Overview
overview
10Static
static
102017.6.30/001.vir
windows7-x64
32017.6.30/001.vir
windows10-2004-x64
32017.6.30/002.dll
windows7-x64
102017.6.30/002.dll
windows10-2004-x64
102017.6.30/003.vir
windows7-x64
32017.6.30/003.vir
windows10-2004-x64
32017.6.30/004.exe
windows7-x64
32017.6.30/004.exe
windows10-2004-x64
32017.6.30/005.vbs
windows7-x64
12017.6.30/005.vbs
windows10-2004-x64
12017.6.30/006.vir
windows7-x64
32017.6.30/006.vir
windows10-2004-x64
32017.6.30/007.wsf
windows7-x64
82017.6.30/007.wsf
windows10-2004-x64
82017.6.30/008.jar
windows7-x64
12017.6.30/008.jar
windows10-2004-x64
12017.6.30/009.vbs
windows7-x64
12017.6.30/009.vbs
windows10-2004-x64
12017.6.30/010.vir
windows7-x64
32017.6.30/010.vir
windows10-2004-x64
32017.6.30/011.pdf
windows7-x64
32017.6.30/011.pdf
windows10-2004-x64
32017.6.30/012.vir
windows7-x64
32017.6.30/012.vir
windows10-2004-x64
32017.6.30/013.exe
windows7-x64
72017.6.30/013.exe
windows10-2004-x64
72017.6.30/014.pdf
windows7-x64
32017.6.30/014.pdf
windows10-2004-x64
32017.6.30/015.exe
windows7-x64
2017.6.30/015.exe
windows10-2004-x64
102017.6.30/016.vir
windows7-x64
32017.6.30/016.vir
windows10-2004-x64
3Behavioral task
behavioral1
Sample
2017.6.30/001.vir
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
2017.6.30/001.vir
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
2017.6.30/002.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
2017.6.30/002.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
2017.6.30/003.vir
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral6
Sample
2017.6.30/003.vir
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2017.6.30/004.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
2017.6.30/004.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
2017.6.30/005.vbs
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral10
Sample
2017.6.30/005.vbs
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2017.6.30/006.vir
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral12
Sample
2017.6.30/006.vir
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
2017.6.30/007.wsf
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
2017.6.30/007.wsf
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
2017.6.30/008.jar
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
2017.6.30/008.jar
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
2017.6.30/009.vbs
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
2017.6.30/009.vbs
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
2017.6.30/010.vir
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
2017.6.30/010.vir
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
2017.6.30/011.pdf
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral22
Sample
2017.6.30/011.pdf
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
2017.6.30/012.vir
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral24
Sample
2017.6.30/012.vir
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
2017.6.30/013.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
2017.6.30/013.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
2017.6.30/014.pdf
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral28
Sample
2017.6.30/014.pdf
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
2017.6.30/015.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral30
Sample
2017.6.30/015.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
2017.6.30/016.vir
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral32
Sample
2017.6.30/016.vir
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target ca0a2bd0633e8462f759a607a5f38ed8_JaffaCakes118
- Size 13.2MB
- Sample240830-ck7dwascka
- SHA256 eb39e3c3215ee01a3ed0148766b22b139d1cf42a3631b7c99144ae2d181bbb8c
- MD5 ca0a2bd0633e8462f759a607a5f38ed8
- SHA1 82d49e5b5dfc7620091ca939fe02cb389ffda78d
- SHA512 9715e45578bf743641c9179b5efa83bad756315f848ff1a99e08288565f7e8620b74192b0392a61dcf9672e66e87a86d8fbf5b9f12dd45abd6aefdef09becb99
- SSDEEP 393216:GoFNAmr9UhNiKmsu1cpYBhd3LBEAZXjgfvDbibYpSr:GonH994u0k7SG8CM0r
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
njrat
-
0.7d
-
HacKed
-
127.0.0.1:5552
-
279f6960ed84a752570aca7fb2dc1552
-
reg_key
279f6960ed84a752570aca7fb2dc1552
-
splitter
|'|'|
Signatures
- Adwind family
- JAR file contains resources related to AdWind 2 IoCs
resource yara_rule static1/unpack001/2017.6.30/008.vir family_adwind1 static1/unpack001/2017.6.30/041.vir family_adwind1 - Njrat family
- Office macro that triggers on suspicious action 16 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack001/2017.6.30/012.vir office_macro_on_action static1/unpack001/2017.6.30/028.vir office_macro_on_action static1/unpack001/2017.6.30/046.vir office_macro_on_action static1/unpack001/2017.6.30/047.vir office_macro_on_action static1/unpack001/2017.6.30/057.vir office_macro_on_action static1/unpack001/2017.6.30/060.vir office_macro_on_action static1/unpack001/2017.6.30/069.vir office_macro_on_action static1/unpack001/2017.6.30/074.vir office_macro_on_action static1/unpack001/2017.6.30/086.vir office_macro_on_action static1/unpack001/2017.6.30/088.vir office_macro_on_action static1/unpack001/2017.6.30/091.vir office_macro_on_action static1/unpack001/2017.6.30/102.vir office_macro_on_action static1/unpack001/2017.6.30/106.vir office_macro_on_action static1/unpack001/2017.6.30/108.vir office_macro_on_action static1/unpack001/2017.6.30/110.vir office_macro_on_action static1/unpack001/2017.6.30/118.vir office_macro_on_action -
resource static1/unpack007/000261712564.docm -
resource yara_rule static1/unpack001/2017.6.30/013.vir upx static1/unpack001/2017.6.30/025.vir upx static1/unpack001/2017.6.30/097.vir upx - PDF contains JavaScript
Detects presence of JavaScript in PDF files.
- PDF contains one or more embedded files
Detects presence of embedded files in PDF files.
- Malformed data in PDF
A PDF can contain malformed data to evade detection
- HTTP links in PDF interactive object 1 IoCs
Detects HTTP links in interactive objects within PDF files.
resource yara_rule static1/unpack001/2017.6.30/073.vir pdf_with_link_action - Unsigned PE 43 IoCs
Checks for missing Authenticode signature.
resource unpack001/2017.6.30/004.vir unpack001/2017.6.30/013.vir unpack003/out.upx unpack001/2017.6.30/015.vir unpack001/2017.6.30/020.vir unpack001/2017.6.30/021.vir unpack001/2017.6.30/024.vir unpack001/2017.6.30/025.vir unpack001/2017.6.30/027.vir unpack001/2017.6.30/036.vir unpack001/2017.6.30/038.vir unpack001/2017.6.30/039.vir unpack001/2017.6.30/040.vir unpack001/2017.6.30/043.vir unpack001/2017.6.30/044.vir unpack001/2017.6.30/051.vir unpack001/2017.6.30/055.vir unpack001/2017.6.30/056.vir unpack001/2017.6.30/061.vir unpack001/2017.6.30/062.vir unpack001/2017.6.30/065.vir unpack001/2017.6.30/067.vir unpack001/2017.6.30/068.vir unpack001/2017.6.30/070.vir unpack001/2017.6.30/071.vir unpack001/2017.6.30/072.vir unpack001/2017.6.30/076.vir unpack001/2017.6.30/079.vir unpack001/2017.6.30/083.vir unpack001/2017.6.30/085.vir unpack001/2017.6.30/087.vir unpack001/2017.6.30/090.vir unpack001/2017.6.30/093.vir unpack001/2017.6.30/094.vir unpack001/2017.6.30/095.vir unpack001/2017.6.30/097.vir unpack001/2017.6.30/098.vir unpack001/2017.6.30/101.vir unpack001/2017.6.30/103.vir unpack001/2017.6.30/104.vir unpack001/2017.6.30/107.vir unpack001/2017.6.30/112.vir unpack001/2017.6.30/114.vir - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/2017.6.30/112.vir nsis_installer_1 static1/unpack001/2017.6.30/112.vir nsis_installer_2 - Office document contains embedded OLE objects 1 IoCs
Detected embedded OLE objects in Office documents.
resource yara_rule static1/unpack001/2017.6.30/016.vir office_ole_embedded
File Explorer
-
ca0a2bd0633e8462f759a607a5f38ed8_JaffaCakes118.rar 13.2MB
-
2017.6.30/001.vir.vir .doc 25KB
-
2017.6.30/002.vir.dll 353KB
-
2017.6.30/003.vir.vir .rtf 635KB
-
2017.6.30/004.vir.exe 96KB
-
2017.6.30/005.vir.vbs 5KB
-
2017.6.30/006.vir.vir .doc 37KB
-
2017.6.30/007.vir.wsf 11KB
-
2017.6.30/008.vir.jar 551KB
-
2017.6.30/009.vir.vbs 5KB
-
2017.6.30/010.vir.vir .doc 90KB
-
2017.6.30/011.vir.pdf 109KB
-
2017.6.30/012.vir.vir .doc 280KB
-
2017.6.30/013.vir.exe 12KB
-
out.upx.exe 26KB
-
2017.6.30/014.vir.pdf 67KB
-
2017.6.30/015.vir.exe 256KB