Extracted

• • Target

    78634800cef7fb1f56c83c3c46524106_JaffaCakes118

  • Size

    491KB

  • MD5

    78634800cef7fb1f56c83c3c46524106

  • SHA1

    712a5bc3efbb71b18af09096ab1304538e40de2b

  • SHA256

    5adaacc278d85267b0774c7b9fa048bcc0043ec6860e18b706b4118c34c3feef

  • SHA512

    c7a72ca3c2aec98402e65f30c5aad8d4984580e7d3c5f69993ae921faec4d178b12665c3878fe9fe80abd4c90665a234f470bc4237c2c090cb6d0242c708edf2

  • SSDEEP

    6144:cKkNvGTNnsvrtYUyfQhxxYYdOWKkFtwG5jjgWgy5O4RsOEboEv9SbHufOpLapcCI:GUFsqUiif/ObkFtpoO5vRabokNsS+2

  Score

  10^/10

  hawkeyecollectionkeyloggerspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2