Overview

overview

7

Static

static

7

ecf46bb870...18.exe

windows7-x64

7

ecf46bb870...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    ecf46bb870e5ae83ea1b4750800c9d8e_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240411-jzsmlaad81

  • MD5

    ecf46bb870e5ae83ea1b4750800c9d8e

  • SHA1

    52052fd67d7a0e2449b93d30f4c8dc66acfcd737

  • SHA256

    c61728d51c77d2ac3b42efe76120a83537b0930128d2b9c86b86c2c82a8d808e

  • SHA512

    43a4aaf994a2a604e7f93b62bd47f217d29ecf650a18cdaa637d670087b2d08d55bf705d29c460fa587831c5cb233e0938ddb8faf7da7e2df90c98804f9aa352

  • SSDEEP

    49152:BYsbQjtQ2tNbUarvaWtZMkFvU9ia91OVg308Tu3:BYO9NarvaYvq9TrTu3

Score
7/10
evasionthemida

Malware Config

Targets

    • Target

      ecf46bb870e5ae83ea1b4750800c9d8e_JaffaCakes118

    • Size

      2.2MB

    • MD5

      ecf46bb870e5ae83ea1b4750800c9d8e

    • SHA1

      52052fd67d7a0e2449b93d30f4c8dc66acfcd737

    • SHA256

      c61728d51c77d2ac3b42efe76120a83537b0930128d2b9c86b86c2c82a8d808e

    • SHA512

      43a4aaf994a2a604e7f93b62bd47f217d29ecf650a18cdaa637d670087b2d08d55bf705d29c460fa587831c5cb233e0938ddb8faf7da7e2df90c98804f9aa352

    • SSDEEP

      49152:BYsbQjtQ2tNbUarvaWtZMkFvU9ia91OVg308Tu3:BYO9NarvaYvq9TrTu3

    Score
    7/10
    evasionthemida

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks