ffc57d84cdd184d90966b6d0bfd925c3_JaffaCakes118
- SHA256 b8fecafb0ea8ed59d3c66ea34f14f25f1354589750fc854ff78c11e10cc3421b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Transfer Swift Copy.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
- Target ffc57d84cdd184d90966b6d0bfd925c3_JaffaCakes118
- Size 577KB
- Sample240421-vsmcsafg86
- SHA256 b8fecafb0ea8ed59d3c66ea34f14f25f1354589750fc854ff78c11e10cc3421b
- MD5 ffc57d84cdd184d90966b6d0bfd925c3
- SHA1 f280979956162f01c8119328df78ce64247ff3da
- SHA512 550fa6203cb4ef67bea0140681626ba5589f3d5f0a30dc46a7bcd9b4acb0cbef8987b16aeacd8589916418abbd8f229433efed624cda5a4633fe8491a0663676
- SSDEEP 12288:XZRR5hRueKeuUMd1oBPIEQq+ePa9Xtz+vTV8+7gSPRqJwA5:X7rKmMsBPINXYTVP7giI++
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Transfer Swift Copy.exe
File Explorer
-
ffc57d84cdd184d90966b6d0bfd925c3_JaffaCakes118.eml 577KB
-
Transfer Swift Copy.zip.zip 345KB
-
Transfer Swift Copy.exe.exe 528KB
-
email-html-2.txt.html 22KB
-
email-plain-1.txt2KB
-
image.png.png 56KB
Transfer Swift Copy.zip
- SHA256 89b50c9939ccc7767d545713c2f5f9d0b28c977fd9082d138eddfb268b8bef0f
- MD5 310b0a0806baf1f98195664908d2ce4e
- SHA1 03ab56f012c3cd2a81f418ee4712dbc06f1950cd
- SHA512 4125dd01c34867a0802dea99d29f6d8a69c4718f2846eb44647dae33c13d02593921936a87545ac6194457f9631f4a10a5e49c8b3bf275c4076bc3008b7dd106
- SSDEEP 6144:h68YQVfdJAyMN59bKV5L7kBGo86yTTazyMonFbw5fJzT4+xz7MCGONR1qailqrOp:hyQfPAHhKV5xoyTYonFk594fCGONR1qR
- MD5 SHA1 SHA512 SSDEEP
Transfer Swift Copy.exe
- IMPHASH 97750a00050e37c7b56da7bc3864f0f1
- SHA256 e51b63aacca71c639c6f3b12a6b0eede821c54567125b52a21a0a24ec540d04a
- MD5 0d5bfa60273cf3871c7596b7aa2fc447
- SHA1 451461604085634e62758f142fbca0bdbf12a044
- SHA512 33afea5b2367b0f4a0f222d14d4fe531c8b076ff1c253897b4e69f9a2956637573284cb7433d75e09d6aeb6f1891a3b962672cd7be561f25e0649def528276a2
- SSDEEP 12288:ZhQVh9a17gNm5YnXDdx2OjKhNHySntntjEyjIOm+mmmTIhfCGONcR9Ok:ZhQVh9FDdx2GKzSSt9ZSsmToik
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15668
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\xampp\htdocs\Cryptor\ffc27e084b2c4bf1bd9d43ea8b953aba\Loader\pr2\Release\pr2.pdb
dbghelp
MiniDumpWriteDump
kernel32
CreateFileW
GetFileSize
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetCurrentProcess
GetCurrentProcessId
VirtualProtect
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetConsoleCtrlHandler
GetProcessHeap
LCMapStringW
DecodePointer
GetTimeFormatW
GetDateFormatW
OutputDebugStringW
OutputDebugStringA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
CompareStringW
SetLastError
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
WriteConsoleW
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetCurrentThread
GetFileType
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
user32
LoadIconW
LoadCursorW
GetWindowLongW
MessageBeep
MessageBoxW
GetWindowTextW
SetWindowTextW
EndPaint
BeginPaint
GetDC
UpdateWindow
GrayStringA
TranslateAcceleratorW
LoadAcceleratorsW
SendDlgItemMessageW
GetDlgItem
EndDialog
DialogBoxParamW
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
comdlg32
GetOpenFileNameW
Name
.text
Size
257KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=25203,
count=131, id=261, version=25203,
count=18, id=260, version=25203,
count=19, id=259, version=24123,
count=18, id=260, version=24123,
count=39, id=261, version=24123,
count=9, id=257, version=25203,
count=117, id=1, productName=Unmarked objects,
count=1, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
email-html-2.txt
- SHA256 c2a4f1304c706d1c697ac623a1b5b10e432b8c5b1b56905977211e40180ebef9
- MD5 a923722050f1b787d32eaffc55adc38d
- SHA1 54fe473c9a601b82115de948693fcd62c75854ce
- SHA512 961e200d153b8bc108b7d2746311694cafc9d27621cca383ec77e524f8c3b9c8ebeb8e41bbe2fbea7d2a9c58caad4ca2d0306a4e4e108eb0ce483787126e182c
- SSDEEP 384:BezUYe3efeJezzezHeveYle8e4eWe/ese1aeKCejJeRe9eBkibIsIedeze3eYez2:Bezbe3efeJezzezHeveYle8e4eWe/esM
- MD5 SHA1 SHA512 SSDEEP
email-plain-1.txt
- SHA256 1881bf55b3100249de220360ad0dc7515a528b8c130b19734d563db3b6a5b808
- MD5 360b730eed8034633ec125878cec57c3
- SHA1 0510c813a94e0e929a7fe090b97274236319bbaa
- SHA512 d16de8839cc63b12288ed10b5e8636da36a01aa215f52b51d033bfa9cce383e79dcf6bc7f5684b093df7773fbae88587027a825c2462fd5593c32258a268d52e
- MD5 SHA1 SHA512
image.png
- SHA256 2fbe4f701a26a527e56c4115478d97966d1280d7ace2d89ec4ed6ca663793c45
- MD5 196efc3e8a55c55a9cbf6031ba781665
- SHA1 54b77899eebcc8603b55b55bac17d7eb4be04903
- SHA512 c3d5b68ea9416013d4552f9989b9d5bce85a36d74fc547d50086f9ef5869a3237941a590788ea8ba4c0f6dd756b0e29633d1dc9e02b9b6524c99c4314c327edc
- SSDEEP 768:To6B/O1b06fMOEi6pD3lPFenBGSETUvqMML/ZM/NfxdNl2B0BAZj6VNRwy:TVIIuKPw8EMVMhPN/cOZ
- MD5 SHA1 SHA512 SSDEEP