0bc2d7d643056a1dedab2af681fb44ed_JaffaCakes118
- SHA256 f07cfd6befeff9ba1e74ab66896cb288a5e1eb1fe77a59c08343d8a010d68303
Overview
overview
6Static
static
3fck.exe
windows7-x64
1fck.exe
windows10-2004-x64
1findcheck.dll
windows7-x64
1findcheck.dll
windows10-2004-x64
1findcheckb.dll
windows7-x64
6findcheckb.dll
windows10-2004-x64
6findchecke.exe
windows7-x64
6findchecke.exe
windows10-2004-x64
6uninstall.exe
windows7-x64
1uninstall.exe
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fck.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
fck.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
findcheck.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
findcheck.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
findcheckb.dll
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
findcheckb.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
findchecke.exe
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
findchecke.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
uninstall.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
uninstall.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 0bc2d7d643056a1dedab2af681fb44ed_JaffaCakes118
- Size 2.4MB
- Sample240621-qf3rsa1dkd
- SHA256 f07cfd6befeff9ba1e74ab66896cb288a5e1eb1fe77a59c08343d8a010d68303
- MD5 0bc2d7d643056a1dedab2af681fb44ed
- SHA1 289eb5a3bb8487960145c12070b4380d6bb5d409
- SHA512 da900eebc5cae3a5f2321b7d773f43e5c87d462d2f6cfe1c4ae9e3e2e8b3b88f19c2c9f07ff63e54dfc4959f5657ca32ab39499c5db7973637707eb9d64ef1dc
- SSDEEP 49152:LpTxLmDEIp7BkE0jU5UGFQfIqtKYGppmcx+tJ1alBppMJqdvJeads:LpdGEckEVUG2IJTiQO1YGJqdvVs
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/fck.exe unpack001/findcheck.dll unpack001/findcheckb.dll unpack001/findchecke.exe unpack001/uninstall.exe
File Explorer
-
0bc2d7d643056a1dedab2af681fb44ed_JaffaCakes118.zip 2.4MB
-
fck.exe.exe 1023KB
-
findcheck.dll.dll 1.4MB
-
findcheckb.dll.dll 810KB
-
findchecke.exe.exe 1013KB
-
ies.tml1B
-
ls.plc1KB
-
uninstall.exe.exe 1.1MB
fck.exe
- SHA256 c658d36639780bcaa2b0556b4a4c898391a2e05092783996884c270eff9d3b47
- MD5 751c602f63dd498a7581565aedd58d47
- SHA1 4771589fcfe552f37cb9f733de4299943148e7de
- SHA512 63402a7652712cfb13dab88b1c7c522b7993b43bc34b1e0a90c3610d9bfd1bb873ee2954d69c0384c759701fbfa1f914ad3ce2fc04a02c5c27dfee624340eb0c
- SSDEEP 12288:WuEGjD5tZ3+7pdJLo9qrLSnKcWNFjKbpaaBPIjj+ABozLxI6DjJwP7Y:gGX5tJidRoM+nUNFjKbpllU+gG9I6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
749324
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
728KB
Virtual Size
727KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
215KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
findcheck.dll
- SHA256 42d9bb61fa5c3beac4bbc9961571f6e062ea9e0913df06071df2f26c4e922daa
- MD5 cfb7249923e4ef0462ae28c44955ae4c
- SHA1 92b21405ba8e66fa25d8d7f6ab55de8af94c865d
- SHA512 cbb2581851874d56bf2b9da0e8384f15de8ed15773484d10afcd38f19091a56781c256a558b975cfb74f49d5f3a5475700154655e985a2201551ec5da4abcbf3
- SSDEEP 24576:8/YApcs4yEeoBbuQrYyFJUAlYiEjSUpT+canNRnR+RIFVhO:8/hp6Bt3J/M5pYnY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1224972
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
CODE
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
163B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
91KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
findcheckb.dll
- SHA256 fac1d0c80f11d2f9a7a1382a42a2defe163ea86a77953aeaead465a79996fcd5
- MD5 df3c24d64838088bf4ae0c61d88c4e73
- SHA1 4bc130b6a5f775e4d34f4156415bb469e87c45e7
- SHA512 2d789c5e9018ff66de8ca8757383a78eddd6c2bff6c1bbb861e76565b664b00b97cf2a982aeeee91ce6f383e3b86389965fd276943bb7a7ea6bd8b4fecea4a8e
- SSDEEP 12288:5Nrmo6MSYmAHhSdv645XqqgFILs1/tZYA/vl5dtQZLQ92BiCF2:3ajYlItJv3s1/7lt6ZEojF2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
692512
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
CODE
Size
672KB
Virtual Size
672KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
170B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
findchecke.exe
- SHA256 ea168ab72fc6d5ff05057d4a12dbf88dd38d59d2b8d1b91b38f9f4728dcb549a
- MD5 b82cf52780f79f6ad3cc7965b980a4d0
- SHA1 40f16c23f8913e0d4aea0d18592e4e78c3d67b88
- SHA512 173df09772af61235b7a245c7b3a78d5b6a8ccfa34b32c822e8764044b3ef241f62af3b0dbdd12bfcd42647bd014242c4ea962d3ffff4729d6d8e632e14d019e
- SSDEEP 12288:oQYVGXlKfjwRE+NyYq2xf2gQCdgZBbbAU98msUqDVepRQ0R7Fav2mMzFa4cQZ:hum9/AhLgQ6YbAQ/RQIFXXo4cQZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
726856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
709KB
Virtual Size
708KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
214KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ies.tml
- SHA256 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
- MD5 a87ff679a2f3e71d9181a67b7542122c
- SHA1 1b6453892473a467d07372d45eb05abc2031647a
- SHA512 a321d8b405e3ef2604959847b36d171eebebc4a8941dc70a4784935a4fca5d5813de84dfa049f06549aa61b20848c1633ce81b675286ea8fb53db240d831c568
- MD5 SHA1 SHA512
ls.plc
- SHA256 9034c892b912e9bc4aad0c78f3a0fd23ba5206481ec7dfe8e6490af083a1f862
- MD5 51886ccdda10abab600817ba3226c5de
- SHA1 e6e9d500203a07a79e5ae707d50c7be22b3f7e21
- SHA512 9ba85ba94d7b2d8e7962b7c94eeacbe9f312f1d12bc4c12ccdcc301470e97417aba53a7e82a59f894ef1e1969e718de2a56794ac1d635901a1c5f6c5779e16a8
- MD5 SHA1 SHA512
uninstall.exe
- SHA256 058642cbdb1a517c3d0a1d3e876b3d53ea3279b87e2a9ca9a2ccd61c27f892cc
- MD5 48f9888794bad16f6d7317711a2cabf9
- SHA1 3d98f09db78911309806ab4e52bf4b2837b9ef08
- SHA512 66006dc7610de6ef7e67732fc86ebd9ee6d63972914b6695096874b2dc52b24aafaf005881d377bc9f20f715a381ce560b4bdeb2470c42c7a7fc43bad0e7df48
- SSDEEP 12288:lfv2ia8oehVgZD7Nfwi1uYGnbY/VcdFiedmTnn1qdHtYWu1XcxpTIo8H2adiv+eC:B7aHpNxGnbY/sFiu41WmXctnvOw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
882112
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
858KB
Virtual Size
857KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
157KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ