Overview
overview
7Static
static
3ffdec_21.0...up.exe
windows7-x64
7ffdec_21.0...up.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3ffdec.bat
windows7-x64
1ffdec.bat
windows10-2004-x64
7ffdec.exe
windows7-x64
3ffdec.exe
windows10-2004-x64
7ffdec.jar
windows7-x64
1ffdec.jar
windows10-2004-x64
7lib/JavactiveX.jar
windows7-x64
1lib/JavactiveX.jar
windows10-2004-x64
1lib/LZMA.jar
windows7-x64
1lib/LZMA.jar
windows10-2004-x64
1lib/avi.jar
windows7-x64
1lib/avi.jar
windows10-2004-x64
1lib/cmykjpeg.jar
windows7-x64
1lib/cmykjpeg.jar
windows10-2004-x64
1lib/ddsreader.jar
windows7-x64
1lib/ddsreader.jar
windows10-2004-x64
1lib/decimal.jar
windows7-x64
1lib/decimal.jar
windows10-2004-x64
1lib/ffdec_lib.jar
windows7-x64
1lib/ffdec_lib.jar
windows10-2004-x64
1lib/flamingo-6.2.jar
windows7-x64
1lib/flamingo-6.2.jar
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 13:23
Static task
static1
Behavioral task
behavioral1
Sample
ffdec_21.0.5_setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ffdec_21.0.5_setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ffdec.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ffdec.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ffdec.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
ffdec.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ffdec.jar
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
ffdec.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
lib/JavactiveX.jar
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
lib/JavactiveX.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
lib/LZMA.jar
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
lib/LZMA.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
lib/avi.jar
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
lib/avi.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
lib/cmykjpeg.jar
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
lib/cmykjpeg.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
lib/ddsreader.jar
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
lib/ddsreader.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
lib/decimal.jar
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
lib/decimal.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
lib/ffdec_lib.jar
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
lib/ffdec_lib.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
lib/flamingo-6.2.jar
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
lib/flamingo-6.2.jar
Resource
win10v2004-20240802-en
General
-
Target
ffdec.bat
-
Size
786B
-
MD5
128f871f94216f847a3f119e333f1940
-
SHA1
955a125f9594199fccbdeca60c630e8f3e15f365
-
SHA256
12b1b10c3b375720eb3d90b42cfa43e0771d0997e0d94cf304b81d058164fd32
-
SHA512
de1da5b61ed289177aab1097831f0ac93a79893ca5d2b5a8604d452aaed0398c750fcee93b83b45ff891d2155806410ebe16ab610cec1898c043b81f87c4aa89
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 632 wrote to memory of 2052 632 cmd.exe 31 PID 632 wrote to memory of 2052 632 cmd.exe 31 PID 632 wrote to memory of 2052 632 cmd.exe 31