6d82d3927b9b87282ed17b9df5477539_JaffaCakes118
- SHA256 44b7f1a0bbdab6175749184a630e7445b16eb0c9e6671c453aabce8f3ced5922
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hab.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
hab.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
hab.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
hab.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 6d82d3927b9b87282ed17b9df5477539_JaffaCakes118
- Size 1.1MB
- Sample240524-ghx5msfe99
- SHA256 44b7f1a0bbdab6175749184a630e7445b16eb0c9e6671c453aabce8f3ced5922
- MD5 6d82d3927b9b87282ed17b9df5477539
- SHA1 ebf81aa55cdb676ef7b5dcd0ec47188c641e93c4
- SHA512 7666e617167801009e7ad11b8c926ae341dc08b6d2bb849ede1118eca583ef0f2881a7b0c3f59c079e78da9d40fb6401ecb1b502d8b6ff691c0ab34b8a9838b1
- SSDEEP 24576:G9x3C+HqUjAE3QWhqx7Z96qoi/9x3C+HqUjAE3QWhqx7Z96qoiF:G9x35H38CQR7ZKy9x35H38CQR7ZKW
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/hab.exe unpack003/hab.exe
File Explorer
-
6d82d3927b9b87282ed17b9df5477539_JaffaCakes118.eml 1.1MB
-
EDG7602020092601540012_3645.gz.gz 417KB
-
hab.exe.exe 802KB
-
EDG7602020092601540012_3645_760.gz.gz 417KB
-
hab.exe.exe 802KB
-
email-html-2.txt.html 2KB
-
email-plain-1.txt1KB
EDG7602020092601540012_3645.gz
- SHA256 31d55debc8f525bb3324fb890640497cafd5de643a17d56623ca61762932295e
- MD5 e9249199088e6e65ea7867c267578ccd
- SHA1 077e8bf5d361eda105b1b3569aaf8a8a2a9b0481
- SHA512 b2ef45d88e5c72817335b8e7c0a996ba2e316b394be2ca920c62738d4bbf03707afaec9384223276391df5e41562f2e79d75a29e6b6536e9762189d6b57aa6e2
- SSDEEP 12288:H2iL3jdTII8QEE2XdOxIbtDZWlQYhMvmEMFH2aO3:WsVHdEEYOxKtDYlzhMvmEMFHN0
- MD5 SHA1 SHA512 SSDEEP
hab.exe
- SHA256 adcf0b372228b76e987deecd0f45733e93dee3a798258546612a8f2232044d81
- MD5 6fa59c037085c8f1d744da3f0bcf4404
- SHA1 99540076afe5478f0268f5cc35449b510b883fc2
- SHA512 23f8d74f6483886f71a939f7ea36dcc476a95115e6d05db0e1fa657495dadd8864f7ff2a3849f8fa3849decd5d8e53e0fce8f0184a1f30bd9f914c1dce9b9f0d
- SSDEEP 12288:Cb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hO+mVvldcgcbqSw:7eSHhYRRxOVGcxJBdb1LwvOc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
531492
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
515KB
Virtual Size
515KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
EDG7602020092601540012_3645_760.gz
- SHA256 31d55debc8f525bb3324fb890640497cafd5de643a17d56623ca61762932295e
- MD5 e9249199088e6e65ea7867c267578ccd
- SHA1 077e8bf5d361eda105b1b3569aaf8a8a2a9b0481
- SHA512 b2ef45d88e5c72817335b8e7c0a996ba2e316b394be2ca920c62738d4bbf03707afaec9384223276391df5e41562f2e79d75a29e6b6536e9762189d6b57aa6e2
- SSDEEP 12288:H2iL3jdTII8QEE2XdOxIbtDZWlQYhMvmEMFH2aO3:WsVHdEEYOxKtDYlzhMvmEMFHN0
- MD5 SHA1 SHA512 SSDEEP
hab.exe
- SHA256 adcf0b372228b76e987deecd0f45733e93dee3a798258546612a8f2232044d81
- MD5 6fa59c037085c8f1d744da3f0bcf4404
- SHA1 99540076afe5478f0268f5cc35449b510b883fc2
- SHA512 23f8d74f6483886f71a939f7ea36dcc476a95115e6d05db0e1fa657495dadd8864f7ff2a3849f8fa3849decd5d8e53e0fce8f0184a1f30bd9f914c1dce9b9f0d
- SSDEEP 12288:Cb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hO+mVvldcgcbqSw:7eSHhYRRxOVGcxJBdb1LwvOc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
531492
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
515KB
Virtual Size
515KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
email-html-2.txt
- SHA256 a5e268fb5dfbdd7e12e12b16dc6a554d191c31bdae63569f01d9c37d7ce8565f
- MD5 97349b867cc945e88c5429543560990c
- SHA1 9e25c7d8b8f0e4a69fff0f538b34fb0901203a17
- SHA512 ad38cc3b7ed2f7166e7b6daf6f0beadd15b4307aaa73a371705ee40f79de5cc36f0dd1925cc700ba10dc5795b3697bcc7ebc4d1e9d20bf3ffbc55015d3775895
- MD5 SHA1 SHA512
email-plain-1.txt
- SHA256 0023733cd4011d3290265b47f1ea1cbb8e559b9f214c9b7d8e10282dde0d9025
- MD5 6095cece1f8841be91ef57cab1a8831a
- SHA1 eae823d8f806ff3053cbfeb2c0762641a3bec8f8
- SHA512 58e4e05e4e2dd1227aa39bba22824cc3c52357157ed15c8e99a9942af61116f5851baf07e60c920ccdc7e6d9b5b2b18651d1fa5cae191ed808df6b7f1d16163a
- MD5 SHA1 SHA512