8b45549c13883db389406324f8dac21d07a153289e050e0fb675e3433b8df193 | Triage

Submit
Reports

Overview

overview

7

Static

static

7

eaceb17673...18.dll

windows7-x64

7

eaceb17673...18.dll

windows10-2004-x64

7

Sharing

General

Target

eaceb176735608b0f53fe230c51e0ef4_JaffaCakes118
Size

589KB
Sample

240919-hsg2vawfpn
MD5

eaceb176735608b0f53fe230c51e0ef4
SHA1

7d80adf1406cd299b1d5196c57d058c9686e3e17
SHA256

8b45549c13883db389406324f8dac21d07a153289e050e0fb675e3433b8df193
SHA512

e9f868214e505df03a9bec4c4b433e68841ace0a0297f666af1afb3eb31382069293b2ab924e3adcc92a382d235b42ad30dc8cfb15fdb325d50ffe5a43cee3a7
SSDEEP

12288:YX7N1wqc7z7EcLIRytWvqT6/xtZZq3PIbah4H1BGnyGD7fhph0WLC3WTiN+7kqKj:YZSqq4RRR3SgblVkyorhPk3yiNCk9G7u

Score

7^/10

discovery evasion themida

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

eaceb176735608b0f53fe230c51e0ef4_JaffaCakes118.dll

Resource

win7-20240903-en

discovery evasion themida

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

eaceb176735608b0f53fe230c51e0ef4_JaffaCakes118.dll

Resource

win10v2004-20240802-en

discovery evasion themida

windows10-2004-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  
  eaceb176735608b0f53fe230c51e0ef4_JaffaCakes118
- Size
  
  589KB
- MD5
  
  eaceb176735608b0f53fe230c51e0ef4
- SHA1
  
  7d80adf1406cd299b1d5196c57d058c9686e3e17
- SHA256
  
  8b45549c13883db389406324f8dac21d07a153289e050e0fb675e3433b8df193
- SHA512
  
  e9f868214e505df03a9bec4c4b433e68841ace0a0297f666af1afb3eb31382069293b2ab924e3adcc92a382d235b42ad30dc8cfb15fdb325d50ffe5a43cee3a7
- SSDEEP
  
  12288:YX7N1wqc7z7EcLIRytWvqT6/xtZZq3PIbah4H1BGnyGD7fhph0WLC3WTiN+7kqKj:YZSqq4RRR3SgblVkyorhPk3yiNCk9G7u
Score

7^/10

discovery evasion themida
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionthemida

behavioral2

discoveryevasionthemida

© 2018-2025

Terms | Privacy