Static task
static1
Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
FAnTAST/MediaMan.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
FAnTAST/MediaMan.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
MediaMan3Setup.msi
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
MediaMan3Setup.msi
Resource
win10v2004-20240802-en
General
-
Target
96cd7562127ff5e0720361796b40efd7_JaffaCakes118
-
Size
13.9MB
-
MD5
96cd7562127ff5e0720361796b40efd7
-
SHA1
90314eb2b2a62910d196ad61384e20e08311c73e
-
SHA256
f82481e5a1426b0ae5eace35d7642070715cf2782ad832305f51c41510578311
-
SHA512
6a8a7fb2c2e742e183f5f3718256b4ec234ae83518029b203f884f9fabfa6dfe56cdef6f4bb78cce487b019b26689f4711da89d1babbf58bedb26bbc6883f01a
-
SSDEEP
393216:OovQcDmS1MhKCAnP52QUPFYqE7YCCWJd2iY0:h4WFS7OPkQUPEnhJ8x0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FAnTAST/MediaMan.exe
Files
-
96cd7562127ff5e0720361796b40efd7_JaffaCakes118.rar
-
155绿色软件站.url.url
-
FAnTAST/MediaMan.exe.exe windows:5 windows x86 arch:x86
666315bd9225dda7c310d3080b8eefe4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
slimbase
SlimCreateInstance
rpcrt4
UuidCreateSequential
psapi
GetProcessMemoryInfo
winmm
PlaySoundW
user32
PostMessageW
gdi32
CreateRectRgnIndirect
comdlg32
GetOpenFileNameW
advapi32
RegDeleteValueW
shell32
SHGetFileInfoW
ole32
PropVariantClear
oleaut32
SystemTimeToVariantTime
shlwapi
PathFileExistsW
comctl32
ImageList_Create
msimg32
GradientFill
version
GetFileVersionInfoW
slimsuf
SlimSUF_SetUIPreference
libcef
cef_v8value_create_double
gdiplus
GdiplusShutdown
wininet
InternetQueryDataAvailable
dbghelp
StackWalk64
Sections
.text Size: 1.4MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
MediaMan3Setup.msi.msi