General
-
Target
2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118
-
Size
745KB
-
Sample
240509-wsnfhsfe7w
-
MD5
2b3c4a317d8fc64ca9991aec36624e6d
-
SHA1
db802611ad8a645d12a609f596d152c2ea5d0d52
-
SHA256
82f4ebd30b18743d8cc409de5931a978434755705af9bbfa3c6d8d0b34d30a6b
-
SHA512
09cab61855eb7dffbe26a3ac51338510d74b5c6b7fbccb5610b295ac2ccf199c4b559ca3162b984689b535c9f7a53ee708671bba44c8fb3fbf5910aca77c0ef1
-
SSDEEP
12288:k0QQSy3frualbxbrBsbkqgkEKjzH4tvF89:RSyrskJuc9
Static task
static1
Behavioral task
behavioral1
Sample
2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
formbook
4.1
gtb
kbsvipbags.com
grandma-salt.com
org-id100.info
marketobserverllc.com
robjmccarthy.com
orbitnest.com
7d5d.com
hotdealsallday.com
kaban-shitsuji.com
eivisionexport.com
luatfv.com
creationxbydom.com
realjuku.com
roast365.com
epis2020.com
schcman.com
xn--pimi-ooa.com
jobshustle.com
rightnewswire.com
seguonra.com
graececonsulting.com
fondflowers.net
khawarlearners.com
andkth.xyz
chengfu114.com
kombitfashion.com
thameensa.com
sopwidget.com
zethcameron.com
numbered-tags.com
mazasilva.com
huawang.love
19songs.cloud
coachinggay.com
arazonatile.com
westburyclose.com
ovejaalbox.com
pickiuram.com
fabiecreations.com
1in7proman.com
fancefeet.com
imsfirm.com
befache.com
theracingplace.com
themoddgroup.com
monitoringsibi.run
foodonwish.com
38sdsd.com
serilga.com
digisaze.com
sandynoses.com
bright-brave.com
xn--gwos-epa.com
hkganghua.com
roofingsantamonica.com
migranreceta.com
whendoamericans.com
thepurrfectprints.com
aldosminconclave.com
modifiedhomes4vets.net
crowd50.online
fintechtreding.com
sop-games.com
alltechlansing.com
kelitastudio.com
Targets
-
-
Target
2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118
-
Size
745KB
-
MD5
2b3c4a317d8fc64ca9991aec36624e6d
-
SHA1
db802611ad8a645d12a609f596d152c2ea5d0d52
-
SHA256
82f4ebd30b18743d8cc409de5931a978434755705af9bbfa3c6d8d0b34d30a6b
-
SHA512
09cab61855eb7dffbe26a3ac51338510d74b5c6b7fbccb5610b295ac2ccf199c4b559ca3162b984689b535c9f7a53ee708671bba44c8fb3fbf5910aca77c0ef1
-
SSDEEP
12288:k0QQSy3frualbxbrBsbkqgkEKjzH4tvF89:RSyrskJuc9
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-