General
-
Target
4105b6a32b90180cd3dfe3c359061f46_JaffaCakes118
-
Size
956KB
-
Sample
240713-kwsc4awhng
-
MD5
4105b6a32b90180cd3dfe3c359061f46
-
SHA1
ea131838d1e1ed495d75c76b956c790f071e002e
-
SHA256
3f1f0dce8eb0b1a98912a8c08208c5d4425e013e20719aca1d14ca4924f841c6
-
SHA512
c7c039b347b1a1a0d63d3ab81a3024d7f7bd669325e341bf27d0b62960ddbd56f17b836e98d9cb78ce6feaaf1a7160d1613a4e57d634a712ee28a21683215bbb
-
SSDEEP
12288:fO4jeQ5jsruJH+ReJqvqfLRXwK4+HNONnvsyl5RODp2K046Mnq0UnsO5lJkKzUva:2HXRYFphm9vFrPMOiPRVZIRfBiBk
Static task
static1
Behavioral task
behavioral1
Sample
4105b6a32b90180cd3dfe3c359061f46_JaffaCakes118.exe
Resource
win7-20240705-en
Malware Config
Extracted
formbook
4.1
rf3t
palmettohomeswakulla.com
sorelleapparel.com
abouttohour.com
ogrownhemp.com
themontagnard.com
zarioch.space
lty712.info
ajdstone.com
600plusgymspa.com
schmitzland.com
luhuigw.com
mysafeplacetoinsure.com
barkpark.club
investigation-science.com
sermonartnotes.net
gorgeousflippinllc.com
smarttrendshop.com
markusjungfoto.com
glyzaelbol.info
thewiseowl.art
ladycigarclub.com
compasschick.com
xrk72.xyz
mynextversion.com
stresimer.com
bugitee.com
tofigaming.com
themokyoco.com
rickysinmiami.com
terashun-shop.com
istanbulartroskopi.xyz
sleekrevenge.com
linqlax.com
scenic-usa.com
catnapupuncture.com
ioqoqoquyi.xyz
romantictravels.love
skillfulscooptoseetoday.info
eatonmilano.com
fhaonlinehomes.com
jumpmine.com
economybevmachinery.com
stereodeluxemusic.com
652ch.com
ecnomi.com
eastvalleyloanofficer.com
naytor.online
mpteaminc.com
ghalerodkhan.com
rentalpixels.com
jerrysmunchies.com
jackohoeg.com
haroldbrandon.com
sipsongpanna.biz
gooddeats.com
dtdfamily.com
metaphilestudios.net
bgari.com
sarsukeiw.xyz
brunsbouw.net
myfilthy.com
mcnallynd.xyz
corridapromocao.com
nishiawakura-rain.info
logjed063.xyz
Targets
-
-
Target
4105b6a32b90180cd3dfe3c359061f46_JaffaCakes118
-
Size
956KB
-
MD5
4105b6a32b90180cd3dfe3c359061f46
-
SHA1
ea131838d1e1ed495d75c76b956c790f071e002e
-
SHA256
3f1f0dce8eb0b1a98912a8c08208c5d4425e013e20719aca1d14ca4924f841c6
-
SHA512
c7c039b347b1a1a0d63d3ab81a3024d7f7bd669325e341bf27d0b62960ddbd56f17b836e98d9cb78ce6feaaf1a7160d1613a4e57d634a712ee28a21683215bbb
-
SSDEEP
12288:fO4jeQ5jsruJH+ReJqvqfLRXwK4+HNONnvsyl5RODp2K046Mnq0UnsO5lJkKzUva:2HXRYFphm9vFrPMOiPRVZIRfBiBk
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-