���W����Ma;〈�g�'�`^40�͔�_j�J����� uR����]9�N��?�� �F�����4������;���C�]��ڢ���)�)�Cp���{Z@�XLj>Ag��3�E�WL"7�iu^�U�����)���2N����[��W�)[��C���e����s����~m�y��G������G3�D��7��{#ې����$�����{ܑJ�j��L��N��F����ȃ����Eo�Ԕ�ӄ˚ʞ�P����Is�����Ü���;��b�Q݃8� ����_Y�TJ]���<�U�Ld�6T��� {9�)������X[�'c E�N$�������_��M&d�"kNݳVo�Wm��C�n�x����T�(\�IÅ#�������_ ��T�>���{#{fax��Lle�� M/]BX�h�<0��-�;�=ۋ���M��㊚V-ω�S#&���G�̂ZP��;'��gi��q���rr�ko����p�T�3������/|�?�˵�X!��C�{X��z7�f� �dL=�������l��!�[Ύ�k��k��ؼ6�O��qVv��ŖeD3<(j���X�K�3��^��AEG�#�狒F^2���ھ����`�P� ݶu{��M�4�S�Bp�`�f.�SW��s����XF�z[�%���E�����u����9!_Il9�'{1#��_7�N �FD��?�����c 1\��u����s8�$xaz5�J?��3N��s)}�]��>�DW��5��Ct�Za��?�x3o����\��U�������V�pA��J��c����ХCj���q�Y(�Z#���1�Z��&,�l�M����x�� 7C���ɕ B��qB~6�B@@f��h��'��{9�E�,X�]����*�ڿ)�s���$N�����f��e4�?�٬��b�3�#�m!�����^��)P{8�,x<���BJ�,�$�{�q�V-7�Jo6�aS��Kr���Ɵ+N���̟4�h.�o��ͼ#��ܑis��F=��K�����& \��c�?��A5d��9e�잦�c"m���h{9;V]�I=����K������|�a5`���X��t������Pl�z c�,��i���Q� k B�\��>�Hʯ�h���ړ���V�]���ôf0��! ��dH�W��mK��k'��ĦJ<�Y�1F�����-:~�hz N,/�ȫ>�95�wf�Of�?�Pڋ���:k0v?�%`r�֖����P���{��ʦ�����wy����9� dճ��C�"�A]�Xi"��n��9��0��Bbi�ԟޔν�^���T��r�,G�xs){m�����IE��q��w���H0M�0 :��-�;�Bhf���4.��J�NhUæ���h�P q$ �� ���U�ttC�$yǗ���̗!l�J|Pz�i��n�4�����(B5S���ø@�gG��r]�D�D��_>#�P')-�����9�>=�g������c���]^ܷ=t ƪ�#3=A�ȣ�0��ji�H����(�Vt�狀`_#(�?F9?G2Mh�D�~~���7�;>B��n-6�RK��9�^��k�)�����ܒDF��8 #�)�Bb����״��N-�|G�i5�՟�}KEǠ����政D��X{P��S��6���0���h��9FuO��?�[�������2^Wˏ|{y�%7[m��CVW|V�%��8�/���;�!�ħ��ـ��te�V(*�g�^x�a�_���sD���i�)�`��'�)��y Ұ�6�Y�W�S��L�"����w6T��0+�z;���e� �#%�mN��F�b���,�=��;KηOR����=�t]ȃ�q��~H�U±�.#xz:�]�;���,��.ڻZ}�����UWT�߫���x�K.@���p��::�H�i"d���m�ؓ F�����Z�x���L���<u�"LK��[�3����<��U��ޢ%l�?��n|�0��,@N�3�_���X�!7R�@��*N��O�M�v.���O-j�l��`y�S��`��xqB��Ւ6�@�E�?fy�c/\��~i23(~�h�-�)m�H|z�/���AK���FZ%mAU�2YCJ��虛/��KGg�F�È�4�R�݁w�k�߉s&��d�9���ZK ,36�2~��./�.^onģ�>�����~�C�ˢ���,4��j�{�!(�_�۟�AC�2P���ԛ��I�}�����Ӄ�1{���7������m�N��_��4��L�ݜeQ����sM�nD��#p�w��g�VʛK?{p~#� 9Q ��a�l��Z�4��ƃ1�g�{'|>F���Tbs�8�M� ^��D��k��O��xyȇ�̨\u������#[uɃ�+;{��u���T��b�g�a��@���%�fi���%���N{ ���$[z2�s���)Z9Dw��.\�x�����"<�� ˥���K�7�����0=�+^v]65��أ�� �D�P��2B��4nR(7��~Z��c���?R�#��ںк?�TQ����S1v� %�}����Aa�sǰ�e\��$��aT ��'9[�|�V�P�"��ZQQ���R&)(n�,���/� o�S��������6�����>7:O��k��L�n�����3�0C4tJ�3���*�ҘN�Pt@I?�XQ����{��m3;YA{�@�(+��=�<�v:7z��R\u�m{Y3�#�T ���XLAr$�d0���\+I1��X�f�/e�1/%�P�Ȧ�<������.��I��/[�$��Dwlr�4���o�Ϻq���b��ד�e_bb�[$Y2��q�b��y_��A+yl���,�އ��zHW���ڗ_ %?]��N���j���������cI�8�=[�1�����>������S�bN耙Lz� �o����I��#�x>9ȏ"�.I���[� �pJ�ר��%K�/-E�"���C0�zA�*X�^�ww�7^���KM�^3Lp�& .�K�U���q��&z{�'�
Behavioral task
behavioral1
Sample
73fba2d43e29d0b72e4ca8f129889a34_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
73fba2d43e29d0b72e4ca8f129889a34_JaffaCakes118
-
Size
384KB
-
MD5
73fba2d43e29d0b72e4ca8f129889a34
-
SHA1
f3625a6c1cd3fd28ed8d2293309ba294d5814c55
-
SHA256
e1ee62adc8b68a1fd006d55de659d1b28cd10ef78916818a499dabdcbd1ea68a
-
SHA512
70c56e2da5420e7fa8aa1f0604891b38533e505997b80d9c9ebbaa29298163ef21cb8c6005af368f980b2fe64116d56712c3fb28248c29b3ba33d52cc1a5d23f
-
SSDEEP
6144:FEsVfaOMo3TPDyLftXznR0Zuv6AGQ9/TMznwQwHFV9HE:t/MgP+xzOZuyAL9/TCwJRH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 73fba2d43e29d0b72e4ca8f129889a34_JaffaCakes118
Files
-
73fba2d43e29d0b72e4ca8f129889a34_JaffaCakes118.exe windows:4 windows x86 arch:x86
492f6e0b6fa2e094ddc361b53331f6b7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaStrI2
ord690
_CIcos
_adj_fptan
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
ord589
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
ord512
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
ord626
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVar
ord520
__vbaBoolVarNull
_CIsin
ord632
__vbaVarZero
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaPutOwner4
__vbaI2I4
__vbaPrintObj
__vbaObjVar
DllFunctionCall
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaUI1I4
__vbaVarMul
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord607
__vbaI2Str
ord608
ord716
__vbaFPException
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaVarCat
ord644
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
ord648
__vbaR8Str
__vbaVarLateMemCallLdRf
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
ord689
__vbaLateMemCall
__vbaAryLock
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaFpI4
ord616
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaCastObj
__vbaStrMove
__vbaForEachVar
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 344KB - Virtual size: 342KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ