0250c196e99dd7378c5617e90489c729_JaffaCakes118
- SHA256 570f20894dfd4b8cd95a3ea84f9b3c6f27e20e44c1f87526a007521cf879dc60
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ipscthm.dll
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ipscthm.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
ipscthmuninst.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
ipscthmuninst.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 0250c196e99dd7378c5617e90489c729_JaffaCakes118
- Size 560KB
- Sample240620-dprdwsvhqc
- SHA256 570f20894dfd4b8cd95a3ea84f9b3c6f27e20e44c1f87526a007521cf879dc60
- MD5 0250c196e99dd7378c5617e90489c729
- SHA1 c8d115150ef426beaab459f080474a042e1f34d4
- SHA512 18e107202eac3ed17b1a00061a088064c6886c4f46611824030b7b762f66b79f6d022b2f6aeea437775d90d03f9417821c94bd9f8a73894a358f28516d2f4c42
- SSDEEP 12288:O28tG04wEpLjHkBd/icSkh0ha2TRiFY6DaA7F:O28tfpN7dS6l2NiS6DaYF
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ipscthm.dll unpack001/ipscthmuninst.exe
File Explorer
-
0250c196e99dd7378c5617e90489c729_JaffaCakes118.zip 560KB
-
ipscthm.dll.dll 578KB
-
ipscthmuninst.exe.exe 566KB
ipscthm.dll
- SHA256 0e2a3fa878ee0d610561a4836fdb9df5c735eef4e67a6cae6bd7811b78e7b248
- MD5 d8136d9fd38feee2970a7653afabccdc
- SHA1 7569097137b033c9f6d99555fc14c4edbfb7f7cd
- SHA512 a80b3da88aa33d5ee6e0c425b8fd98f93d11940967235a278cc27265ffd0bdd436b9ccbd5a252441de9a00c576dcde2fc84e41c41595d1ec14b35e053c96f58b
- SSDEEP 12288:QuxivUHqKj8erDCwQsgGW8aR3gW5mncaAcs:QKkS8QtB3Mv4r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
507448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
CODE
Size
492KB
Virtual Size
491KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ipscthmuninst.exe
- SHA256 e619406f1e0a9cde0d68612477d8a4f357f2e5bb2fd192bb4f9245ed1fefd49a
- MD5 5697e14cb9abfc0c0cdc4e81e7f1e917
- SHA1 f3803dbdf0ec0cb8918f0639a7bb50e97ae811df
- SHA512 74b8cc1b0ff4f34a81e7b93ec31ff46b6889268db4f70fe50c4204ed82f758740cff2e98fa0068f7d730508ce4e25c5e47c638db13ac4952a695bf0d4c9583a3
- SSDEEP 12288:dqSeOTosGnY/5lwLKwIDjeVyzMmLDJxKvuCa:ddNGnY/5KAOV9mLFxKvL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
494224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
479KB
Virtual Size
478KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ