Overview
overview
8Static
static
3EmulSmall/...ll.exe
windows7-x64
3EmulSmall/...ll.exe
windows10-2004-x64
3EmulSmall/...lt.sys
windows7-x64
1EmulSmall/...lt.sys
windows10-2004-x64
1EmulSmall/...ll.bat
windows7-x64
8EmulSmall/...ll.bat
windows10-2004-x64
8EmulSmall/...rv.exe
windows7-x64
1EmulSmall/...rv.exe
windows10-2004-x64
3EmulSmall/...ll.bat
windows7-x64
1EmulSmall/...ll.bat
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
EmulSmall/Автоматическая версия/EmulSmall.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
EmulSmall/Автоматическая версия/EmulSmall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
EmulSmall/Ручная/haspflt.sys
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
EmulSmall/Ручная/haspflt.sys
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
EmulSmall/Ручная/install.bat
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
EmulSmall/Ручная/install.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
EmulSmall/Ручная/loaddrv.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
EmulSmall/Ручная/loaddrv.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
EmulSmall/Ручная/uninstall.bat
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
EmulSmall/Ручная/uninstall.bat
Resource
win10v2004-20240802-en
General
-
Target
d16753c18acf5c06667eaa834680c636_JaffaCakes118
-
Size
339KB
-
MD5
d16753c18acf5c06667eaa834680c636
-
SHA1
8a9f892cd6af241bdd7b166ee688c44fbb2857af
-
SHA256
49e2a3d0bd50894cedf431093f1b31904ed8549c8b0381a4330e36a1603bc488
-
SHA512
3958776bce496fa7b4f13f5025e08deab61a946a8b6a3171caa5f0af8821268cfb5e43562840d4e0bf64bbb22e9209aacf93998e99292abd588d2541ee6c667a
-
SSDEEP
6144:07kGfWH+mtThOQW2qKy0z3pWjj+4n9sSVUjWQQXrdDPNKxdXe9OVsAXlBMLg/GHl:07kGeH+SBjS+4WIUjnaPNKTXSAVYC8
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/EmulSmall/Автоматическая версия/EmulSmall.exe unpack001/EmulSmall/Ручная/haspflt.sys unpack001/EmulSmall/Ручная/loaddrv.exe
Files
-
d16753c18acf5c06667eaa834680c636_JaffaCakes118.rar
-
EmulSmall/Автоматическая версия/EmulSmall.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
EmulSmall/Автоматическая версия/Перед установкой прочитай.txt
-
EmulSmall/Ручная/haspflt.sys.sys windows:5 windows x86 arch:x86
3f0d89c84f8747a68b773aebd16649a7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
hal
KfReleaseSpinLock
KfAcquireSpinLock
ntoskrnl.exe
ObfDereferenceObject
IoGetDeviceObjectPointer
RtlInitUnicodeString
KeInitializeSpinLock
DbgPrint
IofCompleteRequest
ExFreePool
ZwQueryValueKey
RtlUnicodeStringToInteger
ExAllocatePoolWithTag
ZwOpenKey
ZwEnumerateKey
ZwQueryKey
ZwClose
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 32B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 480B - Virtual size: 466B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 736B - Virtual size: 730B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
EmulSmall/Ручная/install.bat
-
EmulSmall/Ручная/install_1C8.txt
-
EmulSmall/Ручная/loaddrv.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
EmulSmall/Ручная/uninstall.bat
-
EmulSmall/Ручная/Правила установки!!!.txt