G������TfW��7�]��ׂ�ߧ��wN�,�d��JQ뢣����^�W���\,�(87$xFR '��1{��<�˨`k���8��T�)�e���a��Uoe���9����3��~Y�I�X��0�ۏ�����3I�Ы��8��C��M�9^��;���5��4�ɧ��-%qmUn��x ovz���w<2o�B�[U�����qg3q� �k��7��ئ�b�4����7�~��ob��V/��1�z����c�Q��l�B+����1�KIcw7�8�!<Z]C���W�X�GE�Xi��UZk���F\e�`��F5Ѻ��`�ůD8G�&`nh�|YPM�BLy��l_��wM�;m�2��xG��;{��$_�.�J4���?Pw�w��ޔZ�0V��4�t��K���Zx�蕌�p�J��9��M��Sf@��VV��1Q+����`H�K�F��8���hM(��~5�:�¦#��Lj�����&��c��xN�����b�F����E�<�<AS!.ꏉ���F��9@U�M�����p�ӇJ��¤�8lM?qj�<0�|���vG�'��!�4˺r�,岛m=]A�o=X� �� C���@��06�����.g/�r���]�� W�C~nRh-c�8��ޘт��nnXFJE7��,��}��lZ.Az�XJ{)�H�l���#�20I~��?�Fy���+<����|$�,1n��9�ځ7��3�D4m���*�j�g�Z.�y��]�MC>=������FYNjϹ,���ss��M_��7�/� 0�.ƫ��Lc�,)�g��Y �F��;'�x���7T[q6� �_�2W��)�D}�\k�!���ț���ؐ�m&#��@�KɌ�'Vo��{��`r�-�-V�{&%� ��K/M���v�N�Je��s�����%�P�m�5�f���+m��MF�x=�7."h�Z�U\M�H�����YX������I��c�JQA�hE�`�� 8-m��՝��wZI�s�� �T������!�!{H�x�,��� ��5 Z-,��;��*j\��Z��W��DI�����V\�g��nm�F�N\�/ ��<��ty�%��m�~�6C�/�U��d������I���N���%�V�֒9B�����9�[��K�}F$�i��t������o�]'4ן�GC�*�.$&�>>�� KԶ� J����ta��)[�s݆�4�!���ZK�cA�O�#��)��j���u���o8����s���3b������UO���P�XT�c�O]�ʎ�A���8����k�V{�ϳU#so��{���\����#�N���{LjU V��ϙ$�� ��Ӽ�xI���12T�9H*슷} b�W�蕆�?"�彟Ԏ���/@��Z��ۚ�#�x�tx-&��z.�nࢻz_d�,&���U�y��P�2��sT�e�N��qq$�s{�\n��@%�j���� +���qi��K��(_���HX����B���%,���N�5�%����b�E��*2��'5nW��F���4�68�H�6����DXhg1��ۈJ�t�W$��<%�UΦ����+��҄a1����S�/̞_��/��rTŠՉX��4b��Lɽ*{�5��P:!'��e�����|v�'��Ǝ0�������'Z�Ӹ����� YI�1(Ó""�� ��Ͳq!�d��֚)�7ZE��!!{����uZ�V�EUR�e�I-�k1�<%i�Q��֒��cO����͢�#�'��ߝ��H�au*}xQW�*Ƅ��?E�]���x�>i����f�A?F��R�Q�nN-��`>����ʶ���8�*#'�ྉ�:f*�-���Xu,�0h��3<��Lj���M ��ď7�6D�d�AE�z���2R���6��la�8C�r���Ҳ�'�����, �_�m� �!U9��"o�d]zB��f�%�s6!~� �цl8R�R_�Þ��&|�^X��c?��"��������=��;���N�V�p�&,bֽĵ�s�8,�{||�ۈ[D�G�)�lF������I��2�a���{.Y�>�`����3�4H����oB�(I��G\����*�4v�T���&])��o&��<�kwr_�n�P��%��$O��y�g_��K�)� ��Rvu��>P�B��h'5�}�{�q��NK���%:��`qrR�g���g�^�I$5X� �L�P���x���4̡g�{�҈�afOM���"�7���P��OӅ�0��Y?Z� 7�7uy.��F/���n3_�����6m�ٍ��b_����_b)����?���'���`h e�?Z��d{Foh��b'G�ijǑ� É����X�K6��58"� e�Y_I��&�̵�F�h��kH��@w������i.�?.�L���?4vU�;L��uz��!n�c[η��Ф�~�$�ne4�[��}�#�e�p��E+01��ww �(b �ٚ�.��W��Z����~�q���4���f<K.Zg�Vv��F �0;uD��;��ѫ�˜��*�e0� ǹ ����=3@c��/��3�|��5��1�: �D�����h6�nF3����0W@x���Mn��&⾊l걕|���2�z��!� rD��>��y_�X�5<��? ���r<��['��j͟��y|`A��v�rK|�(E���OW�0�R�+��H_wk�la�8w�u��qp��Q�4�>������y�j��#�X�x=�z�yHL=�sQy��w�sL������s��"�GTk�m̎s��q;A��Ç������(�L��%;�u�C��\�m�6.s�av�1�|ʏ@OĴ����3����?��W.�i��r=�*Jlo ##�����;Q�-71�|���0���J�����s���ᗜr��M�p!���@ݚig��.+� ���bkj�p��]`��^�>����̑9DLm�/���R�l�[��8��g?d~�9jE Ё)�WQ���$Y!�@$��u��t��-�WI �H�`Pg�- ���D�ӿ�� �(Bc�KY"�y��h�
Static task
static1
Behavioral task
behavioral1
Sample
CODBO2+12Tr-LNG.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CODBO2+12Tr-LNG.exe
Resource
win10v2004-20240802-en
General
-
Target
f0bb77627be49e052e423c65e3e4da00_JaffaCakes118
-
Size
1.9MB
-
MD5
f0bb77627be49e052e423c65e3e4da00
-
SHA1
4de77434b247c86cc7213ba3d95fa8499424f02c
-
SHA256
5b56b7505f88e3b3b397848255a24ae0e6cf2069631df0c5dfba28bfe80faf01
-
SHA512
d39875c19631f1881b6a1a4247ade303342426d3252fbce8b7cfc8370fbe01a590cf6028b33c215e5977ef36191602c90093d25a885ed249aa9946ab8fce9a84
-
SSDEEP
49152:/2wxfgt23Ld6yNbh9dT/WexoSvSzgzmcBmntRf0sfOqySEE:/2gfSQNFjTeeSSvk8mcBmbfXO16
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CODBO2+12Tr-LNG.exe
Files
-
f0bb77627be49e052e423c65e3e4da00_JaffaCakes118.zip
-
CODBO2+12Tr-LNG - I.N.F.O.txt
-
CODBO2+12Tr-LNG.exe.exe windows:4 windows x86 arch:x86
128fa9a0facc5f5545bab004008796d5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord607
kernel32
SizeofResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 927KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt
-
˵.txt