6a96fc8ce45b90e6ea767a08a07fe1ad_JaffaCakes118
- SHA256 99b14ade8ea9c02b24c71a5583d02322594460af4d2fe734ec2af3d6c805f027
Overview
overview
10Static
static
10Awesom-O/A...er.exe
windows7-x64
7Awesom-O/A...er.exe
windows10-2004-x64
7Awesom-O/A...er.exe
windows7-x64
7Awesom-O/A...er.exe
windows10-2004-x64
7Awesom-O/A...or.exe
windows7-x64
7Awesom-O/A...or.exe
windows10-2004-x64
7Awesom-O/A...er.exe
windows7-x64
7Awesom-O/A...er.exe
windows10-2004-x64
7Awesom-O/A...om.exe
windows7-x64
7Awesom-O/A...om.exe
windows10-2004-x64
7Awesom-O/Awesom-O.dll
windows7-x64
3Awesom-O/Awesom-O.dll
windows10-2004-x64
3Awesom-O/Awesom-O.exe
windows7-x64
3Awesom-O/Awesom-O.exe
windows10-2004-x64
3Awesom-O/c...ll.vbs
windows7-x64
1Awesom-O/c...ll.vbs
windows10-2004-x64
1Awesom-O/c....1.pdf
windows7-x64
3Awesom-O/c....1.pdf
windows10-2004-x64
3Awesom-O/c...cs.pdf
windows7-x64
3Awesom-O/c...cs.pdf
windows10-2004-x64
3Awesom-O/c...ll.vbs
windows7-x64
1Awesom-O/c...ll.vbs
windows10-2004-x64
1Awesom-O/c...le.vbs
windows7-x64
1Awesom-O/c...le.vbs
windows10-2004-x64
1Awesom-O/c...ies.js
windows7-x64
3Awesom-O/c...ies.js
windows10-2004-x64
3Awesom-O/c...es.vbs
windows7-x64
1Awesom-O/c...es.vbs
windows10-2004-x64
1Awesom-O/c...ets.js
windows7-x64
3Awesom-O/c...ets.js
windows10-2004-x64
3Awesom-O/c...ons.js
windows7-x64
3Awesom-O/c...ons.js
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Awesom-O/AOHelpers/Awesom-O Debugger.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Awesom-O/AOHelpers/Awesom-O Debugger.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Awesom-O/AOHelpers/BotINIManager.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Awesom-O/AOHelpers/BotINIManager.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Awesom-O/AOHelpers/PREditor.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Awesom-O/AOHelpers/PREditor.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Awesom-O/AOHelpers/Realm Fixer.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Awesom-O/AOHelpers/Realm Fixer.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Awesom-O/Auto-Awesom/Auto-Awesom.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Awesom-O/Auto-Awesom/Auto-Awesom.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Awesom-O/Awesom-O.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Awesom-O/Awesom-O.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Awesom-O/Awesom-O.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Awesom-O/Awesom-O.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Awesom-O/config/PR_Docs/ao2luafull.vbs
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Awesom-O/config/PR_Docs/ao2luafull.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Awesom-O/config/lua/Docs/PR2.1.pdf
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Awesom-O/config/lua/Docs/PR2.1.pdf
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
Awesom-O/config/lua/Docs/PR_Docs.pdf
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Awesom-O/config/lua/Docs/PR_Docs.pdf
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Awesom-O/config/lua/Docs/Reference/AO2Lua_Full.vbs
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Awesom-O/config/lua/Docs/Reference/AO2Lua_Full.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Awesom-O/config/lua/Docs/Reference/UltraEdit/LuaPR_Wordfile.vbs
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
Awesom-O/config/lua/Docs/Reference/UltraEdit/LuaPR_Wordfile.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
Awesom-O/config/lua/Docs/itemEntries.js
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
Awesom-O/config/lua/Docs/itemEntries.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
Awesom-O/config/lua/Docs/itemTables.vbs
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Awesom-O/config/lua/Docs/itemTables.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
Awesom-O/config/lua/Greedy/PickitRevolution/classic/magic/amulets.js
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Awesom-O/config/lua/Greedy/PickitRevolution/classic/magic/amulets.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
Awesom-O/config/lua/Greedy/PickitRevolution/classic/magic/weapons.js
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
Awesom-O/config/lua/Greedy/PickitRevolution/classic/magic/weapons.js
Resource
win10v2004-20240709-en
| resource | yara_rule |
|---|---|
| static1/unpack001/Awesom-O/plugins/Awesom-O.dll | family_strela |
| resource | yara_rule |
|---|---|
| static1/unpack001/Awesom-O/AOHelpers/Awesom-O Debugger.exe | upx |
| static1/unpack001/Awesom-O/AOHelpers/BotINIManager.exe | upx |
| static1/unpack001/Awesom-O/AOHelpers/PREditor.exe | upx |
| static1/unpack001/Awesom-O/AOHelpers/Realm Fixer.exe | upx |
| static1/unpack001/Awesom-O/Auto-Awesom/Auto-Awesom.exe | upx |
AutoIT scripts compiled to PE executables.
| resource | yara_rule |
|---|---|
| static1/unpack002/out.upx | autoit_exe |
| static1/unpack003/out.upx | autoit_exe |
| static1/unpack004/out.upx | autoit_exe |
| static1/unpack005/out.upx | autoit_exe |
| static1/unpack006/out.upx | autoit_exe |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Awesom-O/AOHelpers/Awesom-O Debugger.exe |
| unpack002/out.upx |
| unpack001/Awesom-O/AOHelpers/BotINIManager.exe |
| unpack003/out.upx |
| unpack001/Awesom-O/AOHelpers/PREditor.exe |
| unpack004/out.upx |
| unpack001/Awesom-O/AOHelpers/Realm Fixer.exe |
| unpack005/out.upx |
| unpack001/Awesom-O/Auto-Awesom/Auto-Awesom.exe |
| unpack006/out.upx |
| unpack001/Awesom-O/Awesom-O.dll |
| unpack001/Awesom-O/Awesom-O.exe |
| unpack001/Awesom-O/plugins/Awesom-O.dll |
| unpack001/Awesom-O/pthreadVC2.dll |
| unpack001/Awesom-O/uninstall.exe |
| resource | yara_rule |
|---|---|
| static1/unpack001/Awesom-O/uninstall.exe | nsis_installer_1 |
| static1/unpack001/Awesom-O/uninstall.exe | nsis_installer_2 |
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=466, id=1, productName=Unmarked objects,
count=58, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=466, id=1, productName=Unmarked objects,
count=58, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=466, id=1, productName=Unmarked objects,
count=58, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=466, id=1, productName=Unmarked objects,
count=58, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=466, id=1, productName=Unmarked objects,
count=58, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=466, id=1, productName=Unmarked objects,
count=58, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=52, id=110, productName=VS2005 build 50727, version=50727,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=470, id=1, productName=Unmarked objects,
count=57, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=52, id=110, productName=VS2005 build 50727, version=50727,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=470, id=1, productName=Unmarked objects,
count=57, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=52, id=110, productName=VS2005 build 50727, version=50727,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=470, id=1, productName=Unmarked objects,
count=57, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=126, version=50327,
count=52, id=110, productName=VS2005 build 50727, version=50727,
count=192, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=470, id=1, productName=Unmarked objects,
count=57, id=114, version=50727,
count=37, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Detects Strela Stealer payload
Unsigned PE
Checks for missing Authenticode signature.
count=17, id=125, productName=VS2005 build 50727, version=50727,
count=45, id=110, productName=VS2005 build 50727, version=50727,
count=98, id=109, productName=VS2005 build 50727, version=50727,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=119, id=1, productName=Unmarked objects,
count=23, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
file http://luaedit.luaforge.net/download.html
file http://www.aobot.org
file http://www.aobot.org/
Detects Strela Stealer payload
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=150, version=20413,
count=5, id=149, productName=VS2008 build 21022, version=21022,
count=13, id=131, productName=VS2008 build 21022, version=21022,
count=4, id=147, productName=VS2008 build 21022, version=21022,
count=12, id=123, productName=VS2005 build 50727, version=50727,
count=29, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=298, id=1, productName=Unmarked objects,
count=160, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=19, version=8034,
count=2, id=14, version=7299,
count=53, id=1, productName=Unmarked objects,
count=5, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=4, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Unsigned PE
Checks for missing Authenticode signature.
NSIS installer
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,