Extracted

• • Target

    7b1f0563576b3c5af9f4b6faf07529bb_JaffaCakes118

  • Size

    328KB

  • MD5

    7b1f0563576b3c5af9f4b6faf07529bb

  • SHA1

    a604fffc91898085c5978c5c09ab375140902c20

  • SHA256

    1ea8ef6762ff35035136847b8d52f181a10831ba519bb4f8662396f55d3aaa2f

  • SHA512

    139e6ec33f9651586511807993d91d8aebfa59750df1be6a6a663ad8d36a32623246dae0627ebd397e76c80a46794d637b8953924ecc1cafcaa09fdbbd962ed5

  • SSDEEP

    6144:nd6a9GdC+9G33XV4nPZ9dQZrV3qh3vhF/J8wR9b4V/f/xWs0/WEFb865QrTQg5v:d6a9+C+I3novdaVOxhb4VMsOdg5v

  Score

  10^/10

  hawkeyecollectionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2