Static task
static1
Behavioral task
behavioral1
Sample
百变珠宝俄罗斯.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
百变珠宝俄罗斯.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
通告.htm
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
通告.htm
Resource
win10v2004-20240709-en
General
-
Target
5a759333e3b1b21cad000413aa199f87_JaffaCakes118
-
Size
10.4MB
-
MD5
5a759333e3b1b21cad000413aa199f87
-
SHA1
e62af77639bc426611ab14eae2e9b35f1d0e0c83
-
SHA256
e54eda859215927c7c59ba9b69ef439011cc8122503b77d90ad9658f6dc6aafc
-
SHA512
3b67524d9e517b66e1e63bb69666cb1e57744725eddb503fb69121bdb17c5832b1182b8a1dacf0d201097221789df73b0ffb4962ccd5cf2ca233783b8d0a7304
-
SSDEEP
196608:LiOPuNrVJQLM8OCG8WR56x1aQ/UwLEaMQQftVgXQ673k6Xc/RCYTCEupOqDbjdnQ:L/Puh0M8OfO1rLpMvjzZN/9TCKWjUjf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/百变珠宝俄罗斯.exe
Files
-
5a759333e3b1b21cad000413aa199f87_JaffaCakes118.rar
-
Levels/Level1.txt
-
Levels/Level10.txt
-
Levels/Level11.txt
-
Levels/Level12.txt
-
Levels/Level13.txt
-
Levels/Level14.txt
-
Levels/Level15.txt
-
Levels/Level16.txt
-
Levels/Level17.txt
-
Levels/Level18.txt
-
Levels/Level19.txt
-
Levels/Level2.txt
-
Levels/Level20.txt
-
Levels/Level3.txt
-
Levels/Level4.txt
-
Levels/Level5.txt
-
Levels/Level6.txt
-
Levels/Level7.txt
-
Levels/Level8.txt
-
Levels/Level9.txt
-
Levels/下载说明.htm.html .js polyglot
-
sound/101.mid
-
sound/102.mid
-
sound/103.mid
-
sound/104.mid
-
sound/105.mid
-
sound/106.mid
-
sound/107.mid
-
sound/108.mid
-
sound/109.mid
-
sound/apple.wav
-
sound/bomb.wav
-
sound/win.wav
-
sound/下载说明.htm.html .js polyglot
-
下载说明.htm.html .js polyglot
-
百变珠宝俄罗斯.exe.exe windows:4 windows x86 arch:x86
616ebd42bb23294f2dffcefb8651ded8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord690
ord588
MethCallEngine
ord660
ord593
ord594
ord595
ord598
ord632
EVENT_SINK_AddRef
ord561
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ord607
ord608
ord717
ord534
ProcCallEngine
ord535
ord645
ord648
ord571
ord681
ord685
ord100
ord689
ord612
ord616
ord617
ord619
ord546
ord581
Sections
.text Size: 24.4MB - Virtual size: 24.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
通告.htm.html