Overview

overview

10

Static

static

1

eaa3a50157...18.doc

windows7-x64

10

eaa3a50157...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eaa3a50157f075e78db122e483390917_JaffaCakes118

  • Size

    142KB

  • Sample

    240919-frlbrssclh

  • MD5

    eaa3a50157f075e78db122e483390917

  • SHA1

    1b4b70da4e5a946965205ea5d907814f0008df6e

  • SHA256

    55df7a80e87bf471bd9e82d03e9cdfaf29005dfdbc4e7759ab4425d3ffd09725

  • SHA512

    bd54e90a1e371f139d0f8b18b3d4b95ded4825b43aed9cb024ff2dfe886996a81f7e3b28be51abcfc681b16ef2d0fd3eaea4fd9eabf8b752a2b04a8f977ab36f

  • SSDEEP

    1536:ALRD3bNqfNpu39IId5a6XP3Mg8afCqZ2oF3Cgar3Pd0MZXiNjLoop:8R1qf69xak3MgxC7oMFr3Pd0MZXiNPvp

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://shop.mtcss.co.uk/wp-admin/USQFPj/
exe.dropper

https://handfinger.com/wp-includes/iCY/
exe.dropper

http://hanulmotors.com/nbqso/8Tz/
exe.dropper

http://helpinghands4needy.org/wp-content/LgrI9g/
exe.dropper

http://www.ecobaratocanaria.com/wordpress/Jt/
exe.dropper

http://macerindia.com/wp-content/hRS/
exe.dropper

http://cfn.tvstartup.com/wp-content/7dNH1LI/

Targets

    • Target

      eaa3a50157f075e78db122e483390917_JaffaCakes118

    • Size

      142KB

    • MD5

      eaa3a50157f075e78db122e483390917

    • SHA1

      1b4b70da4e5a946965205ea5d907814f0008df6e

    • SHA256

      55df7a80e87bf471bd9e82d03e9cdfaf29005dfdbc4e7759ab4425d3ffd09725

    • SHA512

      bd54e90a1e371f139d0f8b18b3d4b95ded4825b43aed9cb024ff2dfe886996a81f7e3b28be51abcfc681b16ef2d0fd3eaea4fd9eabf8b752a2b04a8f977ab36f

    • SSDEEP

      1536:ALRD3bNqfNpu39IId5a6XP3Mg8afCqZ2oF3Cgar3Pd0MZXiNjLoop:8R1qf69xak3MgxC7oMFr3Pd0MZXiNPvp

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks