Static task
static1
Behavioral task
behavioral1
Sample
155ɫվ.url
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
155ɫվ.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Crack/Normica_View_Pro.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Crack/Normica_View_Pro.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Setup/Install.msi
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Setup/Install.msi
Resource
win10v2004-20240802-en
General
-
Target
8c9c864fda3dc5b1ca33fced77d5f9e8_JaffaCakes118
-
Size
13.0MB
-
MD5
8c9c864fda3dc5b1ca33fced77d5f9e8
-
SHA1
339aef7544af0e8596f5211f9eaa42094c26c339
-
SHA256
84a24d0de32577beeec9818e4b711b0e0d8a84f7f851ed4aaeeb85e54b41508a
-
SHA512
531849ee284cd202ffb6f3b71cb3e40363ce89de5839b3b72001dc4f3dddd4a231a4028c2a94c34712fdfaaca16e3666e96c33aa13742234dedc8d738aac1e05
-
SSDEEP
393216:w9bhnjXHVMXMgfgazsNAonP7SHScTW1bGkqsK:w9bhTH7igazrHjTW1il
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Crack/Normica_View_Pro.exe
Files
-
8c9c864fda3dc5b1ca33fced77d5f9e8_JaffaCakes118.zip
-
155ɫվ.url.url
-
Crack/Normica_View_Pro.exe.exe windows:5 windows x86 arch:x86
49dae81ce9fcfe95fe9f75eddf5c0a0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
wininet
InternetReadFile
norm
?RotateBitmap@CBmEmfObject@@QAEXPAUMYBITMAP@@H@Z
whiptk.7.12.601
??0WT_Point_Set_Data@@QAE@HPBVWT_Logical_Point@@D@Z
vic32
ord82
psapi
EnumProcesses
user32
CopyImage
gdi32
CreateDIBSection
msimg32
TransparentBlt
comdlg32
GetFileTitleA
winspool.drv
GetPrinterA
advapi32
RegDeleteValueA
shell32
SHGetFolderPathA
comctl32
InitCommonControlsEx
shlwapi
PathRemoveFileSpecW
oledlg
ord8
ole32
OleIsCurrentClipboard
oleaut32
SystemTimeToVariantTime
gdiplus
GdiplusStartup
winmm
PlaySoundA
version
GetFileVersionInfoA
imm32
ImmReleaseContext
Sections
.text Size: 3.9MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 163KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
DJiNN.nfo
-
FILE_ID.diz
-
Setup/Install.msi.msi