Extracted

• • Target

    78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118

  • Size

    1.2MB

  • MD5

    78fc807a0d0b41a65654733c4b7203c9

  • SHA1

    ee9a0f2a0cce28e33336c4987ac31992fbef6751

  • SHA256

    884051874b4ba6a28d2a50586da27bb841dde9ce3c770cc7a3bd239a36f17c54

  • SHA512

    d13348c5bc061dd29ed74335b087c2a932481f38064ec000b39eaee8a9b61c43b6be8bc439515646dc2c99f02a2a7571f8f1f178874e3cd830b4907a851d3843

  • SSDEEP

    12288:RgahAN4aebneohnpATnGKfsJDyfgrcA0V387bt4Z/bX8MkQBt8fA:m2ainjhpQk1LwhUbt4VX8XQBt8I

  Score

  10^/10

  agilenethawkeyecollectionkeyloggerspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2