�8Ю~B61���l���N������Ri�=� ȭ���m�`�.�c�H�s? n�n��)��>L7q6�c����ٙ��U�L�!���q�v�Q���� 뮺3T�ψ��9�t){��/�K��l����\�Y���� 4��8��A��W��tD��;Z���9I@j�-P�� ��VYnZ����o��i�r�#c{�A��jL���AX ��]p�%l���{Ŕ 6�C�K��$� 2����Q����x�i�>�R(˻Y���Ó�w�ȑD��_�f^D�s�#'�w����C��yVv�X��be4`�J��i�`/A�?���[�`��H�߄b4K��#���j�W��= `���K��h�]�vL���{H��RY?���.X-�W�H���ƥt�9=x+[��+mU%�{�q �e}�%���� �Dǵw��C1��<���2F��4���BOJ涚��26�ьT������j1�?-Q ��5�%� ����4�����n.���f߃� ��W�4 vɷyr���wWxĴ ��&���Z�e�E,��S^DΠ ����<6Bh�}[kU�^w:��K`�q6�eέ��J^e��ATT������{�#�F�F4��Gf��cpT5�M�s�����ꠞ��`����k�>�^��+�#s^��g�!�.����.O��d5#��R�c�!ʤ�՟�魚��)-���zz,{|�u�#��/l���P��dzp�XA�8Ιf!,y�I�K<�����ܛ�������g�W���JC��X �BY�dPctN���Yf�:�.j�N#7h �>�����왚��$�����9� �p܅,�z#��GH�ے.f2yښoD�N@M���M)B��]�Y���N���� KbD�E�� ���}����*��n�4k��e����� Qq�Ö,����C_H�UbN�2����_��Ӕ���F ��� q�����_ �il��HB��V�Y�ؤ�S%]�9��gY�0����ɜ��m7�V��^g�A{��|t��FE$m* í�NıW��UT=������g+�f,�|�\�rҥ���~tط։��M�ӚI�C����r��0��}�/P��m\�𭽕� ӫgeW���( -����"�������^�C y}0Q2���Of�K���jF6��s�w����Φs d��D�3 4['��P�H`Ƨ8TNj�b_���`j}�'AM�$E_d ��s�����'$��ʔ{y���̳��_�H�N��ڲ����S�#�K�Qc-*O��^\T�N��#�YdDyI��w���Ƹ��,h��0kd!xGȥ<Ԡъ��M+�sW2v!F�?�E����Z�����-L�_�{�q�ޟ�9��B�(�NRGp)��Ml��;>%y�prH�̀�6 1::l��/A; ��-��S\Z��f9���_�Ĺ����'H`_�_��ڽ�8��oO}ݍJ�X:&�$逶��?5��f/ �|N�7���؊�)u��k�MJs��Y֖������V���f�ZB���5�}Yc�7u>o�dx��1��E�UH�H ��n�p�1��oz���e�H�� �@0_�۪���F�`�%���Z�p���n��!-��K.9�����w��s5�������-=�`/F~1���� ?��v�u8������^��D��t_zV4��;(���r� ����5�@��0*����d�B��-�]B�FխY X�7�x��ʹ�K^|f'�J����!�l�}u�{P�A����ra$��<Y8t�� ���&Y�⃛~Oc#R�T�DVs9�h�3�;�"�_���������n���|>ۧ�W�`��gQ��o)[��n%� I���81^쭭�r �2g}EB,�3j�3�!W �U�o��������po��?�б��좘��d%_������iW�5c�د�){�7W$L߫)"�]1Nw�mYLN5n����VC�3e?�$N��S�ٷP���(0�� *��nSD����=�5&�q�w�I�� Vc3|\��m�*.+)C��4Ad�5{����0� |@We�����:�2 f�:ۘ��R7k��1�'���H6mQ�K�`{Κ�w�2�m�d��n+);��>�2.�.q,��*�ڽ�7�zE�K�F��(q����P�X�抍Q3���|�m�k�c> �<���=:��1�i�7/HR��.]���e#~�s|"Ѹ�=y|г��) ���\��M#R0��Bͪ�.����!e,��=< �w����?H^��]0�'�.�Sʪ�z���I}^�����mZ�WP������6��@�c0!֯f{X�킄C�E�H�ׇv�F���u4�{̟�A��[Zk%?h�n�S� wJΪ�c��|��.��������q�uw���6}e�<�f�&�j���DwD��ȸ�&����&k�|X2�Bo���~��9֙���?��l�_�!ۖ��1�D��6� R��<����¨�6$�~����6dP��|P���W�P�36Ϊ @������Q���&��ĂɃ��*J3b�<�n�n�RN���&�vU�4S�>��J�]Y&{u˟���B��{,���"��=�¦����G��L�'g�ȡ�������ODU��,���5��o�/��)`�u3���&8�7c躟h{{þv�g�Y�w�:�P��f�^4��i��U���3'���T���ނ�@!u��N�6�%�y0.��s�Q5���4�: �j���s��pN?Q�pѰ{������6jyTk�H�1Y�BK�M��ܔ����'�xn�3�����$yg����8t6�T��]� ��Z2�7iD?�bV�l\���#JD,��_�[�T��9V]���at�|����yt�GDkO��Ǵ�A��$��E�\l��\cXu���آ6���r�4����V&?�u�.��A�Ne��Ԍ>i<��AS?/ș˚� Õ��O�rv��q�4;v+�����Z�s���;/����� �t0���\o�m<��/�%����^�>F0�bMI�����~v�����z�;o����D����tl�:�e�)O�
Behavioral task
behavioral1
Sample
3901d19e03a02c3e4a476510b3aceb3e_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3901d19e03a02c3e4a476510b3aceb3e_JaffaCakes118
-
Size
100KB
-
MD5
3901d19e03a02c3e4a476510b3aceb3e
-
SHA1
0131842605481a3226cd837a0a977acf0c4abb28
-
SHA256
df20ab9fa8076f7f48a666cbac1e677f43fe530e3eab30620c73fb2d678f8823
-
SHA512
b1b1197d972a42d6869224ebfb13a106e32ad7851b07f0acee4608b9104e6570a66afd3c2fc6b6bae784e9641926343b52d97010bad1e718005c7023495f9618
-
SSDEEP
1536:gDSnwFEEHmxxEJnvBnred3jMhOQpoA1dWLMqc406BfmnxADyrAfWDd+:gOnWHmjUvpqtjMh82i03xfrAfWDo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3901d19e03a02c3e4a476510b3aceb3e_JaffaCakes118
Files
-
3901d19e03a02c3e4a476510b3aceb3e_JaffaCakes118.exe windows:4 windows x86 arch:x86
2cd28c7cb37f894fcdd0c91497c53044
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaFreeVar
__vbaLenBstr
__vbaLineInputStr
__vbaStrVarMove
__vbaLateIdCall
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaNameFile
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaExitProc
ord593
__vbaVarForInit
ord594
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaFpR8
__vbaBoolVarNull
_CIsin
ord709
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
ord608
ord716
__vbaFPException
ord532
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord645
__vbaExitEachVar
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
ord648
__vbaInStr
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
ord579
__vbaVarSetVar
__vbaI4Var
__vbaVarAdd
__vbaLateMemCall
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaVarCopy
__vbaVarSetObjAddref
__vbaLateMemCallLd
ord617
_CIatan
__vbaStrMove
ord619
__vbaForEachVar
__vbaStrVarCopy
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
ord580
__vbaFreeStr
__vbaFreeObj
ord581
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE