Overview
overview
10Static
static
7Shut Down ...lp.chm
windows7-x64
1Shut Down ...lp.chm
windows10-2004-x64
1Shut Down ...md.exe
windows7-x64
1Shut Down ...md.exe
windows10-2004-x64
3Shut Down ...rv.exe
windows7-x64
3Shut Down ...rv.exe
windows10-2004-x64
3Shut Down ...wn.exe
windows7-x64
10Shut Down ...wn.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
Shut Down Expert/Help.chm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Shut Down Expert/Help.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Shut Down Expert/SDECmd.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Shut Down Expert/SDECmd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Shut Down Expert/SDEServ.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Shut Down Expert/SDEServ.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Shut Down Expert/ShutDown.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Shut Down Expert/ShutDown.exe
Resource
win10v2004-20240802-en
General
-
Target
d548be88a497ba3479e5d009e5bb33e3_JaffaCakes118
-
Size
1.0MB
-
MD5
d548be88a497ba3479e5d009e5bb33e3
-
SHA1
f05a54393175d97a18204e6eecba6a45deec7875
-
SHA256
9012a47a33830ca75305a1648ff073143561cd7b102e93563a1eda196be3840d
-
SHA512
47f914a34b3e9122b85efa7cc45c4a14d57aa89c08eac8c948a09f74ba90dfa371e18eda19bbb0b9b6404e1e57e51efc80fce603bdb0ffa23a3a3c0e8dbd44f7
-
SSDEEP
24576:dXPcHdC+xs9FiVhjFgxDcEu6jfxiFjgXce9slW8kA1NKjAICuQr:dXPccvbiVhRmDcEgJcciyDzxf
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Shut Down Expert/ShutDown.exe upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Shut Down Expert/SDECmd.exe unpack001/Shut Down Expert/SDEServ.exe unpack001/Shut Down Expert/ShutDown.exe
Files
-
d548be88a497ba3479e5d009e5bb33e3_JaffaCakes118.rar
-
Shut Down Expert/Help.chm.chm
-
Shut Down Expert/Language/Deutsch.lng
-
Shut Down Expert/Language/English.lng
-
Shut Down Expert/Language/Espa駉l.lng
-
Shut Down Expert/Language/Italian.lng
-
Shut Down Expert/Language/Korean.lng
-
Shut Down Expert/Language/Magyar.lng
-
Shut Down Expert/Language/Nederlands.lng
-
Shut Down Expert/Language/Polski.lng
-
Shut Down Expert/Language/Romana.lng
-
Shut Down Expert/Language/Simplified Chinese.lng
-
Shut Down Expert/Readme.txt
-
Shut Down Expert/SDECmd.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 12B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Shut Down Expert/SDEServ.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 428KB - Virtual size: 427KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Shut Down Expert/ShutDown.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 888KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 432KB - Virtual size: 432KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Shut Down Expert/下载说明.htm.html .js polyglot
-
Shut Down Expert/读我.txt