General
-
Target
16f7045eebb451234ca8078222c5994c_JaffaCakes118
-
Size
484KB
-
Sample
240329-dra5pagc7z
-
MD5
16f7045eebb451234ca8078222c5994c
-
SHA1
99e8f263f9e34ad13cb8cd6af1bb816deffb5bde
-
SHA256
ff344e635b268090aafdb8fa830e76c41f34d7cf9a9bf03ed4ede2705008bfef
-
SHA512
147d377f3f05f593e7428f5e5dd70c231e187c73de1cdf111790156060f59047e80f382805678ecd3f946c58fcf5d80f4e16d8534f07f0f7355bededb7726bb8
-
SSDEEP
12288:x0K9jbtvzZPJukNeFrmndcPeGGUQSB/a:xh/plBlMFrleGfdB/
Static task
static1
Behavioral task
behavioral1
Sample
16f7045eebb451234ca8078222c5994c_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
formbook
4.1
cb3b
listenlocker.com
jumpstartnotarybiz.com
new-post-vehicle-site.xyz
summon-entertainment.com
johnandtracy-adopt.com
bferety.info
palmonlae.space
yx1889.com
janetnaufranck.com
banditanalytics.com
agenciahologram.com
artemojo.com
goldensuninn.com
aminobalm.com
customersme.com
techcareerschool.com
angelahuckeby.com
smoothcontract.com
kartsorgumerkezi.com
houstonhemorrhoidclinic.com
istanbuloz.com
buyrealestatewithcarlos.com
onlinelivehds.xyz
outstandingearth.com
cyclingsunglassestop.com
haras-dors.com
zhuanyekf.com
pps-squad.com
highlovely.com
hudsonvalleymomandpopshop.com
graytielaw.com
orang-gilakali.com
sajaasboutique.com
nwomakrom.com
mobilne-kucice.com
instant-geek.com
brewinginthenameof.com
shopstel.net
alumaber.com
fernoost.info
expandablepocketdeals.com
ritelard.net
elderyochanan.com
gofante.online
americansforbrazil.com
condosofcolor.com
the2gaku.com
mesegeka.com
democratsforesteban.com
vinoporfavor.com
xwaxxc1.com
jinhongtextile.com
festival-du-chanvre.com
abrasivburada.com
pinhoti.net
nestd.online
fendlercart.com
unanox.com
boyscout-site.com
wlctrade.com
gudesigns.net
jandmisia.com
funnyp0sts.com
laveudelamare.com
thefanlounge.com
Targets
-
-
Target
16f7045eebb451234ca8078222c5994c_JaffaCakes118
-
Size
484KB
-
MD5
16f7045eebb451234ca8078222c5994c
-
SHA1
99e8f263f9e34ad13cb8cd6af1bb816deffb5bde
-
SHA256
ff344e635b268090aafdb8fa830e76c41f34d7cf9a9bf03ed4ede2705008bfef
-
SHA512
147d377f3f05f593e7428f5e5dd70c231e187c73de1cdf111790156060f59047e80f382805678ecd3f946c58fcf5d80f4e16d8534f07f0f7355bededb7726bb8
-
SSDEEP
12288:x0K9jbtvzZPJukNeFrmndcPeGGUQSB/a:xh/plBlMFrleGfdB/
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-