Extracted

• • Target

    362073a5ce3273ad4dcfc8e6c47ec3ca_JaffaCakes118

  • Size

    1.6MB

  • MD5

    362073a5ce3273ad4dcfc8e6c47ec3ca

  • SHA1

    7948c767c9d666b4fd73d7b6180c5fd78c302ac1

  • SHA256

    e569998290b8e57cbfeea4f35425d6c79e4a6cf1bf56b316c01d8f91d269396f

  • SHA512

    15d048fbb1ab5da75818a1ea21a1d7ed4f97b394281c677c7e7a08c1291cb514500ef3078ae358d1e1eb5c9bb294ebacf075f3b3b40631bce01c92d8f00c0377

  • SSDEEP

    49152:niHexSQINK8mkzI+xNPfCH+CjIcZWzjR:niHfpNNMkpqHbIZ

  Score

  10^/10

  buerevasionloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2