Behavioral task
behavioral1
Sample
CORE10k.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
CORE10k.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
mightcraft.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
mightcraft.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
mcsetup_arm.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
mcsetup_arm.exe
Resource
win10v2004-20240709-en
General
-
Target
33e690fd0c779b84f188f16ee003372d_JaffaCakes118
-
Size
1.0MB
-
MD5
33e690fd0c779b84f188f16ee003372d
-
SHA1
59a09944fcba654e5c14c2a3bc68ef426d357afa
-
SHA256
593861d16ba8113fda7996ed4100a31921746a9aacc19ae40c7ae29686d69c26
-
SHA512
4bc2fa5f251f819844d239401bf83fc53bcf3a3aa36d8658c858ab31af948daa1e4197453ab12da26d7c97dabf6388e6add1b94ee245e67569547d15017e1f36
-
SSDEEP
24576:8R91tthlXJIwusGp/y0pnXlHchXIFQ4R48B2+/gL1r2s:8VtthlXJtusGLnVbQ4RxB3/4P
Malware Config
Signatures
-
resource yara_rule static1/unpack001/CORE10k.EXE upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CORE10k.EXE unpack001/mcsetup_arm.exe
Files
-
33e690fd0c779b84f188f16ee003372d_JaffaCakes118.zip
-
CORE10k.EXE.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 13.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 129KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
COREPDA.NFO
-
Cracked.zip.zip
-
mightcraft.Exe
-
FILE_ID.DIZ
-
QQT.nfo
-
mcsetup_arm.exe.exe windows:4 windows x86 arch:x86
d4ff4e9520d2b9d618be12fecec0c0ac
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
LoadResource
SizeofResource
FindResourceA
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
DeleteFileA
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStartupInfoA
LockResource
lstrcpyA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetModuleFileNameA
lz32
LZCopy
LZOpenFileA
LZClose
user32
MessageBoxA
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 925KB - Virtual size: 928KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
oFFS3T.nfo
-
releases.cr