Static task
static1
Behavioral task
behavioral1
Sample
medik.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
medik.exe
Resource
win10v2004-20240508-en
General
-
Target
436a498290b66d3d0d224f7e8a47b2a3_JaffaCakes118
-
Size
7.8MB
-
MD5
436a498290b66d3d0d224f7e8a47b2a3
-
SHA1
dae5fbba355a82dabd0863eefda83de0f46997c2
-
SHA256
0f21d7e1dd06bcf41ad3bfd9f9378b1742c843cb1b6f3a012710fcf8aa0484a5
-
SHA512
ba6b22fcedbc418d3c1d0a3963b02144b1606039301d8ec7ed9c090e165eb2ec09110c8d68cef153a07820f49bd7c2b77f8553e553a9fa970fe268e7a52d8a9b
-
SSDEEP
196608:qfJv9gWhNM8frcMRJ9o/5fxrYetqKsaI2ctbAbdRqt4YrhF6igBkl1KGgzj:qfJVgWhNM8foCJW/5fxrYNa5ctsbmOww
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/medik.exe
Files
-
436a498290b66d3d0d224f7e8a47b2a3_JaffaCakes118.zip
-
LEKARSTVA.blb
-
LEKARSTVA.dat
-
LEKARSTVA.idx
-
VRUZKA_MKB_LEK.dat
-
VRUZKA_MKB_LEK.idx
-
medik.exe.exe windows:4 windows x86 arch:x86
61dd5088012346099248cbf54da723a5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
CharNextA
advapi32
RegCloseKey
oleaut32
SysFreeString
mpr
WNetOpenEnumA
version
VerQueryValueA
gdi32
Pie
ole32
IsEqualGUID
comctl32
ImageList_Add
imm32
ImmGetContext
winspool.drv
GetPrinterA
shell32
DragFinish
comdlg32
PrintDlgA
wsock32
send
winmm
PlaySoundA
crypt32
CertOpenStore
gdiplus
GdipFree
usp10
ScriptPlace
oledlg
OleUIObjectPropertiesA
Sections
.MPRESS1 Size: 5.8MB - Virtual size: 29.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE