main
Overview
overview
7Static
static
7Organux Info.chm
windows7-x64
1Organux Info.chm
windows10-2004-x64
1Organux Info.pdf
windows7-x64
3Organux Info.pdf
windows10-2004-x64
3Organux Li...nt.pdf
windows7-x64
3Organux Li...nt.pdf
windows10-2004-x64
3Organux demo.dll
windows7-x64
3Organux demo.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Organux Info.chm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Organux Info.chm
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Organux Info.pdf
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Organux Info.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Organux License Agreement.pdf
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Organux License Agreement.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Organux demo.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Organux demo.dll
Resource
win10v2004-20241007-en
General
-
Target
30a912c5038f387fe4719621a9cdf9be_JaffaCakes118
-
Size
6.5MB
-
MD5
30a912c5038f387fe4719621a9cdf9be
-
SHA1
1bf476c8ef908e4ba5c65f2b65ecb7972a1badba
-
SHA256
b7930d76ff1534ecc6383d0f362aa22026aaf482c8082a4ca293dfa18b5a0500
-
SHA512
7238a83acd8755414afba411cba17a77a3bb8456e1615fd50c7e2ff99b62314bbab24cb631719d680cca08d4c2fd295a90ae2dd4ab8c07e88f27d92575275ae1
-
SSDEEP
98304:nB+4J0vgqgyeF9XTFVDK0/JtMmFa6lpi8yWoeHeYlVnZMdb3KQYzg/4qUibp+:nrJ0ogWNZZV/fMmFP0WZxnU+QYzNi8
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/Organux demo.dll acprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Organux demo.dll -
One or more email addresses in PDF identified
Detects presence of email addresses in PDF files.
Files
-
30a912c5038f387fe4719621a9cdf9be_JaffaCakes118.zip
-
Demo Version Limitations.txt
-
Organux Info.chm.chm
-
Organux Info.pdf.pdf
-
http://download.syntheway.net
-
http://faq.syntheway.net
-
http://shop.syntheway.net
-
http://syntheway.net
-
http://www.paypal.com
-
http://www.syntheway.com
-
http://www.syntheway.net
-
mailto:@syntheway.net
-
mailto:[email protected]
-
mailto:[email protected]
-
mailto:[email protected]
-
mailto:[email protected]
-
mailto:[email protected]
-
mailto:[email protected]
-
mailto:[email protected]
-
mailto:[email protected]
- Show all
-
-
Organux License Agreement.pdf.pdf
-
http://syntheway.net
-
http://www.syntheway.com
-
http://www.syntheway.net
-
mailto:[email protected]
-
-
Organux demo.dll.dll windows:4 windows x86 arch:x86
fdbfec85672f73d2a4d49635454936d4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: 524KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 324KB - Virtual size: 321KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.5MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.perplex Size: 170KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE