S�S� �m) �,������O>|�b"�$-�#Oa�� @�h�A/��.%C���,�4SU�~>�2(��2v�@�� 9�k���aa� ���(�;`�M7��L�@�#E�ymQ~K�{uqUi�- |���|�E��c@�C2XݢC��ګB���f��x��;����vQvf�Ku�p_����������C~����돏�?:}��|���:'^�:F=�ˆun�I%�T�yh�͚ez��j=6�R-x\�]]�Y�0P�Z��gM���,'%�W��y6X�;g�`�P�_�������6Oxs���'�}ӶbrJ�RB5X����b��z
Behavioral task
behavioral1
Sample
6187360a3c18c1591f0edc8f0877f7d5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6187360a3c18c1591f0edc8f0877f7d5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6187360a3c18c1591f0edc8f0877f7d5_JaffaCakes118
-
Size
508KB
-
MD5
6187360a3c18c1591f0edc8f0877f7d5
-
SHA1
c853e8e87b16c1cfe665cc9baba5567faf294d0d
-
SHA256
2f715118060e9fee15f0c01d9ad77d42257772a97c914f66f32feeae90f50486
-
SHA512
75f4252ba74721e1969f1c10772a55d2d95c3911359006b3ad7d626de11532d1835e715bb5c5724c863e2050d08b55a9e1e2dc70447f23ddf611494729bd1701
-
SSDEEP
12288:l1+aktzLu04K+0zKITkxH0GJ96tXy+Zrm/JFUb7cScCuAKsj:fBktm0r0xU+gti+Zrm//cc3SKk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6187360a3c18c1591f0edc8f0877f7d5_JaffaCakes118
Files
-
6187360a3c18c1591f0edc8f0877f7d5_JaffaCakes118.exe windows:4 windows x86 arch:x86
ef931a35c3e38a55ebaa30f8d51a35a4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLineInputStr
ord588
__vbaLateIdCall
__vbaLenBstr
__vbaStrVarMove
__vbaVarIdiv
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaRecAnsiToUni
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
ord661
__vbaSetSystemError
ord662
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryVar
__vbaVarXor
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaVarForInit
ord593
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
__vbaBoolVar
ord520
__vbaFPFix
__vbaRefVarAry
__vbaVarTstLt
__vbaFpR8
__vbaBoolVarNull
_CIsin
__vbaVargVarMove
__vbaVarCmpGt
ord525
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord529
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaR4Str
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaFpUI1
__vbaCastObjVar
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaLateIdCallLd
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
__vbaUI1ErrVar
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaUI1I4
__vbaExceptHandler
ord711
ord712
__vbaPrintFile
__vbaStrToUnicode
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
ord607
ord608
ord716
ord531
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaI2Var
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaVar2Vec
__vbaInStr
__vbaNew2
__vbaR8Str
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaI4Str
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
ord610
__vbaLateMemCall
__vbaAryLock
__vbaVarAdd
ord612
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
ord614
__vbaVarMod
__vbaVarTstGe
__vbaVarLateMemCallLd
__vbaVarCopy
ord616
__vbaFpI4
__vbaVarSetObjAddref
__vbaLateMemCallLd
ord617
_CIatan
__vbaStrMove
__vbaCastObj
__vbaAryCopy
__vbaI2ErrVar
__vbaR8IntI4
ord619
__vbaStrVarCopy
_allmul
__vbaLateIdSt
_CItan
__vbaFPInt
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaMidStmtBstr
ord580
__vbaFreeObj
__vbaFreeStr
__vbaI4ErrVar
ord581
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 488KB - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ