da30bad30d316739eddfdba02aa3d611_JaffaCakes118
- SHA256 900c82f46aa74c6f2a2d262eab934425ac142b83193043987152e5e788c8526f
Overview
overview
3Static
static
3RamSmash/ramsmash.dll
windows7-x64
3RamSmash/ramsmash.dll
windows10-2004-x64
3RamSmash/ramsmash.exe
windows7-x64
1RamSmash/ramsmash.exe
windows10-2004-x64
3RamSmash/s...��.exe
windows7-x64
3RamSmash/s...��.exe
windows10-2004-x64
3RamSmash/�...��.url
windows7-x64
1RamSmash/�...��.url
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RamSmash/ramsmash.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
RamSmash/ramsmash.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
RamSmash/ramsmash.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
RamSmash/ramsmash.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
RamSmash/soft2cn．com汉化说明.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
RamSmash/soft2cn．com汉化说明.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
RamSmash/未来软件园-首页.url
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
RamSmash/未来软件园-首页.url
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target da30bad30d316739eddfdba02aa3d611_JaffaCakes118
- Size 421KB
- Sample240911-m2e13axbnf
- SHA256 900c82f46aa74c6f2a2d262eab934425ac142b83193043987152e5e788c8526f
- MD5 da30bad30d316739eddfdba02aa3d611
- SHA1 dfe90e67d35f11db3365c37b0c4a9c682bcaf836
- SHA512 d717d3ca569cd5bd889e6bf80455fbe2d28b1b922ae09982a8154c10027967309cd6118717aa92cffc7ab480ae647ad847f27125cd8fb261acd86d57be551382
- SSDEEP 12288:fl6HYblor5jhgJdk1EWmgVzZusUaU+3C6Tjj:N6OsXiqE/gVNH3C6z
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/RamSmash/ramsmash.dll unpack001/RamSmash/ramsmash.exe unpack001/RamSmash/soft2cn．com汉化说明.exe
File Explorer
-
da30bad30d316739eddfdba02aa3d611_JaffaCakes118.rar 421KB
-
RamSmash/ramsmash.dll.dll 151KB
-
RamSmash/ramsmash.exe.exe 362KB
-
RamSmash/soft2cn．com汉化说明.exe.exe 51KB
-
RamSmash/下载安装说明.txt4KB
-
RamSmash/未来软件园-首页.url.url 271B
RamSmash/ramsmash.dll
- SHA256 d0fe1ea7b25d5995f8b2523c6e3386d8cd3cb9e9ae6ceb4598bff9d817957216
- MD5 20010fa9bcfe78cd586e1ab41ed8922b
- SHA1 b871db95f38c0fcc9d472dce0ade0228128b9197
- SHA512 6fd626544f6352dedbc170f9e79a167a2762978c25dbaca20aac7bde4c48408e95daf68d93f3ad941c1154dfa41aa29ac4293e35916d0f0f99c51cc4bb2f4570
- SSDEEP 1536:dwxqsQDrq1SPWG0D8H2ih+ra/lPlSgrc4+hHDNrAxpAyMWuJ8DdQl/D7kHVYrq1x:GS0SH689SaMMpVDO/T0SH6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13472
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
834B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
RamSmash/ramsmash.exe
- SHA256 464517492dd2e0959f962d11f85023a1e021432a20eff0a17a2bf1699b66ffb1
- MD5 fe4018609d6c5e0d6a393f569e9b20e4
- SHA1 586b455c7f129935b70209fd41a58d2944a1245c
- SHA512 4e8e1b2d70bcbf937eafd5872db7db1eaea52e65036b8a8e69ac92d1c0837cdf2670f3237e5b2fcee4a20d18dbd1ebf6ea37eff97ab6b856fb3047076deaf3e0
- SSDEEP 6144:lYgcQdjW7i2P7h8PiONS4ESwsRHx9vC5GAT7iUYoWmmBSRf4A6YOR:l5jgnqay5QG3UYohmS1H6YI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1683120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
S2C!
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Fox!
Size
324KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.2008
Size
33KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
RamSmash/soft2cn．com汉化说明.exe
- SHA256 e0d94ff7ee63d172ab99d839ed4a8053067b62776a58996a62e3fb81c8d25b65
- MD5 73d08a2d48c0a6a24875fbea007009fb
- SHA1 490cd52cbd4941a00993c4a3dd99d7e809170326
- SHA512 ad8404baa8e8c34b43cb333ac37ab0f0e210fcc28b364a4ff3c2d3d67376e8f9898cf6cd5fe475f6c8621fc84dd8f68832bbd57169af2771ac7132f198110030
- SSDEEP 1536:9g3gJmVb2Y3lnpIzVeTqLm60Ua0dml95pT:9GV/LyVeTq7DE95F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
148496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
HH_By_Soft2CN
Reserverd
Name
S2C!
Size
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Fox!
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.2008
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
RamSmash/下载安装说明.txt
- SHA256 b43d84c32af96f1acfee9bdb2bd4bfd2b895d8665ce569f28c53342a938bcda2
- MD5 42ecc2ee0b99c926e23a55b01b4e001f
- SHA1 16f4fcdc3c53703409ec9eb6cc68325cfc2d733b
- SHA512 83448e073ab1a06fc845a274836d2d04a540082fb8378dee558cdf00e6ccf69bf5327ea4871a1b4bf62089d9835907fb4247a989f2232a6b181e97e37611e1f3
- SSDEEP 48:S79PTnuhTECwrrEr97GKEHny36jOS1cN4kCPd+GSd3q5QH2F:09PTnvCagr97vkny36jOS1cN45PdE68g
- MD5 SHA1 SHA512 SSDEEP
RamSmash/未来软件园-首页.url
- SHA256 d0d65e31155d61d6bf3620e70b064d36779a754ae53d8bdfb772e892f95dc15a
- MD5 dfce8856238e1f4e787491321478e5d9
- SHA1 fbd1598d996fdc9b3ad5fa0b585562ff9ce5f8f5
- SHA512 26ac37a1d3f133bb5c47f0359b60b70ed6572d1879bac0cdd50138e20ee05d6548cfa165bb3052921c3cb65e902119c951ceec1cb45bcf3e101895a4e2988b61
- MD5 SHA1 SHA512