c04025b7d26272ffd36007aa510124dc_JaffaCakes118
- SHA256 6555b534d16a2d938b089dfd3b4878429298f1b328406a6e8ad65932221671d1
Behavioral task
behavioral1
Sample
msd32.dll
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
msd32.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
sim.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
sim.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
新云软件.url
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
新云软件.url
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target c04025b7d26272ffd36007aa510124dc_JaffaCakes118
- Size 1005KB
- Sample240825-jd7vdsvalp
- SHA256 6555b534d16a2d938b089dfd3b4878429298f1b328406a6e8ad65932221671d1
- MD5 c04025b7d26272ffd36007aa510124dc
- SHA1 cc22157fd42b981a5b5eb0bb87d07a15ff753912
- SHA512 dd313685b6cc435c963e24f41d1c263ef33121338e23c859b950296bf94b383690b575813606076949ed841e73ecd9557bd5a8a60b0453248073fcd1f036b425
- SSDEEP 12288:zJAVTR4ekp0JFqVW0OvARHKNSIoebv0y10b3Qvq7JWWrB0psh/UGGNlhbEE3OqLo:zGJ0WNcCH8y0bGpI/HGXN73OKfqwKr0i
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/msd32.dll acprotect -
resource yara_rule static1/unpack001/msd32.dll upx static1/unpack001/sim.exe upx - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/msd32.dll unpack002/out.upx unpack001/sim.exe unpack003/out.upx
File Explorer
-
c04025b7d26272ffd36007aa510124dc_JaffaCakes118.rar 1005KB
-
data.mdb624KB
-
msd32.dll.dll 277KB
-
out.upx.dll 708KB
-
odbc.xml64B
-
sim.exe.exe 747KB
-
out.upx.exe 5.2MB
-
ykssoft.key311B
-
新云软件.url.url 133B
data.mdb
- SHA256 bb07f68c9c8a01e640af6de0ec42cac3419b71ef34dc8682675e4085c3cfba99
- MD5 3cc3494a1e5449acda219bfe5d2cc689
- SHA1 6308fc73696446f7333a0b6505051351558c5dff
- SHA512 985c4297b3efc41a84601977990bb9e912cc76556976be2d3f7808100a992d40a2fc1d1efa401d71cfc1e0663b7d1eca38403488f42d476dc4c236cee83f6e6f
- SSDEEP 1536:EZz6S1m4A63Fi6lHvtpxC3feVfe0oXCi4QgP2MYyDC:EZ+S1lnlVGXqQgP
- MD5 SHA1 SHA512 SSDEEP
msd32.dll
- SHA256 eae2854537c45f3ad2091f199afb723bef97049e4b8518d35f55d66ca4e41926
- MD5 87cc08fa69a335e420c54bb8f07f3feb
- SHA1 339f952b281bc503d6c0f740af6e99ba49a03a23
- SHA512 3b23072ebbc30a938a5847b20087775b704b1f078c77bbebc2ccc5f866f53325fee05bb7f06f0f418188336d62092eb14d0088b5c6b7e560ba7e8c59b8f2773e
- SSDEEP 6144:o8XUsRlr/I7PNHJ+zOJGp3ZuXkTPH/onoqNapX5aWGdCJ:vJyPeyE60THonoqApX9GdU
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
868976
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ab
che_md
sqlinfo
xi
Name
UPX0
Size
Virtual Size
576KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
269KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=12, version=7291,
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=44, id=19, version=8022,
count=24, id=19, version=8034,
count=661, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=105, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=193, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=74, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=48, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
out.upx
- SHA256 3464d7cf9e98fad612768114b1a12b85e79339579a95b6aee9b5bde49b304bbf
- MD5 3c80fa40526fd749b8d451ebcd55db65
- SHA1 bd6ef2734b9ac2c9372913e164babef91e6b6c0d
- SHA512 a739e57da5c36a36bcf0804c33686902f8b1821c2133d72b558f43ebb79afeeefaba9b46765781175f4a2892f106c048ba20eb216eba94eef5f107401d14bb06
- SSDEEP 6144:ZoNNcZAelXfDov+RNPN+kGyCNbfMKpHke4YccXLp91FPD/H2zGpGw3LO/bSfZ:Zo/UAelFl+kGyqrHysRFPD/Ihw7OT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
348255
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
460KB
Virtual Size
459KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
76KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=12, version=7291,
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=44, id=19, version=8022,
count=24, id=19, version=8034,
count=661, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=105, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=193, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=74, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=48, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
odbc.xml
- SHA256 0f88e9c9a9adc8d2637e696a4f32246ff32655f90e224babcbee8c34966e39f1
- MD5 429ec05726e765ec3dc4d50ec44c9fb1
- SHA1 8f2e0680f1df8a5970dcd5a9cb17c8fcf4723057
- SHA512 cb0d871099878d442c61d71c77f5e72c3c1c4a7c9bcfe9d764535a31e7622b84e9f82ed010e55284769f8038c0443ad844b17d3c09d52999bd2908d38c5e848d
- MD5 SHA1 SHA512
sim.exe
- SHA256 513f359f0ef0cabed3cad96cd79cc503f280a247c95aa643161f51591c8c6ee2
- MD5 f4406dc7d2593fc92726a00bf9a4e5ef
- SHA1 ff00065c8172c56869f599d99fa993b200eb509e
- SHA512 04dc7ff4ee1ad5f3c33e8b74d0a87fe0e175522fe2f65b9155b2bb55dbe954ec5fb0b1834a7379eaffc7f77c5c900861aef7790ad50c19fdab37a34bb0f929d6
- SSDEEP 12288:yazgRUe5ErSap+mQoKPpDqWGHnEokeubN18iTk/7Yn7er2aAn1vVTK:CURrnsm5KPnGHKXHlTk/787erLg1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5819248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
735KB
Virtual Size
736KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=11, version=8798,
count=5, id=12, version=7291,
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=35, id=2, version=7303,
count=48, id=19, version=8022,
count=26, id=19, version=8034,
count=717, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=138, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=215, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=135, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=59, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
out.upx
- SHA256 fadf64211d0dc07f538a2533b7aa8b942e1b9be9fb03ca10fa0f06d11c623dfc
- MD5 a04133b6a98279a453750544e5e7de8e
- SHA1 6723db62c4ed9e7e8e270305eb0699d6fa2ef566
- SHA512 90d2d305a1b23667816e6958a5e8dfe58380aa45ccb6f1f1a004aa9c21723ab8f2926c156be0697e7bcd5f9382cdd91947c9b080c3ddf4e5d6080258050ff8a2
- SSDEEP 49152:wbLtDmnPezxUjoKaHhWws8rHd351T4ih66wf1n+8t:9UxUjiHhWIt510ih66wN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1382444
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
108KB
Virtual Size
497KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8798,
count=5, id=12, version=7291,
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=35, id=2, version=7303,
count=48, id=19, version=8022,
count=26, id=19, version=8034,
count=717, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=138, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=215, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=135, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=59, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
ykssoft.key
- SHA256 2e617ae6bdcfdaff9f77d3ef26c43566bc7feb7da0c0d25d8099d8cd13507b58
- MD5 3d2cba0aaa5a4b3942d94477efce5d41
- SHA1 7f02517ce2d1e33545fd240bf9c27dc19f73c647
- SHA512 037e1a6421dfc7ae274f95af0cf9c5423bc6e8a4c4cffc7262bd1c5b8f9c21b9d9a6ca4ff43764568f2254b37e561bb2986731b61b592f7a60fd4edd240256e6
- MD5 SHA1 SHA512
新云软件.url
- SHA256 df65af1fc1e09f6effbde7e0ef1cb64d6caeef1f62b0e6467821efa032533678
- MD5 4f0017b3b346bd0626f0c3b915e6e734
- SHA1 823bf3ff9e16cd636c9dc0dc690d6a586fcbfe92
- SHA512 0f5eb5024cf6a0323f7998d419995a707c48de917a5899a185369e6acfeb17c09ffa03f7d110adc87b8de20b7d4bf30d50c72479bfb18614d2e21cbe169dc5a6
- MD5 SHA1 SHA512