Static task
static1
Behavioral task
behavioral1
Sample
idman 615 - PATCH.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
idman 615 - PATCH.exe
Resource
win10v2004-20241007-en
General
-
Target
25646ad3146a0252336ecea83c662b4c_JaffaCakes118
-
Size
397KB
-
MD5
25646ad3146a0252336ecea83c662b4c
-
SHA1
a8e8eaf8ad15ee2f2ea2c7691bf9bdaba69b4947
-
SHA256
d5a7deaf5b9ddafb268d30af89273a83422d08ba8dcb723c076d41310155ef0e
-
SHA512
1c0dac2752898ccc4dbb2e98ba5fe140206cbf90e4d43ee4947ecaf716f713e7dfea2639ffa60853592d3c70a1625dbfc6bce5e1d5777f443b5d90a4081f1d75
-
SSDEEP
6144:0bWSjlPKJXdmN7jCRqiuGv8DHeyzcF+D5krAwoBE81McBhfKomGbJDu4xK+NLG9B:yWSpybsiutbe4cFukAwEB4ovJ3KW7W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/idman 615 - PATCH.exe
Files
-
25646ad3146a0252336ecea83c662b4c_JaffaCakes118.rar
-
idman 615 - PATCH.exe.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 250KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 371KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
วิธีติดตั้ง (อ่านก่อน).txt