Static task
static1
Behavioral task
behavioral1
Sample
Workshop www.unlockmexico.net/cdma workshop.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Workshop www.unlockmexico.net/cdma workshop.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Workshop www.unlockmexico.net/cdma_workshop_FULL_Cracked.exe
Resource
win7-20240708-en
General
-
Target
aba17279cb28a2b442e5547e0a8ea52e_JaffaCakes118
-
Size
4.6MB
-
MD5
aba17279cb28a2b442e5547e0a8ea52e
-
SHA1
f39b25ce5ea94b52208e34db28b502bb982e2ceb
-
SHA256
1abf674465790dfddd9280b8ab555928dae2fb6a879408a16cb94d0fc6a7960a
-
SHA512
ee887cfdcf250c6e9ee0b2e8cbe1348f79d38d537b73db5ec59a4f3c99a5c9057b7433a71bc0aca572a232073214fd26d7dcab4d0146075658c6d537ef7327f8
-
SSDEEP
98304:5KdNjveFzqdMuyx41O7b0pWNzNoICYBsN3d3ED/qqiHo:5KrveFzqd3QweyyJoInot3caI
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Workshop www.unlockmexico.net/cdma workshop.exe unpack001/Workshop www.unlockmexico.net/cdma_workshop_FULL_Cracked.exe
Files
-
aba17279cb28a2b442e5547e0a8ea52e_JaffaCakes118.rar
-
Workshop www.unlockmexico.net/Leer antes de abrir la aplicacion.txt
-
Workshop www.unlockmexico.net/cdma workshop.exe.exe windows:4 windows x86 arch:x86
619cbd37c91afb50adfd1979e535ddf6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
kernel32
CreateProcessA
DeleteFileA
ExitProcess
FindResourceA
ReadProcessMemory
CreateFileA
Sleep
SuspendThread
TerminateProcess
WriteFile
WriteProcessMemory
CloseHandle
ResumeThread
user32
MessageBoxA
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ARTeam Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Workshop www.unlockmexico.net/cdma_workshop_FULL_Cracked.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
Size: 349KB - Virtual size: 764KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cdmaware Size: 3.9MB - Virtual size: 10.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE