����2�����@�s �OZf��J4Ԫ�6������\�G���!����~l�/�kV�i�F~w-_�D�2�zi�1ε7^���Pe���ӱ?R���95t�P��y�Nz��{I���8�7I*ﶹW�I�[%�.��ǚS�-W�>;�;�5(0Wy�P"%Z��q:�2��q�^R�����h���2����/���nv�q&���c&��� ������ۀ� D+����巪�C���~l�}L�����u�UG�X'Nã�k /�G��I9���X~���w ���I��k�?��V7ܞ�Jkoe�^<�e�R�V����O�E�-.iD� �Bɒ�^jU���$�3[>�3�D���U�$�ހ�X�Im(aÄ��b��p�2�hΦ����9-��Fi#�vzk�R�dX��z �miv��հ�@���7���}m��i�"����Ñ>H�g2�Pgϴ���M!�rV�<R�&y��q!�ȉ�|^Ydd��|u_g>�#斥����$��F��-;�RE�Aȼ-�:;W+�f���� lH?�����p ��,ȵ�����~�1F�i���NY/U�l�=V���Qa� ����������C�Zwt�̺Խ�q�����D�+o!\~L$�ech�u�����!ʿq˔�����f�2�j(kR:�O����;�G��N5�&~����̿������70j ��Es��"W<LCN���z�)��B�%T�މ���>q6��?*��*�&�Q��mR�3yi�r�.��(� ���fo=dW�F=imK����$�ڠQ��A��4�� ������;�Q*�c9`�-���N bdg� U����� u��rl���ԟ��^�{ �8!H��DT�6<��[�x��>�X�"�o_�?��6L"2���Ӭ��U��M����6z?ӧ���~ߎ/T6� ަ;R���]��cZ�3H8l����fBم�c�];T������x�f�x��h7<��6��a�>V$�ݷQVGd�Ɖڸ;po?D|{��9YF��h�̞��T7fD��,�Wyd���2��?�-d��FN����X�@�EfgP���3x*��ڶ��ɔ�� o��iK�w��pF���S�R&�bL��(���%G��o}g���&/�=�I������-��>Y�^��{�;E� .����i�f������f����������y�5l�Ϡ�ƒP-^�j[jn�`|=�`zEᱞ���x�>��t/#����nqo ��/�Q:KZ�8ۗr)����3 �a<�=/ �(<7��s�\����������pD"��i�7�3~�'�,OVn0I�~1 ���N��n������DkLvX� �hc���2�� ҧlp+��P�e Rz�<j=�J-�֟+5Q�E�o�0&*�=0B��Q��wD��P2w)˰ +�yYQ�-��H�h �Cs]����%! ��ߌ�~[u��z�{�0�28-\�L�&hV���g��h��߮ˊ/La�U���7�P:�k<X�&pݤ �?�X���f�вn<Rr���U�cQ$��Rv�1}�Ϝ�pw>����l�?s]Wx�ib����V��(,|�bȹ�x@��0��F j��'KY�S�)�Կ�J�aA *[�&p�Y���IL)�=(�����1ﭴ~�WC2e�J&Aw��P��-��5����<;���n�����W��=2m�8��NT�I'����,;ecP��0U<p� @��Wt����)�����ND0!�T潬Bö� �!IL���(?��5N8Ӊo=���Ib�%Q��7���WV��&l^��CKTm���v����J��2����a� ڂ@p��*Y���һ��&��<�.� ��l�"_P�kA\�M����D�3g+��'q�3q�B6��q!��q�k�O-�%� �A��jBX$��;m��m[�W �_����6��x?ʂ����Ä]j�ȯy�5;7ݦ�E��S���ˏ���;G����:#���C������s;�A����jM�>��z[I�������\ӌ��S���p0r�����UYud|��'�hfD^''?��ޙ���֭%@�y�=yb��ة�Ǵ#� k4�ǚ��ϐ=2�m�1,[�[�E������D���h��웊���\%>�6��>u�x�ܗ�$Pv&с]�WN䙡�YPK���Y��k3�O�a��֑������:���bv�m/����I�vf����0'��f7���/Ƀ�a����[Rm���jqR���~` ���/.�͎ۥ�=�K@=ɱ���ՊH�v�`9� �6sݛ4�r���a/�˕�;U��mqC���i$���z��-$�������.3�"<KF�cP_k˱�����Ch�-t�8�>�\?m� !���ߍ�$KQ�g���A���b��>���n����5��7hI�L�M�.U�7�#=.a$�D�e�wm%�<vD0� N�܍�H�kՋpJ� a�u{B�ZOI&�1�o�L����W� &`E����"��030�@u�%���n��:�Feupp�|�W�Cˣ�V/�aI;��@�f�����*\눼���Z�E��0�#�0h�\�v����]��.7Y����'�Յ�>/���S�et���>(j}@V,�BQ����|"�����C�0�/���<Njm ~{A�j��1�'T� N�=G����.PWr�ei�0�e'mSC� 0�W�����{_E���O7��뿲5iO![���[w����%xF��l�n�|�,��oMLEHː�E���n�b�؝R�Y)k��`=�'Y�:�wᓯ�鬕���ѿ-AG�v3�>�-��#�6���{�Z�z�M�s��a���H;���<�5)]0��G X������Yo7p߄����{��5C�E �t*�I��e� �W��HG�umT$��yk�7�\�AeH����B3��1(��]��fLiO��1���,T��{3�]�L"�Ih�,��8N����Rqh�=/���)C�W�h�>��A�� ��V�gϫة����ܸ��9!�@�i㋦�sgfj'���_�5��$`��F� =���|��!�B6��� �%�>><Hy��;z�v��'���^��cȘt~��_۬�l
Behavioral task
behavioral1
Sample
c2259f4c8d23c3f1c71bbf0b5e7e4946_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
c2259f4c8d23c3f1c71bbf0b5e7e4946_JaffaCakes118
-
Size
88KB
-
MD5
c2259f4c8d23c3f1c71bbf0b5e7e4946
-
SHA1
91d77caac0d53daca82619c041d718800c8dfacc
-
SHA256
d6ddc25d0d04f8c2c3b753febc9ba8611f52edd5f11b9f918ccf0ff4709cbe1b
-
SHA512
54b61289e41470a2993adab6f7e8c354d590af13de4209e2d092b17c044745c95cd8ae302a5c98d774f5b71a3ffbd4d0c6b32e0c56c58539774c23d32f995a8c
-
SSDEEP
1536:tDCVJ+9tvqkXA/MbUUwKHmE6P4AHrW1U5K2x8jiUx43e:tWVJOtykCwUlo6AAi+k2Cjj4
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c2259f4c8d23c3f1c71bbf0b5e7e4946_JaffaCakes118
Files
-
c2259f4c8d23c3f1c71bbf0b5e7e4946_JaffaCakes118.exe windows:4 windows x86 arch:x86
e098215c933e331d94c6849eecb31abf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaLateIdCall
__vbaLenBstr
__vbaLineInputStr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaStrCat
__vbaForEachCollAd
__vbaVarCmpNe
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord666
__vbaExitProc
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaBoolVarNull
_CIsin
ord709
__vbaVarZero
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaInStr
ord648
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaLateMemCall
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaVarCopy
__vbaVarSetObjAddref
ord617
__vbaLateMemCallLd
_CIatan
__vbaStrMove
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ