E�����F=�.�+���@�����-�DG���h��qW!/H@rx��za�Et�-I:���HwڼJB����Pc� Ʀ�ݘ�b�3�f <y6-Y��H��~�]���`;��u������5+.hl�������? M���>W�:~ '��C�S���N��2��������)|t<b�Y4ƹ��OPl����$O�Έ�� ��U����=�rn_���l@̧K��c��|(���vZ�Ka5+�?��4ı�1L��s��M�fOxsx��[��@�A#�*2���kV�hh��X~$��S#�����r�d����X����X8h&�Սv�0���1� #@ ҥm�����d��� C3��.N�W�� ���������v�3������zC�Z�G 8@�9t�o�<V�-](O@l �C>Ƅ�%��o��.k(J��3��ښ��K�ެ}A�~ h������h�����h�V�]����e�Z���¯��/qb���ׇkuLx7ҙdJ���,�������e|�h #g���#�rs`g�����Ã�/_����p n��:k�T��G Y�/Ȉ�z� ��S�0d�n����&5�HTy.*H���m�ٸ.!�s �p=;���b�� LrR?\�51[bټ.����j�q� k�5B�&��T��Z/�V#1�"��R�Sys���-�Y�9�gX -"?h wЋ��B2"��������uPM��(>[���D� @��,�ܚ�1�ɸm�4�G�M�F�3m�Gσm"��b� }` �)�(h�u������~W���#� �/���]ٖ���pneF�P��e�R�+��e���Z��ֵ�퓱x�*Y�T0Jj�}��|T��`+���a`r�_��ުު�� �\X��N�YֶZcܘ~�G�;�O��ɬ������xO��x��E���k^S���� ��v������0���-�GP��fC���C��{ӧYI�r�9��N�ȕ�&��)�4"���[��j@r�tO��է��Uy�6L��{� j*q����2EwM~��BO��R���pO�6���=��<��s�)��i���#��@p�������$�����ڈ��Lf�.ʳ�J�{j�h��#>ѹ�Y��YDS**��|[4b��+4I�E�?��� �; X�?B�a[A��£���ٰ��}�W%�a��aq녑�ć4��_)U�+gs}FU�9���??��}so��cj���$�뿛q�;.�.C�cwF��m��H&x��`Mlh���k��GV��P��m�Y����S~�#n#�A���H+�`��A� v_��� z80��X�n�(��.�f���`�?oN�ȳw�����5 q)ݦ��t�}$bqq��f^Xa^}'i�+�@H���% �`69=� ������}&��v��B��~s���a���%j������'�lk��)������8AW���5B�Q�y*> �4 `fx�� �OF��j���@��֍#{�q�����6#J��m�g��Q����$���t����Ϸk����>@Ҭ�y��o���l]VP]3.O*�r�uG��>8�ܴ u;�l�(��B�j��]���c*H�5><��-��D,9u����+K�4+���KZ�M����x�?R�lQ�14]B) ҎW�1��5V6"!_��s�����^C�����!,��i7���d�\��æ��w�V���BI�$~j��A8X��T�=|G�Y& B"�E�]Xa}�]�u�Z�f��/�0*��}�B]�GLjRą�l�kP���F���[��nR+iBz�aLPr�g 0McW\V� :�qibFm ��x����A3�~� 3�===�R�4fv6i��i���Kqd�}��;�[E7���?&%� ���Ik���\�����*n^�{HKk9W�}�߲�ɝ|�D�F4ҫ��_N�E�Y��� ;~�pyHq�2Nf0��s����6c�!Y��B��<�� M���Y��������Y�����S���q�=�>��aI_ �z�&�3�UG)@�����0[�ZXA@�ǽWY�(a����ЪC�s��sf�3-ɰ����hw��������?vG�8v+�-̧qY��c���].�5* �@*`��g'��#�F���#{��M6W�ԕӭ����o���.�z�E�����["�|��qa�X��ԁ���l��t�G�P��_�_`�k�YD��9v|�E?��1n$e��T�Rկ/&ۻ�2)Ht�&��꺢[��~IC2�կNG�HH#Wb�6_;��5 �Z*���U����)ӢՆzN��$����>��{���)��.�Q������DItfW�"$��j2���~7D?�=9�h!myg)@��D�l�����l7��7(A���`a����(v��+�RÑ��8���w4�Y��x�������'�T[i�P7��È7��'A����s�ު���Y1W�� a�k�h���$��H���w�ɞ9�A�HWOȃ�o0��wLa �,��=��#w�ߗb����h�#����-��o���FrwȨ�z:�ot�ϡc�R�Nɣ�|k=�9�C,~�=�$~��R�L�}�̺�.E�{�yQ�k��|��K�?��^$�c�����0�0*�WN;��ـ%�z(�cZ1��ś�Ɯ���2�5���J��g]�~D�*j�4�*�#�w�EY�"Q�6X4pu� X�����I|2�s��(]|htp��ʬ�A�M*�z�� ��f�$;=a����c��-�`K'z|�4�Q�IP��{���k�����("�k�!�-���R�C�ʦ���>�� 3a��s��S�j2����~K5h�l�~��O1�`�ZSh�J�VO�����Rdf�G�0��{$#�"4|&�1��Az��~����ӃG��Yxrڣ���!��X�Wv}FOĝ ${ڂ.���&��Vp����z!l�uֶT�ǩo�6�֝�vU���r�c ��<t���eڛ'��q�/S1t=��ݧ�Ʊ�)@Ԉ1�G}�|��`��"���oD^����2.-�Q��T&��m���I9�'6cNWz����8
Behavioral task
behavioral1
Sample
83df1119b50478bb4ca8580edb936176_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
83df1119b50478bb4ca8580edb936176_JaffaCakes118
-
Size
84KB
-
MD5
83df1119b50478bb4ca8580edb936176
-
SHA1
8d329c757c3dcf601497e677ddd3d39e689305a6
-
SHA256
569f5dfe27c0cab41697413646a4d2121958ba61ca8af1b541db5be5f3c4d455
-
SHA512
238ee05c58d934d08fe6905530933f8cb97b63db875bbfd2a4b37d139db33ad0d754067edf52e5396cc1285e4f8c04a118756784d26697d8c8535381c486c0e7
-
SSDEEP
1536:pDrQCzcNTXN45AcyLP3rw6mAGze8/6YJ1nw8t:p3QZNhgAcyLP3M3+a
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83df1119b50478bb4ca8580edb936176_JaffaCakes118
Files
-
83df1119b50478bb4ca8580edb936176_JaffaCakes118.exe windows:4 windows x86 arch:x86
4e1f9c837a4ce7a9981d59cb0f398296
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaLineInputStr
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaExitProc
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaBoolVarNull
_CIsin
ord709
__vbaVarZero
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
ord648
__vbaInStr
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaVarCopy
__vbaVarSetObjAddref
__vbaLateMemCallLd
ord617
_CIatan
__vbaStrMove
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE