Overview

overview

9

Static

static

3

f6f53e3e17...18.dll

windows7-x64

9

f6f53e3e17...18.dll

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    f6f53e3e1752027ec2fdf342cfcf96cc_JaffaCakes118

  • Size

    805KB

  • Sample

    240925-15hg9a1akq

  • MD5

    f6f53e3e1752027ec2fdf342cfcf96cc

  • SHA1

    9143be73004afd9a0b16c8b8a08797b462a18f38

  • SHA256

    eff96cbd7311f20cf51f9aa4b68a28c4a74d633c18dd54dd11ee99a41bab924c

  • SHA512

    d82c10bafb8a3066f7208c9bdcbd047c04cb1b1ae1a0b8b6678491d6d50bbe4ab56fd3609e81356347c67e4c3d3eef486409db5573b0aebaba0ea4946cd3f08f

  • SSDEEP

    12288:us7PZMQhtCUyK2TK7kYFm3Z6xBRQeyyGC14yYm48t8rcYhI/JPK9JKOqLBZ9:ZPZFtCUaTU1OQ5y21xAccI/ecOe

Score
9/10
discoveryevasion

Malware Config

Targets

    • Target

      f6f53e3e1752027ec2fdf342cfcf96cc_JaffaCakes118

    • Size

      805KB

    • MD5

      f6f53e3e1752027ec2fdf342cfcf96cc

    • SHA1

      9143be73004afd9a0b16c8b8a08797b462a18f38

    • SHA256

      eff96cbd7311f20cf51f9aa4b68a28c4a74d633c18dd54dd11ee99a41bab924c

    • SHA512

      d82c10bafb8a3066f7208c9bdcbd047c04cb1b1ae1a0b8b6678491d6d50bbe4ab56fd3609e81356347c67e4c3d3eef486409db5573b0aebaba0ea4946cd3f08f

    • SSDEEP

      12288:us7PZMQhtCUyK2TK7kYFm3Z6xBRQeyyGC14yYm48t8rcYhI/JPK9JKOqLBZ9:ZPZFtCUaTU1OQ5y21xAccI/ecOe

    Score
    9/10
    discoveryevasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks