��坾S�3>{�/�,qQ�n��b�巭{��$�0Y��@��5�"��>�O����+y�֛�k��I#s��VV߮�#o�D�@T���B��2f'�ꂿ�d�,�Di$�'�/��rfzl��Y{_�U����r�I_���S`@9���-��A�?�T��$,T�r� V �Of��G�K��EoE��;+���;��Z��b4���Lj�t�7���?��w�s�O��yF���F��m��*�2�B��z-s� «^��g�t�7��`oҒL��8eVs�U�/��T�R@{���f��x0��\T���Z���D`���Z�ƥ)�I���Ͻr'hZ w>�3Xϧ��I�v@�0�Ř�D4Uc{�����O�+��y��@��2k���/([�s���Nw�}���K@�! _1h�*����%g�DW�O�����X������<�˺���O�5~/���?�������x��7� U�0,b2�_q�(�������v0�/@�X�{u@0yH�'�ʉ2� \����%*u*�|���'���Hmb�ɚ�l�<���c��[����7'�s௹�E���d�-�rw|�w�O|ws������~��cL��� �Œ�����$�ޟT�@��:���D��g���Z�Qg��B��껸� ��8ef9�H�Dy`�J.r~�z�������=�v�,lH�����ld�*�d���'�T\������4������""5��4�$�Ŧ/��M��R��Ŝy����-Mg�傚�M���9c���@��Ygxf���)]�]��M˨Gj���UdB�pl�F�Z����;P�E���h��D�1J��� $� ��%}ivU]����71=��6��C�oLz����f�ٳ�c^�L��stu5��^^�YM�I��ҪM�ւtиQԉ!��X�O� 2�����-OY��{��� )��R[Vf�H�)Y��f�;�tD�9��jZW�}s,���$�^�f4ݿÏ���B�QK�ڝ,�n��k���Ko�]�z���H� ��$z���>�iI"�xc�W[�'3��k�l��&F8�1�dv<`{^��TI~�)�h�u�,_`�H�tӰϲ��6R���� �^YBX���M���������F/�5�+ǍX��7���P"<6�)rNݾ\w��H�CL����b4>�>��<OUN�XE�9!'�H�a�ϯN)!(p�3X"%Kq!BJ{O����.α��~�=�D�k��٥��Q�n3�X���9R�(��t\��4��a?eT"�BS�(Y fDe�/�fF� ��^���.AN0L+�`��ׯ|���7�����<m0�[��/�5���]<�~Fs+o�������3JÔ���U���ڿ��|���j���6�����PV��f}+W���+�����P��V������a�%��d�&%F_X�4b/{y��Yj*��=�>�Ē)q-#%�.4*k$�1B��j=��q;���@����UX�D5s��5��%��9���uq ��f�~�S����5�&g���M|/�1�3(���-�,�����Nc���e��?{������$?]a��D��� �!l��L_%rD�%�u8b3�/��iZ~�X�|֒�9~n6���|�u- 3���_��z�����5}��o)�G[�%$�1�����f��YP7~$0�|���`��{Oh:_*⺬��"p��|�����K�1TOQ�V����&��N�����a:�z�E[�'�|M�� F5`�L�x%�}�Z;O�(ڗ���'���$R�'���Q�@b�$�dw� ��~v)���GP��?�s����(��8/w�*�`��|� �>�yN�z� H�5`�0-�MH�$_>��������UKl=�D�������D/�LU�2�������{�4�uNg�ӝ�겂s��qcn�O�� �%!~��=�� *d�܈��F�� H�� QF�:|����sB��κ�_����+��8As�f��z�[LĮ����Q�4s�Yʛ�q��.��U�t?�Wuچ��MCi2Ĝ�D*Վ�����������l��~F��ۄ]2HmnB���kY�F���\4��߭��g�\]-Fut����d�u��$�WPJ6<*���qvtXI9<�^���8���Cs������&Ǩc�=㧁��G���<7ܖ�crƿ>����`r����g����$ ���:!�w���i0Q,�{@��n�w�x��G���tBT),�>��NBp|X\:�q�>�B�����˒:�1�12�����}�Ւ���`\� ���Į+?e�=�����7Ļ%lf��T�'dĒ^�;Ɲ�7A�����o��f�5y���ոaO+�$��C����<��*�=L2�a~*�P~�m��*��>K���o��ԋ�X�!2�!�u��M�]@(��D^6��Tj�e�{%�"�;57����H����j�}�ey�-��u����� x��du�0尨��� ";<�i3��uSbO��g_ %ò`'���N��m���;���8�[��{������r1��\���"�_�G�1X]��Ok���'k�u���~W�q�_���:�Q��W3�Ŋ#O�?���p���떁p���R]�ݮ>�T؝Z������u�}��mO����hx,Re=� n��c2[�a���G细نP�W�ܥI��pӷ���XW��b�0�H�^|�<�Ɨ�ƊԺ��(�=��(gM��b� �V��!_ʌ-�j����@�6,ee���� ��Vy��H��s�����8:$��:�H�u����>�����Sf<w�����:�2��,���z����pl��t3���0lR�<:��"�Hǜ��W�V����KV�uU�yYŀ�/R�+���GŒ��0�C̎2'] ]2�J��Х��=^Pba��ү��홎�=-��!�BlN������4�#6w=�SO����Sw�%8�d�\�_�g��$�;���YL!��6 �R0����]�V�����ͅ/i���� 6T櫶�hі�>�=���IIsvÈv�����h
Behavioral task
behavioral1
Sample
9fd858de4f3cf0ecb4b6d9f6dd4162ec_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
9fd858de4f3cf0ecb4b6d9f6dd4162ec_JaffaCakes118
-
Size
84KB
-
MD5
9fd858de4f3cf0ecb4b6d9f6dd4162ec
-
SHA1
fdf2e5184f7a7f46ff3310c71eaded7541d80631
-
SHA256
95d16b65e2564be74705b20182bd00bf8dffd92465c31342fea1b856662aebdd
-
SHA512
5b7457a430fb30332be45835648932b2cf7ef4ae0733b02b98fe0fd38f1a3b62c9ce67c96db447fb1a8d77dfd30bf433497d1fe3e438c5872f480e2eafca3f4e
-
SSDEEP
1536:tDClGBjcSxdEkfu/dMAp9RPFGVusuxvskZ6LoYR5Wah0cQKbl6Ys6:tWlGBjXFu1X5981uyZLoYR5tmfKp6Ys
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9fd858de4f3cf0ecb4b6d9f6dd4162ec_JaffaCakes118
Files
-
9fd858de4f3cf0ecb4b6d9f6dd4162ec_JaffaCakes118.exe windows:4 windows x86 arch:x86
5dfc534e59de48ebd1c5a0b89a66a251
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaLateIdCall
__vbaLenBstr
__vbaLineInputStr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaStrCat
__vbaForEachCollAd
__vbaVarCmpNe
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord666
__vbaExitProc
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaBoolVarNull
_CIsin
ord709
__vbaVarZero
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaInStr
ord648
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaLateMemCall
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaVarCopy
__vbaVarSetObjAddref
ord617
__vbaLateMemCallLd
_CIatan
__vbaStrMove
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ