Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order # K007I21539059 USHOMEDEPOHQ on 2021-7-25.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Purchase Order # K007I21539059 USHOMEDEPOHQ on 2021-7-25.exe
Resource
win10v2004-20240226-en
General
-
Target
f40824944a4e9b863d24ff81f7bbc201_JaffaCakes118
-
Size
590KB
-
MD5
f40824944a4e9b863d24ff81f7bbc201
-
SHA1
6bfa20d23a266ab02537662fb521c0cdf023ca55
-
SHA256
375b017e62d63235799b796af9a95186fba64d7dfc6874cdd3c1b118b0968956
-
SHA512
55f822fe174afc8b2bd6e85c13ad74ed72a935806a5ca263b1d62285c18fef080c11c9c86aab6656ccbcc4cbd72e8dc3f63e0b309ab084516335869d5f638674
-
SSDEEP
12288:/hIpf+NinP/TjFXbZtH9cbubC/YwBZ4d601CAZ334gZVy:/JNin3FXbVcbiC/7BZQLNy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Purchase Order # K007I21539059 USHOMEDEPOHQ on 2021-7-25.exe
Files
-
f40824944a4e9b863d24ff81f7bbc201_JaffaCakes118.eml
-
https://www.google.com/maps/search/Vesse+3+%0D%0A++++++++++++++++++11415,+Tallinn,+EE?entry=gmail&source=g
-
-
Purchase Order # K007I21539059 USHOMEDEPOHQ on 2021-7-25.lzh.rar
-
Purchase Order # K007I21539059 USHOMEDEPOHQ on 2021-7-25.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 499KB - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
email-html-1.txt.html