223882875e16e5ca4af9a6b7bc323f50_JaffaCakes118
- SHA256 f1972152b892010f35e44b9549dd9914ca657b08b71f8a479c8dcab6efde2158
-
Detect Neshta payload
Behavioral task
behavioral1
Sample
keygen.exe
Resource
win7-20240419-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
keygen.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
audio-editor.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
audio-editor.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 223882875e16e5ca4af9a6b7bc323f50_JaffaCakes118
- Size 8.5MB
- Sample240507-3ladmsed8t
- SHA256 f1972152b892010f35e44b9549dd9914ca657b08b71f8a479c8dcab6efde2158
- MD5 223882875e16e5ca4af9a6b7bc323f50
- SHA1 b1eb3f129b3bd541be11ea9643339d19571e9c02
- SHA512 7009430cb03092193cb7811cf543107133b3d6eab9ad49c84686d5d283cc6f5977194297f9199ba9344a03aff67f832991869bf27b8b0dc31e0f3fd9176c1e23
- SSDEEP 196608:t1RaI8mnsuMj9Nn0jtAcHJTNMfFsHxz+ymrT7Ke:t1Rx8mN+chNMdsHxz+rT9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Neshta payload 2 IoCs
resource yara_rule sample family_neshta static1/unpack001/audio-editor.exe family_neshta - Neshta family
-
resource yara_rule static1/unpack002/keygen.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/keygen.exe unpack003/out.upx unpack001/audio-editor.exe
File Explorer
-
223882875e16e5ca4af9a6b7bc323f50_JaffaCakes118.rar 8.5MB
-
Keygen-AMPED.rar.rar 66KB
-
amped.nfo5KB
-
file_id.diz331B
-
keygen.exe.exe 58KB
-
out.upx.exe 84KB
-
audio-editor.exe.exe 8.4MB
Keygen-AMPED.rar
- SHA256 d1c48a1447c17fa12327f4a2ef380628f21c516dccddf8669e6ea5e14c84de24
- MD5 5e5db222f72575b4aa5fadefa21270d4
- SHA1 a9cbbe6299172e21bc3c8f93e740443563956a1f
- SHA512 ff6f7895a21b5fbecf359b5c8b3a063b27b4e201c6f7e1e06df8dd15ba8bb6f39434bb1add93268e94e39c7e7964edccac294ace382fbe628f262d2e7cc3da0e
- SSDEEP 1536:qs9Y0hGgjSnRK/ILjogVofk2UM5uTYwr5:qs9Y0zj0o/YjJVocFB
- MD5 SHA1 SHA512 SSDEEP
-
Detect Neshta payload
amped.nfo
- SHA256 d76cb35aa79e75caf067c84d840ed6b4b7c079e05d417ee0e6dcebcba4c3e8c7
- MD5 49bd3c0ae5214cedb81face3ac3413d5
- SHA1 b5ce7dbe6ecbcc932f049b6f3f00738ccdb33cc8
- SHA512 e62961b2af7864906cdf4f0b3eb85135176d4c53bb5df7b83b744b046b047f879aad93cdae1fc3aced77cc5d98b3fe8a69e112f91a17601641eb05da36f113c3
- SSDEEP 48:xG6fjX7BEpXoviLlMSOiM3mpgCgYa9fZEklplLg7YcO5sYem/:xNX7BEmWlMSOiM3vftpWOim/
- MD5 SHA1 SHA512 SSDEEP
-
Detect Neshta payload
file_id.diz
- SHA256 d85c1892e095d6ca01517e36dfa13743bb4d0b8248bb8b277aa45a40612380b0
- MD5 7cd7f0d64cae4c0b84521ec2b23853bc
- SHA1 3b9dc8066dd7833053ea079107d936a13e22cd61
- SHA512 52369a5604611038afb05dc69a0f06ab3c4ee597a020730545c8a332772574f1aa83b76567f28f20c69781f03c118b793732237be5e95a6bf9ab6eb35df187ee
- MD5 SHA1 SHA512
-
Detect Neshta payload
keygen.exe
- SHA256 995a6d74217c9920424caf47c3c93c1fb7380d5232abb26000e49a3cd84ac99a
- MD5 ba2fa029b1fba62d292bd76338e92a59
- SHA1 0ba912180a11fb55665eaae29cd46de6ba961251
- SHA512 8044c915819994f3c8d45dbc8f85a1bb3423b852fb5004b5361e3dac35f500c1dc9aab3dc048b6aa4d70716c4b9c63479878d0fd3f58025ad1512fe643a7eb27
- SSDEEP 768:khTLVF2H8taZ+TCATR/UjmLWxEOfR3a/ILjlelg759VH9mfah/2/UM5uYQYwr:g9Y0hGgjSnRK/ILjogVofk2UM5uTYwr
- MD5 SHA1 SHA512 SSDEEP
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
41KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 1447d8d391b48a667f3244c766153548885a39c3e3328c34123763524eb5b842
- MD5 b49b99cfa96cd4b46681b4dddf4265ed
- SHA1 53b7a891fd60b41e50ff734a4a110ab8ef638562
- SHA512 8f27f406916feea540b76827a56bb073128c98590cfdd15721a6ba54310cff9f9e16c41c654d66b480ed684f521e65116a9e4a9ec2105e8ebc9af515d4de4191
- SSDEEP 1536:c3h2NSBKba75g1rGVnc2UM5uTYwrdxsgOyiT9OgU:HNiKbASgVncFFx8yiT9OF
- MD5 SHA1 SHA512 SSDEEP
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43868
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
audio-editor.exe
- SHA256 8b856b6771937633d7182909ee9867f142a658db6c5bdcfede47d63d9e64fb3f
- MD5 0866a8d9074a11e86aba7b23b4d0e80e
- SHA1 31ec4aff8130f90cca32a4ae35fa0e9323d487f6
- SHA512 52954295401b4f971df627fa5d9b43dd4ccdac5d6782a0d48d221ce9df8e75d1e13863519c8509927f579cdec56bc9e1481de2902900246dde8f5e358b03b977
- SSDEEP 196608:O1RaI8mnsuMj9Nn0jtAcHJTNMfFsHxz+ymrT7KT:O1Rx8mN+chNMdsHxz+rTA
- MD5 SHA1 SHA512 SSDEEP
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ