Static task
static1
Behavioral task
behavioral1
Sample
Probot v1861.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Probot v1861.exe
Resource
win10v2004-20240910-en
Behavioral task
behavioral3
Sample
isButton.ocx.lnk
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
isButton.ocx.lnk
Resource
win10v2004-20240802-en
General
-
Target
0cb1d8c831d4d56cc971c66b1b34af70_JaffaCakes118
-
Size
323KB
-
MD5
0cb1d8c831d4d56cc971c66b1b34af70
-
SHA1
e799f2ee8b3969525b82eb1810752ea956a6d5d0
-
SHA256
9ebb91dc53ca50956c53e54e513cd5997c3bec8f13cd826d18dfbacc21c6bd8d
-
SHA512
68cac0eb28f16bce7a99ec07e2b70e117844551e501a34ab88b653b06e0649bdd1a348f8ab17d2f7f812da4e78b5f0904ca9e70bea058cbce98e7fbc378c89d7
-
SSDEEP
6144:9tKzCicaURoHLA2oIfT745gRacacwoDsBL+Ac1g8TaNqKEEbG:guqrAFI7745gIcpw6sR+lbeNBdbG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Probot v1861.exe
Files
-
0cb1d8c831d4d56cc971c66b1b34af70_JaffaCakes118.rar
-
Beni Oku.txt
-
Probot v1861.exe.exe windows:6 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 27KB - Virtual size: 24KB
Size: 64KB - Virtual size: 4B
���� Size: - Virtual size:
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
Size: - Virtual size:
Size: - Virtual size:
IMAGE_SCN_CNT_UNINITIALIZED_DATA
Size: - Virtual size:
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
�`��� Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
����p Size: - Virtual size: 4KB
����� Size: - Virtual size: 4KB
����� Size: - Virtual size: 4KB
-
isButton.ocx.lnk.lnk