}�g� ��v�o�I�?}'�EY��2\�@l�N�43�Ū��n.ɒ���7'�Ǝ<a*ұ��� 8�����%]l5:&�����%�P����B��_"�'����XJː.R�A:=����g�j� H��'���e}ܮ\.f�`j\�莮����b�ޘw�ns}��h����IS8� ��9c@��r���LU�,��~}(�����Of�ay"Hj��+��Jh�D� ���|\8p�$�$�g0�~V�ۈ[N�(T�� �=�j�B!]_˭�SJ��r�`��%�dž[���4j�� �x�d� ��kXى��F�L�d&�a��X�+Ň���'ᆏ�fX�}\���R�9쎢#HQ}�����d00Z���ڨƨ��sqW_}�$o6�� p�R��=������3�5����^���Z"�a�������]�,������r��7��@�J��O+?� ���@�<�-{��� ��v�NyH������t~�Ϫ#��0-[���}�>2�3r���C=�h��]�<�I��4�Z��MA#m��^��d���������<;A�b�]{��G�<���BZ ���ŵH�����C��_q�� /��5��7�{���:� V��kӄ@#z4��z�/�&�ª����5R��6H�����rD�?����:-�&=����݆�n`��]��y}H<7��6�h��Sk�O)J�k�"K�_?n���|����c�������n�[,p��1p���'^�Rj���p�E� ���o�� ���X���I]Յx����L��9ԼsǧCF.k,�� �p��Z�����Ұ�� �䵰+�>��V_����=��V�w�9��]�$6�)���x��,H���l��ջ�:`����b�s�$P5' ���!������ �P�*>���^$=뀳�d�Ex}-��W��X>���B����Z���C+�I�%���{?������A v�Ӕ!�7���|;ZBl �W��>�_T���ۆv�����H���6z֨��V�Yż��@�1'�WD�������(��_�ۨ�}�� �g��2�4,WѶ��fKmLK�.�]>�;�a|3I����.+�;>����m��`4�~P��@��|�iJ�}l�������m|-S O�?�:d\;�a�� ��Ļ��u&̩���f�~s����=����͈�1����ۨv,�Yá=�����L��h�?�p�\�$� ���鱩RW�o�&p(qlKA��-� �r�b�';�Ir�=���y���ϟ����jdLY�C� (=�a��DS�L@�1r7�_A�FjF��0��i�+�Ӯ�Q�z�H��L�:��TZ�A���1�&��mYe�;?����j깺>�QU%6�uI�;���c��Ag��FWگ=Y� 꾖�!�Q�j����,���$��1k{�.���`<ˤ�qE@{�_�>K܅�.���<�4�|l�^,��!�x�Q�&e�&�Ld��$7�B�^��7NZT7�Pl���q)g}�,^��À��'��D�����ȧ����2��nM��� E�F����?�I:��}���O�6�:EW B�p���?P�V������Fh���:�3��CJW�� iU� �S3��-E+��3QhE��<(7�5�ˋ�3���{[�O,���2����r�y�8������j�hc��z��J�����ר�[E�c���&Յ܃�W�&l��\y����6��0R�ha?�]y�T����%�yx�������D���NC��@���8�Y�����H�����e��_���v�����^�D�w$'�N||����q�2�=�/�X�S2���R@A��#�༕mb��A�������1�G(��MȻz�z��RS�c�����*�2Ӡl���~�2�����JޑE ������덢c��ـ�d4��N�{s5�}����Tr����X����*6�t�㛃 ,���p���zu��p�����"NY?) �����/�hvW��+?�pp�%jBc�����Ǫk����\S�)�J֎I= ��~ �5R*k��Ò��y�Ň�]��%���� �ٔMo�@�u��F]��[�:�"�[�]X�8��~����>�E�־'���imh���F��>:4S$߉;Z��Po�F!��֩��-�cU37H��C 2{�E�p�h�lf��O��Z���X�Ǟ��i1H�����\�nl֨�T�-C��*ޭ��S�RYE�£1����AH UE>��1����&8ۊE�n*8l�љ�.�a?�0$Lz`�wsH��3�O����j��\��;T��iD;X��oq]+��|�d��(AםQ��y/���`�X�BZZ�)�5�W���'9���$%dR�<�*k-D����F.�֦�ϧu"w �qAR��ZM~���/!����d��xQD{�/I Gc�1�8�.IjQ����}�mk%,���J�ҞG���&\�� k�GL��+DhSd�h��!Q�.��*���&��X������u���_E������n��6ܮRIof�����?�2�,� /ݬѢb�!��!����u��J��'�������$Tyq�n=K���zX��]�G×'^W�Zd��2��^!�^��e��p�U�ٛ�˟�2��͟�'�ڹC�2Y��i�R2V�k����QX�7O�4O-w��6��^����\��BK+�),��� GO�T'b��u(��}jj�Ŀn�ba~6���Ʈ�&�m3�C���ê��g ���V�0�Iq(��->&>-?ǒ b�������|�l}Bk�2;��8l�;������Z�S5O���-�M�#Gj��6��<8�ū��ߐ�0Ew�}[�����j?^��V��_S3`��l���U���k��� ^�oDK����V �2�Y�$��>����ڏڤ��W�C_@56o�ʒY�R���Oߔ�[$3��f������GAk�P4���bo�2Bx��\C#w-~�|\E�:,wB0�ĩ ��lW�-ڋ��NS2�Yc�bl�t�ma�p���/��|��SĻ� m�xEo&h�jg��?>S]���.�`������T�,Cl\�T����_ R�C�
Behavioral task
behavioral1
Sample
0637e91024a80228135b46f07376bd34_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0637e91024a80228135b46f07376bd34_JaffaCakes118
-
Size
808KB
-
MD5
0637e91024a80228135b46f07376bd34
-
SHA1
d5b7ff2c08cbfb28b4a3c0890c968312ed270879
-
SHA256
edc6089a8d9075ab1c3d553460e5514306c88bd3383bdc12759adfffc99268fd
-
SHA512
2ed759df2dd718dbb80870d75aeeaa15019f4b74025f900f2939d8c4b426b913ebb40b811280a5b3007439eb6e922f8d48228565f9ea7387c3f7ef09bd7d1f02
-
SSDEEP
24576:NIguQo0ON2aPhQeRRi/+MBWJYFvmgmsz+CdM2:qg/HeZnEBHFA/L2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0637e91024a80228135b46f07376bd34_JaffaCakes118
Files
-
0637e91024a80228135b46f07376bd34_JaffaCakes118.exe windows:4 windows x86 arch:x86
5797b7f4d11e9802bfa77e4e5f08be4b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaLateIdCall
ord588
__vbaStrVarMove
__vbaLenBstr
__vbaEnd
__vbaFreeVarList
__vbaVarIdiv
_adj_fdiv_m64
__vbaPut4
__vbaFreeObjList
_adj_fprem1
__vbaResume
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaExitProc
ord593
ord594
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaFpR4
__vbaFpR8
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord529
__vbaStrCmp
__vbaVarTstEq
__vbaPutOwner3
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
ord670
__vbaFpUI1
_adj_fpatan
__vbaLateIdCallLd
ord569
__vbaRedim
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
ord608
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord535
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaR8Str
__vbaNew2
__vbaVar2Vec
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord578
ord685
ord100
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaFpI4
ord617
_CIatan
__vbaStrMove
__vbaAryCopy
__vbaStrVarCopy
__vbaR8IntI4
ord619
_allmul
_CItan
__vbaAryUnlock
__vbaUI1Var
__vbaFPInt
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 977KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 756KB - Virtual size: 752KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ