���O6,>��%�-�XZP�B�>{�3W�I2}�D�*U7|�&�^��Cg؏>r�칋�ET�������8�4&l��~�d"�b�R�x5_QoT���%��:뭮��X�fα�����;,ؓ��/ vk�ևj�a�i�T3��}�r���T���s,H@!��� �G�jGs���Gj��(@��վ���&b�㥌r$�;! ���WH+6$�Oz����d����5�Z1����q�!ǚ}���8fi��:<X��������"1��ޅ|�K����T � �s/<+r2����?'n(x�R��Y�0+Er�}��G-��P�Ȩ���s��Țߧ�;�85��k��S���$�����2D�Q2��� ,Bm�(�-� Kϣ�2�[��Tz:�b�!JmGJ��t����|z��.�Dab�*$�����C�?y��X�����V� (�wJb�_ڃբ<Et��A(���� �^�g{�I���_���X�QO<Iv�eG,*g�iL�� ӵ�O�E�w�Ju9�4�;/%�?��lᵖE��K�|�y_�2 e$�mhy�0��"��'��~� �0�a���������ޤ���/ք�!Nz���@�wM g��/IFF���@�����>j&$�?�3,u]���F�/�Я���1�@�����cq4lź��y�M6g��F\I��������u���_"����|W4�,���b<j����"k�Fv엗�'����x��w�F�p�1����[Pc�"�1�bW�WlS�¹�s�(�3�r��A�%��f �~v8�!�8N�4�H�I���&�?�UZ�Wz��M֠�N�liǵh�S{C�Q�Ó�ͪo��ɏ�Yb�?��\E.���L�;"�,���I���]��'��b�X�D�� �nS�Xu�p=�]W�mv����榜:��]3�W3��]��/�RD����K�5�V�1w��c3 g�)��ha-} �ָ5���jy���HoҺ �ABXx�{Gۨ����P���������HeڟْN@i%Z �fs�;�,�#��I���� �������;V-�e߉�_�&�( �U7����}O���s��2�-ƫ į7������$$J�O˛%��ڸ]ާlAOE�yJ��A��� _�&Pc��pE���)E�M�Mژ����U��.��`���K9[}���$�4hH�n�`�J��^��Q��뼾�x�!�8*T����ܯ'S3r�j��W������=l,�X�rBx�m�>-|(���gV�@�����f�?���y2@$���<�L����&��H�dw4�<�D�X��CS�g.~�T�6�ۣ��w�]���c��*)�8yK_�T!�WS�#�Բ�M��������)��d���.��ft���c�<[9�>x�3|!R�hqC�G6}D?�v��Yò�l����H����`�6�b����YY�W��`+A�������g���!�)wq�%��\�ew%��/M-ޣ���EK�듧��1M�P�p��4w����K<�%t>U8D�4��g�]9� ��.�=?����=�-������*������·�;���x���1gW|"y~\�묝ݍj���;��$q���ư�O4>������bE�����P>�?ՙ�X�,��>5]�B�f���.$G��{O!8Zn�J3�챭��ڭo/A�9������dMrU�S=���xr�e���Agyi���u� `_U�f����������}�%��� �$������ �#�w���$AQ��"ڎ�p��F �,��V������M!扠�[�����R�VI=v"��^�t��͘ �"H��� ��z{g��]�Sa���k|X�/:�pá<��f�uӎU/[Eq���B� π�qV%Pts�S(�v��Ʉ�k*�W��q��%���6yJ�ez��ƞ^}�b�|DВ3A��]�D�y�")W����:� �#%����p�- �p��l��*S���)�*�{$�����m���}��j���������6՚���I#uzh��d�:MaL�C�x�T&;K!��ڄ�7��U4?��S yFL�Ԝ*�! �f- �~~���8C���"N.F���5�8s�6�*>���~��D����ܱȱ��2t�$���7y�C,MY'����t7����(��Ii����;٢���_��30U���������N���*�aKe���)�ƛ��ovf��sp�Ae�j��r����S� [+p"��}}�v�-�>�B���@"�Y�3����ъ�06b o%i�����}}0^�c�Qk���f�D�L��3��K��Pv�]�a� Z�<hp��>� ���҄��^���Lf��2� +���&�+Ae���$5��M#��NﯷȂ�� W���H0a�k��?���I�x����t^��]K�)]*�qbs��@��\q��:�IcgC%J�(�y�����R �R% ���xZW۱cg��=�toh���+�9�ɂh�W�I�w�@�Y���ݥ��td�P��?���7�"J��tg|��R#��j;n|y�t%�:��=܉�� }5�u_�oW�hI2�^�`q�TY|���N�Z���_S�RNb ��������6G��9�>��H��Ԁi&1��Xn�EYA��'���#n5�������4��j;\�E~�y�U������w�V�� 2�������2�=�BZ?�إct���dK�-���� ec���E�Q�5��=�IJ��2���M��U �������#��:���&U�m�g�9��m����}{br`����a̭(@����N��d��:[��Tlj��$�q�Ӓ�> 8�n���P<��B�q bV�{���h�<*�a��#���w���K �ڱ��FV���z��쟉��)�R^DU;�)'������ �~��������]�L�:�����[D:���J߀��U�)��1�<R(8D�xb!E-��VJ�@�zBw5�6Q�:V�.�<n֑�z:pnyy_��Ŵ�fv'��:'��gT1�j )��wL�@���^�uaATK}eͻ�s�a����\g
Behavioral task
behavioral1
Sample
77bd021a0a6ac3e3c9fa0d8b5422f4c5_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
77bd021a0a6ac3e3c9fa0d8b5422f4c5_JaffaCakes118
-
Size
264KB
-
MD5
77bd021a0a6ac3e3c9fa0d8b5422f4c5
-
SHA1
d3ec37ae185cd85238d7b28d01ac3c25d63857d1
-
SHA256
3168bb77af759c873b60807fc45dc5fc35f46c107794d01bfafb914256557d1c
-
SHA512
63920b1cf26795afab4c1d8e95c18888a6c856f957074ca3fec8a1ae74bebdc58b2f7b7aca65eea43cd537106307aef1eb67c9047fd81e464cca9ae2d7ff73ab
-
SSDEEP
6144:VTYKVKjx9zcPNu4SSrXsDz1ZNAM24Fs+wrl:VMKV87qNhSScH1ZSMdsH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77bd021a0a6ac3e3c9fa0d8b5422f4c5_JaffaCakes118
Files
-
77bd021a0a6ac3e3c9fa0d8b5422f4c5_JaffaCakes118.exe windows:4 windows x86 arch:x86
44f924f87d01bf3b7e5e0102a83725eb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_GetIDsOfNames
__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaLineInputStr
ord696
__vbaFreeVarList
__vbaVarIdiv
_adj_fdiv_m64
ord698
EVENT_SINK_Invoke
__vbaFreeObjList
__vbaLineInputVar
__vbaStrErrVarCopy
__vbaVarFix
_adj_fprem1
__vbaRecAnsiToUni
__vbaStrCat
__vbaLsetFixstr
ord660
__vbaSetSystemError
ord661
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
Zombie_GetTypeInfo
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaBoolStr
ord593
ord300
__vbaObjSet
__vbaOnError
ord595
ord302
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord306
ord520
__vbaBoolVar
ord308
ord309
__vbaBoolVarNull
__vbaFpR8
_CIsin
ord631
__vbaErase
ord632
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
__vbaDateR8
__vbaI2I4
__vbaObjVar
ord561
DllFunctionCall
__vbaVarOr
__vbaCastObjVar
__vbaStrR4
_adj_fpatan
ord567
__vbaFixstrConstruct
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
__vbaObjIs
__vbaLateIdCallSt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
__vbaPrintFile
__vbaInputFile
_adj_fprem
_adj_fdivr_m64
ord607
__vbaI2Str
__vbaR8ErrVar
__vbaVarDiv
ord608
__vbaFPException
ord717
ord319
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaDateVar
ord535
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaNew2
ord570
__vbaR8Str
__vbaInStr
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord573
__vbaVarSetObj
__vbaFreeStrList
__vbaVarCmpLt
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
ord610
__vbaAryLock
__vbaLateMemCall
__vbaVarAdd
ord320
__vbaVarDup
__vbaStrToAnsi
ord612
ord321
__vbaFpI2
__vbaVarMod
__vbaVarCopy
__vbaVarLateMemCallLd
__vbaVarTstGe
__vbaFpI4
ord617
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaAryCopy
__vbaCastObj
__vbaI2ErrVar
ord619
__vbaStrVarCopy
__vbaR8IntI4
ord543
_allmul
ord544
__vbaLateIdSt
_CItan
ord546
__vbaAryUnlock
__vbaFPInt
ord547
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 477KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 192KB - Virtual size: 191KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ