13e8616673a37715f239a90c459060f3388b577bef7e58f20f50295a0f9e703c

Sharing

Copy URL Twitter E-mail

General

Target
2f416b7a58deefb212e5c07fe73139dd_JaffaCakes118
Size 2.7MB
Sample240709-gx2flszbpp
SHA256 13e8616673a37715f239a90c459060f3388b577bef7e58f20f50295a0f9e703c
MD5 2f416b7a58deefb212e5c07fe73139dd
SHA1 bd8d4f6d8d6e12f08376ba547215d30834ff91ca
SHA512 7f76f706e8a0b96053a31e75ffdc9749304ec41ccd05513f739420032a52d09a485602dfa10d29e9e143ea5b3a83c5090469845764986dd598c9f5927126344d
SSDEEP 49152:gh+rY6QBxj3stByLy1JmzOkXQmdJr3CeI4qY/OciLq26EhIE0f9eIleHOKAGXxB7:b4ytMmJmzTgmP3n1q2PYz6II1oKaOP0L
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  2f416b7a58deefb212e5c07fe73139dd_JaffaCakes118
- Size 2.7MB
- SHA256 13e8616673a37715f239a90c459060f3388b577bef7e58f20f50295a0f9e703c
- MD5 2f416b7a58deefb212e5c07fe73139dd
- SHA1 bd8d4f6d8d6e12f08376ba547215d30834ff91ca
- SHA512 7f76f706e8a0b96053a31e75ffdc9749304ec41ccd05513f739420032a52d09a485602dfa10d29e9e143ea5b3a83c5090469845764986dd598c9f5927126344d
- SSDEEP 49152:gh+rY6QBxj3stByLy1JmzOkXQmdJr3CeI4qY/OciLq26EhIE0f9eIleHOKAGXxB7:b4ytMmJmzTgmP3n1q2PYz6II1oKaOP0L
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Base64.dll
- Size 4KB
- SHA256 7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554
- MD5 f0e3845fefd227d7f1101850410ec849
- SHA1 3067203fafd4237be0c186ddab7029dfcbdfb53e
- SHA512 584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a
- SSDEEP 48:SxSrr7xd14m4bLKwvnvcfDw1hEiauGkDVK+hIg4qT9/3lt:zr7xd14m4qw/vGwrEickDVthcE/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/BrandingURL.dll
- Size 4KB
- SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
- MD5 71c46b663baa92ad941388d082af97e7
- SHA1 5a9fcce065366a526d75cc5ded9aade7cadd6421
- SHA512 5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
- MD5 SHA1 SHA512
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- MD5 00a0194c20ee912257df53bfe258ee4a
- SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/blowfish.dll
- Size 22KB
- SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
- MD5 5afd4a9b7e69e7c6e312b2ce4040394a
- SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
- SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
- SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/inetc.dll
- Size 20KB
- SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
- MD5 50fdadda3e993688401f6f1108fabdb4
- SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
- SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
- SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  ChnCharInfo.dll
- Size 381KB
- SHA256 56c61d14fa39e167205125f3d77c0640cd2e991bfcdfc1050b0647c2d4b0d7dd
- MD5 b8bb34a6ecf0e61c750dd158f87fda14
- SHA1 a0246b347f07470c089672eb5e329b140156853b
- SHA512 d4fb2d82450a597418b3cfdca012939ff7204e2f1596c4dec2c7f462edaeb6882069fd594de643faf1bb118cd604a7ce84351f3c829998dccc9a8d15a01ed634
- SSDEEP 6144:aC8p4HNX4MGBJpV/o0ULr9Acp2AO57r6y8ZI9C7s7glZuDkl5NdCgP:aCq4t4BJvo0Kr9JFO57r6RZHI7mygP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  DevComponents.DotNetBar2.dll
- Size 2.4MB
- SHA256 8122ac66237d02f22684737f44b959a295330bb0540e8d920ea1f30e70870052
- MD5 f44f0ed1eb08040c47b160ff57027e87
- SHA1 5e68e633223a2c918c79bd115c4eacc8e8cc70b7
- SHA512 6300bb83e0a3f9d1ed2f11f2cea222d75c093fe4873cfa64117f874fde1024de9b23a1c86c1047c29ce1d81dac4c266855fae1f166255c965dae4ba287136bc7
- SSDEEP 24576:2VNjZ9wl3IhV4lr3nr+ttYytsYne2sVMavxO1jQbNTJkNxfGgoG/RDp+y:2VNjZWie3wg+Z1jQbMNxfUEj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  Interop.MSXML2.dll
- Size 84KB
- SHA256 e6fe625e83568ce1b4e355eb2b07e28f89aec042db35fed6b91ce4e4d8b1fbc2
- MD5 5056857b59dde3735adc3f9464f994e5
- SHA1 ca108b10cc6ac441b91092de53346a8fb20a5fbd
- SHA512 75f05cc35378c21ef17abf8125161dc089fb9d846153eb14792e254cdeae804ef46e091852db0c64963b57e96b279e596454be061ec8edff5dd825d211a474c6
- SSDEEP 1536:6cqs/QtIEOwMoBUXvS7NqQKC8h3SaiSZaSA8:6cqMybUXvS7IQSlSa7HA8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  Interop.SHDocVw.dll
- Size 128KB
- SHA256 a6e1f70d3d3ab78c121d17f4d13b7aa0b4aa405822039daae9ab5a80996fbf28
- MD5 182f052d92115aa5a04ae460c7a9e386
- SHA1 58d23fae166ab14b669ab76df64b53625d722ecd
- SHA512 9029587b7d7427307c7c581fed6dd5849d8eb6e7af9565e3dd20b5048e60659a501bc93285188c679c3158377b7f28a7ade88820c3c261ddad4b2a3ba03a9b78
- SSDEEP 3072:ONknBTRIuXP+EYJO/01arQhkze+psvCNATWR0X6VI7OZc/S9QjmBknKFYLmXwqUG:ONknBTRIuXP+EYJO/01arQhkze+psvCa
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  IrisSkin2.dll
- Size 528KB
- SHA256 49740ab7dbdadfa7554734d7ca59bd26d50d8486b16d3e44b68a0755dca22222
- MD5 47a971ed9601f1a3c00c8200dfd6dc79
- SHA1 0aa9bc5331bd29032ab04ef530c893baaddf2a57
- SHA512 8b0a8ad0eca5f0354dd7bb64b49f2c764070ad33de603603c195d6d0ec555df0464f2f15871d3dd29e89c4eb81de2e39448ee4660bf2590f2f20a27bfc5361fa
- SSDEEP 6144:HkZrzTZiuamzuW51XYIPsZM9ffjgZvyj5cuwIgDAm2kcTP2Z2fZjKRzdyJrJO6d9:pmzCIkI7YqzGzsvex6fBF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  bdyxw.dll
- Size 588KB
- SHA256 5c058f4159120537469cb36a46c5b7256a1d8e6ed2cfc8f835227c18baa47108
- MD5 6c97ee37bfa9ca6e79902f4ef86d988e
- SHA1 2f2d9a4428f009c3f30b1dc560ee03f8e5c2fc00
- SHA512 627e85b3f0772165bb6faf65e14f770ee0bcd5acefe9237fc4038726ae70484711bbf8a68fae0901ec4e59869acaf8b1bcd24e452b00cbb75c803e269e876fb3
- SSDEEP 12288:u+CaLaXwkm43R7IuFiQJp3qTbDIXa0YeQhVTT1wTjVbC:SaIPmMFia1qTbKa5BwT1C
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

evasion themida
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
behavioral25 behavioral26
- Target
  edithtm/index.html
- Size 1KB
- SHA256 9921f5bd2770a3b0ccf52a3090293ae5ae84eaa7d9882fbed1d4b2a80c8d68bd
- MD5 abe74dd0b84a7e1c38dde4367ce9716c
- SHA1 b87d72984b802879f0426fdf4fa3974c97126b78
- SHA512 1661a53f2b046bd791d5f956ca467b099ecdc8072fe18ca323b759c8b88ac516c96a53d22a32f354b9abbd1cf1202f308bf931d5f9898362162d0ac89118a8ef
- MD5 SHA1 SHA512
Score

1^/10
behavioral27 behavioral28
- Target
  edithtm/kindeditor.js
- Size 99KB
- SHA256 22e4fb0664ad847a74d32821c256a8fbdac12eac994a9d5db900e78f33fbfa07
- MD5 427b3ae3c99f99ed947eabcdab1792c0
- SHA1 16d6edc0a578c0485eb5f70025433abb0069f394
- SHA512 3b906dd77af9ba2c2a9f2a0e3c269bed36c61e9b527150c229f8d9ad81ebab1193f33314747857b988606843f5afc3c0f64a912e47fa31b6acf5d470e3ede470
- SSDEEP 1536:Xd80vLsQv1fi1w5fQiwEiu35LSkP9FJ1b4/NYH2Bez:XBVLBNFiNnA
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral29 behavioral30
- Target
  edithtm/plugins/flash.html
- Size 1KB
- SHA256 3341518351a806032bb362c8cd0cf8453fab62b7c7d93141ae24a508179b1358
- MD5 83ab29cf4df5516e1a25864670986226
- SHA1 a7024d907a2d5f14b48a7885c2f6fa41376f6573
- SHA512 ea81ac07632ed52c7b27134173768e3d492648b7bc992a26b5d240a01db8450d1f4b1ce999258ef71530a843e5adca88260870a6d2251c9dadea350a57257251
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Identifies Wine through registry keys

Themida packer

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32