Behavioral task
behavioral1
Sample
DiA_bolic.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
DiA_bolic.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Sources/007.html
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Sources/007.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Sources/009.vbs
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Sources/009.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Sources/010.vbs
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Sources/010.vbs
Resource
win10v2004-20240802-en
General
-
Target
ac2710cb799801901d7f68413ad3958c_JaffaCakes118
-
Size
50KB
-
MD5
ac2710cb799801901d7f68413ad3958c
-
SHA1
880d49f847d128e4a5a8f0f87de6d4740e61c687
-
SHA256
93a23dace0224e567cf7766c0a0ecf62c838099c22c6bd4d60cce4bb4513c7de
-
SHA512
b3f284a61ec0a2494ccef537a4c5b7fbb46ca7388f49e7e40ff44f5ae7a1352feab7ab8d2b5e8a05ad9ad1e13378443736a63c4276d6eb05d0c36ef1288a4039
-
SSDEEP
768:AuL2NV61rKQQicnzoBs2akwmAMABjFz/ki8tGDHNwk7LYKm3sJHa0bfNXF4C:AuS6mnzo67M6jFsZ0wk7cKmcBTpXFv
Malware Config
Signatures
-
resource yara_rule static1/unpack001/DiA_bolic.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/DiA_bolic.exe unpack002/out.upx
Files
-
ac2710cb799801901d7f68413ad3958c_JaffaCakes118.zip
-
DiA_bolic.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Editorial/001.txt
-
Editorial/002.txt
-
Editorial/003.txt
-
Editorial/004.txt
-
Editorial/005.txt
-
ReadFirst.txt
-
Sources/001.txt
-
Sources/002.txt
-
Sources/003.txt
-
Sources/004.txt
-
Sources/005.txt
-
Sources/006.txt.html .js polyglot
-
Sources/007.txt.html
-
Sources/008.txt
-
Sources/009.txt.vbs
-
Sources/010.txt.vbs
-
Sources/011.txt
-
Sources/012.txt
-
Sources/013.txt
-
Sources/014.txt
-
Tutorials/001.txt
-
Tutorials/002.txt
-
Tutorials/003.txt
-
Tutorials/004.txt
-
Tutorials/005.txt
-
Tutorials/006.txt
-
Tutorials/007.txt
-
Tutorials/008.txt