Overview

overview

7

Static

static

7

ff2ebe1c74...18.exe

windows7-x64

7

ff2ebe1c74...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    ff2ebe1c74ba71d9a1c7d3b82e980e23_JaffaCakes118

  • Size

    2.0MB

  • Sample

    240929-xq7xtawfln

  • MD5

    ff2ebe1c74ba71d9a1c7d3b82e980e23

  • SHA1

    c4cfd3a9bd3ae74cae453f5d31f7b4f314266ba8

  • SHA256

    87cd63349614b470ace232f4b828fb7e4725f2d630be7a4e8bc63045b9e05e3b

  • SHA512

    0360ed16c14efa625e6cd400a4d16b4695055d1b5b8d9ac4e3bd2413ce6cb9c1adb668e65a2458f318ff24ba067db1a944bd30ef534e7d3ca93776cad39313f8

  • SSDEEP

    49152:cnbmpDwI65KadOC0mf9YOt/srthQn/yZ:cnbmpDwX59d50mfCY/so/c

Score
7/10
discoveryevasionthemida

Malware Config

Targets

    • Target

      ff2ebe1c74ba71d9a1c7d3b82e980e23_JaffaCakes118

    • Size

      2.0MB

    • MD5

      ff2ebe1c74ba71d9a1c7d3b82e980e23

    • SHA1

      c4cfd3a9bd3ae74cae453f5d31f7b4f314266ba8

    • SHA256

      87cd63349614b470ace232f4b828fb7e4725f2d630be7a4e8bc63045b9e05e3b

    • SHA512

      0360ed16c14efa625e6cd400a4d16b4695055d1b5b8d9ac4e3bd2413ce6cb9c1adb668e65a2458f318ff24ba067db1a944bd30ef534e7d3ca93776cad39313f8

    • SSDEEP

      49152:cnbmpDwI65KadOC0mf9YOt/srthQn/yZ:cnbmpDwX59d50mfCY/so/c

    Score
    7/10
    discoveryevasionthemida

    • Deletes itself

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks