Overview

overview

9

Static

static

3

2da635d434...18.dll

windows7-x64

9

2da635d434...18.dll

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2da635d43459f79bd4ef79318284e3fc_JaffaCakes118

  • Size

    805KB

  • Sample

    240708-yxkarsyfkh

  • MD5

    2da635d43459f79bd4ef79318284e3fc

  • SHA1

    39318dd28fa4e2a7a5857000251dea6688485ef8

  • SHA256

    62e271d0b02f208a23f5d6ffd2b75a990038765d9965d6a56c80c3e7c3ac00cf

  • SHA512

    6e5bddc9a85d6f107e3035246b5ebe5afb6dee7374b30442addbae667d00ed5f1399efd19711d48287682e85028a1c6b14920e79df0d4367853966a4d33b870d

  • SSDEEP

    12288:us7PZMQhtCUyK2TK7kYFm3Z6xBRQeyyGC14yYm48t8rcYhI/JPK9JKOqLBZ9:ZPZFtCUaTU1OQ5y21xAccI/ecOe

Score
9/10
evasion

Malware Config

Targets

    • Target

      2da635d43459f79bd4ef79318284e3fc_JaffaCakes118

    • Size

      805KB

    • MD5

      2da635d43459f79bd4ef79318284e3fc

    • SHA1

      39318dd28fa4e2a7a5857000251dea6688485ef8

    • SHA256

      62e271d0b02f208a23f5d6ffd2b75a990038765d9965d6a56c80c3e7c3ac00cf

    • SHA512

      6e5bddc9a85d6f107e3035246b5ebe5afb6dee7374b30442addbae667d00ed5f1399efd19711d48287682e85028a1c6b14920e79df0d4367853966a4d33b870d

    • SSDEEP

      12288:us7PZMQhtCUyK2TK7kYFm3Z6xBRQeyyGC14yYm48t8rcYhI/JPK9JKOqLBZ9:ZPZFtCUaTU1OQ5y21xAccI/ecOe

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks