Static task
static1
Behavioral task
behavioral1
Sample
Фундамент 10.1/setup_foundation_10.1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Фундамент 10.1/setup_foundation_10.1.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Фундамент 10.1/setup_special.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Фундамент 10.1/setup_special.exe
Resource
win10v2004-20240426-en
General
-
Target
7275a9c693191a2c04fe432c32a46e49_JaffaCakes118
-
Size
4.1MB
-
MD5
7275a9c693191a2c04fe432c32a46e49
-
SHA1
868d2da1b734b72b3aaf16be7e999b91a4e0198c
-
SHA256
204bc56591e631b4f8dc37c08566850fd92f07a619b5c7d0ce41084afcd8ae88
-
SHA512
2b2262ea2be97a17ac8cb6ee433c5283bbc4cc05ae01d3b409b9c2bcfd475aa704d47dcebc030fc891f78af3581ae3d0f08257b2aaf72e8644dee5efe2cc9c09
-
SSDEEP
98304:amqgfVEToni7t3R2UHCYqFVhO8TVtAErf8EQonRE2Z4657bkUZqsPj7ST:ZTVJi7tJ3kVjh18ZmE/657bvPj7ST
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Фундамент 10.1/setup_foundation_10.1.exe unpack001/Фундамент 10.1/setup_special.exe
Files
-
7275a9c693191a2c04fe432c32a46e49_JaffaCakes118.rar
-
Фундамент 10.1/secret.txt
-
Фундамент 10.1/setup_foundation_10.1.exe.exe windows:4 windows x86 arch:x86
547c94826e733fab0c2f59262339e0b1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringA
VirtualFree
WriteFile
VirtualAlloc
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
lstrcpyA
CreateFileA
lstrlenA
ReadFile
SetFilePointer
GetWindowsDirectoryA
GetSystemDirectoryA
ExitProcess
GetCurrentDirectoryA
GetTempPathA
lstrcpynA
GetModuleFileNameA
InterlockedIncrement
GetModuleHandleA
user32
LoadCursorA
SendMessageA
GetDlgItem
SetCursor
MessageBoxA
wsprintfA
ShowWindow
FindWindowA
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 842B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Shared Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Фундамент 10.1/setup_special.exe.exe windows:4 windows x86 arch:x86
547c94826e733fab0c2f59262339e0b1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringA
VirtualFree
WriteFile
VirtualAlloc
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
lstrcpyA
CreateFileA
lstrlenA
ReadFile
SetFilePointer
GetWindowsDirectoryA
GetSystemDirectoryA
ExitProcess
GetCurrentDirectoryA
GetTempPathA
lstrcpynA
GetModuleFileNameA
InterlockedIncrement
GetModuleHandleA
user32
LoadCursorA
SendMessageA
GetDlgItem
SetCursor
MessageBoxA
wsprintfA
ShowWindow
FindWindowA
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 842B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Shared Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ