$��J�ڤu]=��c��_<6dS�@bhb�@0���ǭh�f��b�5R�l�|�t����= �Iem#�/�����/v�g�"?3������u����Y��f1)j1RG��tf��X����L�۸��+p{Ҳ.�� ����@�P�� �I%.��e��&���lϛe�X �{2ߟ�T�xx��{]$�w����歌Le�1ݭ�8'�1<�A(�ҝޟÉ���V��9���G�-*�(l�����\yh���7��� (d̾+��I)�E>�#�*���~�i(J�T�����n<��u1֊���f<m����M> {t� AroA�Sb�P�CFe��\��L<U��q�΄��"��s��&� ������Z�;6�O�Gg<�v���_Y�� 3�D�Y�ؕ��^ω� ���MMVxؠzi=7��$�ϤHM�r�T7��)�� �B挮���=�㤻��= 0Z4�+�/&�S5��u�j�R\��%MZm_�9�y�;��Gk��� V�L�1B�Jt��]f���P�c�������Q�)���X#�����9��V ���'6I�3� �.������f�����^��;*XmXa�+�>1C`�ٸ�D��y�>��=�9�������I����d�ژ� b:=@-}!��I��p��I�.�x�Z�7P��XR���RޡE�&��P�U0�p���(��rv��'X�g_?��)�$�n���/��╶梐�?�H��__��C�*nQ���#ܮI�H�p��|�ɦD�D/u'�2"P�T.0����5O���uq���?��V֭"-�ݵC1����:Rm�0hF��Z�+��-����YŢU7���yI�_c��r�.��*({$��Zx���D�F&L�H 0�B�~\���u���<�����(<�O��&LsZ�z����T�wk���"ݓ]�Fp��T�x8L���z9붏I0�Nx��&���6v�BJ����WG��w �XȨ���|\�Sؙ$��g��tW�I�u:��2��`w����g��N4��ީ����c�u�L��z��{Mwرz�Y� ��#-t���%9��^"�!�y��1xf�hnr���9H��A��PB@4��>�]���D �/��g]�KmM���1e_�q�������$���P(h�0�$��k���yx��B gݮ �a�ex3��V�G�a�Q�(���-c��)�Q���[��N�b5|Ol�`��G���F�d+���P|g��x�݅qpAz�7���J����%��:� ��"�y�%e�L!�����`Z���.8���jRr�a�������:82��"'nWpD��2�c����e�_�*iɎ�{�EM~��������~;�9$�f�t.��R��Tn�\5���t�I#����S�L`�u2LCKZ�n����+�"L���L��hx`��D#�"�<��Jt+��?{�Oht!h�3��6�x� N�x���0��A�f�������=��+&���~�`�"�w6�����Ƽ�����U\3�� �q�*�� ���榥ťI����3���cj�YI��vg�=�s�?G��]���].���O���)�a�U[��V�������GѯW�U� s4 ���c�q�6ۏ�;��+QO��A*���#�,�����p��sEn���6H%�P�a� ޑ/=Ƞ'm��������=ְ� ����z��X1�� n�Mշ�>:�k��PD4�*@�ߐ:sfa�nh�3�s�KF�� ?H�}��8�b�2���7����H���l ��1��d�%���̂��`a�Z1}(�(ƚ�L�N�m�jɚ>�f�V��t�W����ۻ�c�^�CY�yl\���?�7�� ¶sM/�ٯ�;^��<�������An�Y���D�k-G���̈́Y���g��_��A�����3�v������~�}Tӷ���P��:Ad�^��/�',�9V$���A&��ZV!���Q~fP\ ��v�����U�.�cs�R�_�ɊX%�*��b�rx���B����C3@ �k:�o�*���bsOJ�6X��8��b4���)Rkg�#��d]A� I�l��oaƕ�����q"�����e�hUi,3=� l~T���e����a#��)OĶ/�z��=�h�.ԍ�������vQ��^�?]�sIۢ�I�˨2��独�C�F���̧J���AQ��~�����9r1Օ"��@l���I��*y~i*�� �c�'��oVR���ݮf>��z�u�X~�[W�驡�aU���'%3��Hڞ��bf�reŐ;��N�f@"{���}���,ۉc�٣�!jnj�����y|�ɬ���^|=a�NV�[�Yh)�ŖcGz���\���WU�.Ԯ�.�'V��������N�û�.�M�~w�5ԑ��WUW� �9� E<��P�ɻ4�U���N�ZEG gO��[�5�?O[�#�R3�_��=�xq����}�vj� =^�@�'��K����@�2փE�8ҕʐ�����sP��P'8� �Ѵx��<�ck9ټV��h"����Y К�A`Wi���(��)1��c�m�Y%��(Ƃ/�����+<�r��=��|�x�n(�C�[V�cv���d��cy&'�4f�uH�����%o�r��v?�Y{[s#8�@ùr^MwN���a{L��K�`����J��n��*�կ�ll����O�R<��m�۴���L|�u(���?hQ�K�=nJ�Xy�� O�� A~O�!&�r�T/�˧Q&��pGJ���h�����t�[r�(,�Rv���j}Te����K��Ji��2��o)B��M�'�T~��������Sӯ���/n�`Zu<��L$��Q&��y<������IW1�Ʌ�����B�~�F�JA{.�_��-�5,N+�F�B�U[��`�f��ao����o�Kc} $�L�v)֏.�����ɩo[7� �Y�#�h0|_ �`k�r��?(��{Q�F�!��ʀ:��Q�a1�D����;�2-O>Io8�:la��O�cG���q,�|���a t�_f��� �N�]��ݴ�!�D�j;�4����]�O���ݬ��
Behavioral task
behavioral1
Sample
020c7bcf23a5a5556755cca6183b9603_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
020c7bcf23a5a5556755cca6183b9603_JaffaCakes118
-
Size
88KB
-
MD5
020c7bcf23a5a5556755cca6183b9603
-
SHA1
716d4530011083f94d79d41f26aa480c34bb0443
-
SHA256
f43a7facdf79c8316e9cb98f647798c88e50815e0fa3ccf1408fdb00746279d0
-
SHA512
b6194fe7d7de053f91e76196e5a3e4bb4e881f6f011773f89097a8440910a760f516c88956469c2d9d0a165f24cee21f9970cd920fa140a5fce13e663d9639c9
-
SSDEEP
1536:4G/xwKEIWIrOctq6x9EqcgFr3C7m5C05Vc3GJmArutq6Qw2:4G/xwPrIrJq6TVZFTJHrAq6Qw2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 020c7bcf23a5a5556755cca6183b9603_JaffaCakes118
Files
-
020c7bcf23a5a5556755cca6183b9603_JaffaCakes118.exe windows:4 windows x86 arch:x86
acde1f649087c0ca4248b525e3e1aa3c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
_CIsin
__vbaErase
__vbaChkstk
__vbaFileClose
__vbaGosubFree
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
_adj_fpatan
ord569
__vbaRedim
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaGosub
__vbaFPException
ord717
__vbaGetOwner3
__vbaVarCat
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
__vbaVar2Vec
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord573
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord578
ord100
__vbaI4Var
__vbaVarDup
__vbaFpI4
_CIatan
__vbaStrMove
_allmul
__vbaLenVarB
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ