General
-
Target
cb18c25c997f934bf0ef7b0e869c79ae_JaffaCakes118
-
Size
444KB
-
Sample
240830-sph5va1are
-
MD5
cb18c25c997f934bf0ef7b0e869c79ae
-
SHA1
1700768b5b0d8670700aeb08feb91f6272310a1a
-
SHA256
82c7e2de66d1f85945118b2c1056c53d893a1b7017077cb28d53759732aaad98
-
SHA512
62a445dac0c5ff42fcb264de2159bc674f4c03c3b00c4c8ea233065722c3df04477d10d42c1b7278cc4422930f3301123792596605f7155145f058ba329b1ded
-
SSDEEP
6144:t3YZlH4Y/htMCmaHKAVrs4ZoRsKhMOr2tcyiY+VfUYsuPk:t9CTeKtGsIYaUYsuPk
Static task
static1
Behavioral task
behavioral1
Sample
cb18c25c997f934bf0ef7b0e869c79ae_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
formbook
3.9
pe
maytoken.com
esportsacademyhk.com
evanjjackson.com
creeksideatbethpage.life
thebigpigfarm.com
taiwanais.com
g-lectro.com
isabellafraiss.com
warriorfarm.com
todomascotasmerida.com
jonsnow.men
foodtreebd.com
thenorthernlightsmusic.com
weiai888.com
sklepfuji.com
coffindepot.com
swingerssociety.com
wuzixubingfa.com
iaruid.com
zgsdcf66.com
no-stringscountry.com
gongxiangzhanghaowang.com
medi-strains.net
herbmachine.com
lifemasterclass.info
hailougou.com
adrianwarrellthehistoryman.com
lilyandbrian2018.com
cruisinclassicautosales.com
00agag.com
deepmindiot.com
imtmachine.com
cuentavoto.com
my-investment-property.com
chinahuazhuo.com
napalandman.net
equifaxsecuritq2017.com
alexandre-allard.com
dtrwy.info
teamevanssd.com
abetterupdates.win
saludmia.com
maccheronicini.com
mehtassociates.com
containerlots.com
phonecreators.com
bibetts.store
godspee.com
spark-solutionsinc.com
carolachaparro.com
77arar.com
srvloprestihomes.com
crossconnect.online
tattoodedication.com
pitterpatterson.online
914eq4.faith
highlightscomunicacion.com
pikarahoitus.net
gteducorp.com
daltonic.com
xn--cpqr35ehxo.com
xn--6w2bt1chy0a.com
hanlei.site
pureandhalal.com
balonck.com
Targets
-
-
Target
cb18c25c997f934bf0ef7b0e869c79ae_JaffaCakes118
-
Size
444KB
-
MD5
cb18c25c997f934bf0ef7b0e869c79ae
-
SHA1
1700768b5b0d8670700aeb08feb91f6272310a1a
-
SHA256
82c7e2de66d1f85945118b2c1056c53d893a1b7017077cb28d53759732aaad98
-
SHA512
62a445dac0c5ff42fcb264de2159bc674f4c03c3b00c4c8ea233065722c3df04477d10d42c1b7278cc4422930f3301123792596605f7155145f058ba329b1ded
-
SSDEEP
6144:t3YZlH4Y/htMCmaHKAVrs4ZoRsKhMOr2tcyiY+VfUYsuPk:t9CTeKtGsIYaUYsuPk
-
Formbook payload
-
Suspicious use of SetThreadContext
-