���]����8h��CӁ�U����v�xJ�_���GGϵ�劳�v��%^�!���u���u���ۿC�5���� #��K�#��r|�J�{�H]�τ��ȎK����#\Rp��X0H�F����]ʏb�a�Oi��o$j.0q5���w��̣���{��h�U!$�*����'�,���DL�=���Vr �g��,�L��5���*l�9d=u�?��Z&���1i:��g`6�s�����-4-�`�Q�K2���YN�x��ï��xR�z�q��dCz_�� p�uHIe��5+�S �O��w�U��R������\�aT+��.`��ğ��ɇ2�R$� K 7�5ƴ�s��\������i(4Ъ�n9�}v�9�(u��1s�-����x!b�[Eg��l�ǿ��������崰m���Q��R��A��|�L�z�O2�vz��VT��ũ������ v��SZ϶�$���6��������qm�:F�-��v�f��U�7�M�/�gv�Jw�8.���)#r7A��|jh*�}�7���÷U?��3��]�Ғs�6����$X��"L��f�_��H����$�CsW�睙r�.�Db��-��@T�_����i(��u��<�ǫ�@�W�YC %Smk��<�f�7>��8�����v�Q��:?~�!�'nk] ?�T���"`��d���-3H�IHzs��� �Y7��Vx��a����A�)�GƓ���sծV!�橆3��S���+`�+G͕dDt8��kG?����� ��N@n�~&�x��r�Z��Bw��&ڰP9�7\�zw��{;F?���Ǘ�J�� �o�ʪu�Iu�9Y�],�N�/G��U⊴iˢ�m,\Mk�S��[�L��j�JÛ��g��g����G)K��� 5j�_45���.r�@o���zWX�Z��|hm�'����Gئ�0-j$��"��e�_�����^�g����S��V��(;@Ih�=o����I���M����$P+���y�uU���Z�*p�J�Si}���J����e�]�3�����Jը��W�WA��{H}ؘ���7��%�j�(rQ�k!��>��U��V�9�싛�I'�O<1�'|���%�a�W�u��0�����[�@�Q���d"�A� |�8.nI�i7�K-m��>p?�������T�O�9����-�T�aC���i�ccL �;����5�9},E���F|�����q!d��%��o� �wDFF��P���e� ����g��3��o�u��*�P�v��DHљ�G��z�[��<��5�h��E��W�|��ў^��bg���% #��[B!!�3&�B���z�����H�&�G<m��~Y{O7���9n����.������j���:�)wy'��o8Ri_����m�p�t���2"�%)�W�)���]W�(c���=�k�R9K;9�tGr̓����]SV~����lI��i���f�������{�]��{Ć�K��(F��>6�T l��q�\!2�:�Y+�B�5��&�Jh��T�v��r�g+� ���Z��q�=����FA5M5�%����\��nd�#�[ �>�$!�5�����۶W]��@��WSq�lw��ut4e��*�Rqc�̗qǽ�DԁMkl?Cq=Õ�vG!�L1e�!��W�����w� N���"F�v��G^\����L¼p�GC�[V�'kɑ���[c�)��(8���>g �X��M�t| ��sV�*i�O�9�S��-�yxz�i��=qF��e(��ff&9$�r��n;��d0҂A� A�����CuK��!��}�`de�]���O/Zp1�Irtf�Nd�(KX�m?ɂ\:{�Qu�#�����M.\b������RK�>r��;�x-r�G��&1����ը�b�R�w]��*n� 蘄�V�X\ � Z:h�1���7Z���`�S��Kp�θ܌�i"�-TM�jP�}�=W�Y���83TA�M��ƹ��^i��sb�w�W�I��G�.(e�L�� �15���\�s4��D��v�߹��$�� Ց��w�$9[�_�Z����F��n���|����Df�s=RA(���-u �0fdܳm�˸��QZ/�W M��ާ{݄��>[ߵ8Yg�$�Re����F��(8:I�0��Y:�C�}n��X�?�")��Coic<��e���7�x3��ܔ���\ ��N��U��-t���&+�4v�/C�h�F߽��ИnK��w�?E+F���ξ�CE���l�圕� �����$���e07��GW��/�'���^y��zu��-VwT �J������_��%v]�����&lO)W�h�L ���M�k�j9��R��ݘ[f���붤��f�$������Q�+Y��u�����Ie��-+ �PW���{�Z��[q.?F0��Ƿ`������g깹k�Z���� 6Rw�qKL{�8K"�qx�뷽��.��c*�;�Y���.�VbƗ�ܷr`�r���� �l���H?��8�ˊU�r ��Hy�;XI\R�^������! �3q㶄~ ���dCD �M�9ސp���˴���+��\/5{ ыm0c��|�b�g�f����&�M���0��g�u=w�,�/W�t����sˣ��{��g�ھ���[�p����O��{�f5��@��_���\j��'^n��O�n�{Qo<��%À�3s�\�B��=�#�5�օ�8AI.����r��T/��kx��e��Q��@9���{���K�1@w�}�o��l�48�7A8i��)���`9B G� �A=�=� �̥s��?�N�H�ʡuy�j�T�c��W|b�c�s�x��Q��0�j����ދͰck�fk����!t�i�dT��Ѧ����Sea*���F��-��z�7d���ފǪ+cM?l��ܨi� 7���ω'��W�3s*���W��E�ZZ�D }x.���Q��մ�~��4cK_�If��YT�0���e#�z���K ��WcGsW*��Xύ|v��t��e�����
Static task
static1
Behavioral task
behavioral1
Sample
IAAlive+7Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
IAAlive+7Tr-LNG.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
˵.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
˵.url
Resource
win10v2004-20240508-en
General
-
Target
6e4aadb5a5a158a69e8b0d97a1dfd28b_JaffaCakes118
-
Size
2.0MB
-
MD5
6e4aadb5a5a158a69e8b0d97a1dfd28b
-
SHA1
891a175b32e510f65d5aff3edda818ebfaa6b189
-
SHA256
453164b9c5b06ce8c21cdeaf55c3c2b24b32408eb800ec88666dc2f3ad25694e
-
SHA512
4abcb9fe3e464eb75858771ae696e870cb76b9114c50bc1f9c37cdb0fce86f6b53e5e8bfcdc36f4663908860f0d231754c0d3e48daccaeb8be0a6e190899e388
-
SSDEEP
49152:uC4QBSChx3MGUZjp8+X/EX81FqIusHIh4pecCcADW53oZonl6d:LkCHo38C1E9dh4wVa51l6d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/IAAlive+7Tr-LNG.exe
Files
-
6e4aadb5a5a158a69e8b0d97a1dfd28b_JaffaCakes118.zip
-
IAAlive+7Tr-LNG - I.N.F.O.txt
-
IAAlive+7Tr-LNG.exe.exe windows:4 windows x86 arch:x86
e49bd620e0f713ca57ca85fa54396021
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaRecAnsiToUni
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt
-
˵.url.url