g!���dflI����(y�!O|�Y<�Zr�ʨt���8]�������i~ak�n햼B�ϟL�a��¢2�A�.�,|���_(�����X�m��+frER-P�L�����gy1�8�DC�z�vypVE��I�i]tJ� �W�N/�bY7�^�i����y��`������(O�۾6��w�*J/���i�-6";V��z�����'����Gy3d���%\Lg�OtմH:��A��|\���!/N�;�t4�:N�>oM�B�g���{i�V����Pcp��͡�'���yy�w�=?L9����о��-'$r���(��f���U�����$m�X4�3�$`��<nmi�c��E!B�KI|���T�:�N~U� ��`��Z��e�� Sݖ�}k��d^�'!8��>p�t���xķ�R���H)*z��@�@�B\��'+�h�d��)+ ֜2u��!�& �S��F�f��G� #ӈoɀ�}c��{ҥy���e�Ш��$ro�)ӦJ�5/�GG�m�7�LK��xG���K���\l�S������@/S~J�q���:6�^�����]�(�e'�e�x�7�sQ�QVb>JRt�^I/�������K��`�Syͮ�s� ���`�\�n^oOyIK�[d�!�⼇Ĭ�NS�X���AZ`�ka��#WN� *�g0y)��g>����W�v��i/Z�Gz�y9/~aɿ�����,*i���@?1�"��Yj�|Sj��w����0[y"B����c�ӟ����8&��+�k�:�2�l'̙a������������C���G���@���@H�� ����9xB��X�zE��o���y�0�e�IL�ֶM7���s?]$�Y�c��/&=��-���zQ�@3����p�c����43���y�E�gZ��%-�(�8��Q[��o��D6y��� w����(,y����jx��Sue�z��x�y�GWs���ԏ�RA� �p+���r�rQ�L-�$N�v��%|Ӯ�Þqݳ�i��a8�Wײ��a�D���0�=�".�ސ2�d�i�$���w�7dS�f]�'q� Ė��6]�ē�tq$��Gk������\�<�R��ĉ��B �@%q���:�G@-�H�uAt+#�%4��v5��!H�YKb��z��xi,��_��0̈�f��J�����;�����6��%�ܼ��ϱ��0������������%������!n�V����Y X��A2rУܦ���eتv-\r]R��37��z4]��xW��6�GJ���@QՎj��Re}S}ms��,�400D|[�R��j]���y�T��Ɵ?^~v.CYGF*����פ��y�����D�՞?t�<q��@1-��6Aa>��� �S�z9X41`e���D�[�.�\.���+�"�c��\�ᮘbR"�v�e�f�Z/j�Y\V�%�y��)��]"�5�Ɔ�) ���;8�S9�/�!�ӽ�ܥ Y`�0�yo���,A���,q�8 Gک��^�y�|�Qz:o �� ��"�%_����Ē�V�n��S}j'����u�5�Y�o���wx�> k����>���<�I��ǝ` n����6b�,Z������&���z{��-DVm���n���1���w�_DfH����=r���Ps�8�S���;(�tm���c���o��B�8�uG}�u��X��D��}�DZ�T0+8��)^��>R�:�\�m~�s�"?��T��]?P�r���_��� �6.A��(������\|&4k��݂�#���c)�ր(�r�&o�@��q���y�SM������w��a�tW�hb���@e���hG�&5��a�����WF�Q��_۳�v$��#���� �0�:���,�QZ��~��WUɛ�QH�������w���ݮl�\�J�����f0�9��b5������&f�p!#F(:���Q� �����ʳ��ʃ_v��_�Rh�)W+�C��Ɏ�+��t҄���Xi}�#L����l�m��G�%�:!y>�V�$�9sٝ�v�q��c�V��D�K�ǃ�.��?y�5=��t�O�O�%�δY iR��(�W�}y~�:<[���(���W(���&,�q��ǽʘ!L~�T������:�Yy���֝^���ؖ������ξ���-E��SsȞ�u�kJ���zE���iLN�g��<��[d�L�OU�*$���M�v��B5�Þ�^� �e��rv��V9�<0ꇔ��:��F<l8�9p�Q�Ĭ�z[��J���t��i"F���拃����6�6�e<({�:���vR�pe�a��g@�RNZ���ǿ��ic^��Bc�ږ��5�����lӷ&�ة ��Se� �⊛�ո���DΊ� ���k�{)آ06�����yY�2���F ����H�ۗ�m��<�n����I�\QX���gz��:/q���-��h9����������ҙ�X����)����:-� �n��2Ev�3]�0hQ��R)\��!+�q;�8+\gLٿ���շB8W�ߔD8*Q7���B�$Я��l��i��0^����;��E���S�H����ZP�r.�I�qJ�|a��G>X�?�MQd�a�����kTF&�% g�_�d ��19�I�����yO�|�-{Za��L�>�l'����D�V����s���e�V��lĤ� �Ϋ���3�����f�}ɷ��6��������8���׳ l;���wO9�������Zi��ʰ/�p��x3���6{�v�$��*��NT�j唧ͷ3��3J��-�$* �m�w�@/Q,�J�>v���ײ��������j^��d�NI!����V�oD��ܝ��z]��'�Yi��I i�vn%\=*+�%8�sgl[k贊4P��N��!U�Mol�����%����[�%cE�?53�6�E~��"t��nL%a���Q��9[r�r|�*���u|um�c�٩/8M�� bjE*W,���k�}�f�&�T1�Zk%�@e�1n��fŭNE«6�'�����'Қ���|y�����6(d�����ԏx�itՙe
Behavioral task
behavioral1
Sample
0e6006bd48be57d0586d0f1dc11c8c63_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
0e6006bd48be57d0586d0f1dc11c8c63_JaffaCakes118
-
Size
516KB
-
MD5
0e6006bd48be57d0586d0f1dc11c8c63
-
SHA1
4e7c39503d2e975231925f399615d68369602678
-
SHA256
d8d7303fd3bbf257f881552b5395b5d807f7d1d8b2094001ff40c0df42410cdf
-
SHA512
412f3026f583f27f47a4970fcd81e89da8dec25055ca1385fdb6989f95d6211f7e7176673b8de7311f552d013ea4fa7628fd87a015c4887e0112fcd04a3b3ce3
-
SSDEEP
12288:1hDZgmsGGq1uk8PZ7mi7IeRQl/kGG6qvkIwonE8J5PB:rZYnMBM7xM5Gzv9pnX/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e6006bd48be57d0586d0f1dc11c8c63_JaffaCakes118
Files
-
0e6006bd48be57d0586d0f1dc11c8c63_JaffaCakes118.exe windows:4 windows x86 arch:x86
fc6e6cdca3ca0e1ab99ce54dbc1bfff6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaLateMemSt
__vbaBoolStr
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord599
__vbaStrFixstr
ord520
__vbaBoolVarNull
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarOr
_adj_fpatan
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord716
__vbaFPException
__vbaVarCat
_CIlog
__vbaErrorOverflow
ord647
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarCmpEq
__vbaVarAdd
__vbaLateMemCall
__vbaStrComp
__vbaStrToAnsi
__vbaVarDup
__vbaFpI4
_CIatan
__vbaStrMove
__vbaCastObj
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 496KB - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ