acf14efca91d4928aaabe2a5989bdf31_JaffaCakes118
- SHA256 89dbec9a3f635988cd350df820616c02a0bc9c74e4a87cb51520f0d39a81ac89
Overview
overview
10Static
static
3Softcam li...iz.htm
windows7-x64
3Softcam li...iz.htm
windows10-2004-x64
3www.satnet...ll.exe
windows7-x64
10www.satnet...ll.exe
windows10-2004-x64
10www.satnet...iz.htm
windows7-x64
3www.satnet...iz.htm
windows10-2004-x64
3www.satnet...TE.url
windows7-x64
6www.satnet...TE.url
windows10-2004-x64
3www.satnet...iz.htm
windows7-x64
3www.satnet...iz.htm
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Softcam link www.satnet.biz.htm
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Softcam link www.satnet.biz.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
www.satnet.biz/Install.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
www.satnet.biz/Install.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral5
Sample
www.satnet.biz/Oktagon Softcam link www.satnet.biz.htm
Resource
win7-20241023-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
www.satnet.biz/Oktagon Softcam link www.satnet.biz.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
www.satnet.biz/SITE.url
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
www.satnet.biz/SITE.url
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
www.satnet.biz/www.satnet.biz.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
www.satnet.biz/www.satnet.biz.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target acf14efca91d4928aaabe2a5989bdf31_JaffaCakes118
- Size 1.0MB
- Sample241128-tzbzyssraw
- SHA256 89dbec9a3f635988cd350df820616c02a0bc9c74e4a87cb51520f0d39a81ac89
- MD5 acf14efca91d4928aaabe2a5989bdf31
- SHA1 73ebb236e8e7d69b361501565dea10e27232ba0b
- SHA512 9289492865ef5e238d01ed0bf2c3d13837707f089aa4bb6be31c5f6aabe28c2d0a286d924cf6bcaa1ca9d6dd22cfccc8f81b1e3b7ba52af3563e4142785348c3
- SSDEEP 24576:R7FCneGBZwn+Tfz/9xRB8ZZAVT7nVAV59j5RAXAglai1Wpr:RZCneIwnIJzB8vAVTc93AXASai1Wpr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/www.satnet.biz/Install.exe
File Explorer
-
acf14efca91d4928aaabe2a5989bdf31_JaffaCakes118.rar 1.0MB
-
09-01-2010-Settings_upd_Humax-13-19.hnf47KB
-
Grenz-FKK--www.grenz-fkk.de.jpg.jpg 66KB
-
Softcam link www.satnet.biz.htm.html 8KB
-
new update info.txt18KB
-
www.satnet.biz/Faker User.txt17KB
-
www.satnet.biz/Install.exe.exe 818KB
-
www.satnet.biz/Oktagon Softcam link www.satnet.biz.htm.html 8KB
-
www.satnet.biz/ReadMe Update.nfo3KB
-
www.satnet.biz/SITE.url.url 233B
-
www.satnet.biz/WARNING! Read me!.txt3KB
-
www.satnet.biz/all Files.jpg.jpg 98KB
-
www.satnet.biz/info.txt18KB
-
www.satnet.biz/www.satnet.biz.htm.html 8KB
09-01-2010-Settings_upd_Humax-13-19.hnf
- SHA256 10eb2dce7e7a3c671f92cd01ecde1e4f15ddbcbb4cb72cb5692d5b961b365681
- MD5 84c49e47dbbf46b18c2fac5f0cfc3519
- SHA1 d0f8cf443be7d4d923bd86b1f78e565f98f53ba7
- SHA512 ae2b6205676aa9953d44a91e9e6d45e22f05168027e516c76e6de7c9f40a45b8725701d08a65e191d1358990cc471efe7f80e8ed602a48dc75e5d942de333ced
- SSDEEP 768:f/23mUsmXK6v5rS+LstK6+PXr4Ze4TQQIHiLNla1R+FNLVhIm+GtjwOqOtOXw+lb:WXsMK05G+mVacLQQIHiLNo7+b3tUlw90
- MD5 SHA1 SHA512 SSDEEP
Grenz-FKK--www.grenz-fkk.de.jpg
- SHA256 5cc331d7756a790e83c79e0d6294152bc21d37013530713f680d9091eba443a4
- MD5 428566ae6d51c5622426f5597d51adeb
- SHA1 c907540ea4f3265b4c11b95773c8c11273a91270
- SHA512 2795cde18d926f0573c33aebaa0ccb1da1ff8882eda792463e74d34bf1a5af453687b78d967cbc13da6de804fd500833f70deccdfe22c13b155cb55ef425e156
- SSDEEP 1536:GPKMZBZvc6m8WELJpkCytHUy5yLuGy2Cl/hgga+rdaLj/Fez/yd:1MZB1cb8WgpkCi0y5yLuGyj/hlBcHdW6
- MD5 SHA1 SHA512 SSDEEP
Softcam link www.satnet.biz.htm
- SHA256 eab287387197e7b5a78c0cb673ff8719d2059558918e5117f8b0fd052dc106b5
- MD5 138366e862b24e5035119c5272d57aa3
- SHA1 8035b85bfffa0591d3cc19f98c1140d5feb19f06
- SHA512 30c78ce65fe6658a56e9b94e743f73ef8f9e08a72b786d8837258f98298a05bb784e9435a8912dac7e6eabddebfb32cda92f779cacf0c861661b14082a23fb50
- SSDEEP 192:eCfy4AbY5z5gnn8AkABPaXf27Nuz0A0YC3yZvOZvbWN8ewMXnF:eCfV+Y5z5VAkABKWKUYKyRORb0jpXnF
- MD5 SHA1 SHA512 SSDEEP
new update info.txt
- SHA256 87c803c4f42debd0f6ec3b597c481a492753721feeabcee71486ab3cc34ae775
- MD5 3a0cf1b62e10dc94ec286385f11e9b43
- SHA1 9ab717c20d844f11cbab7f36a470a21971e0cbc2
- SHA512 b945a8a993bcc341b0c1b0c4fe005a0f2b50b6814488b280f289c1387e7b9a4e6dda433eb7f77095df4f380a289b9d6beba93cfdd509efe17c663adad07652f8
- SSDEEP 96:mMYC24ma0WLyGOvrKM+avZWMu9qVziUhINm3OVTVVqVTVNV0VxRIHAggHN6Y36XI:5dhydKMtWMCpiJnOTRvHIY3nl1y6
- MD5 SHA1 SHA512 SSDEEP
www.satnet.biz/Faker User.txt
- SHA256 9ea42587128b49c5fbcedd2016feb91b75db2758399d4185bb32caa8b70ab2fb
- MD5 d0263a7e1aa78ac992ea6caff6c20f10
- SHA1 aeed5e90c0830905c5b703420b6143780445fb85
- SHA512 b8b10a1ec5fa53bbf273064bdfa3c3cb1b7040eb8304a6002660a8b6c6a2d45afed59265b8b3cc603dd21c6971c40b62ec3c1a7c33ede48ac6ff646f68203338
- SSDEEP 192:dUxNkQuxACMeCYrhydKMtWMZAbvWVY3no1yJ:okQuxLlCqsXROb+Sx
- MD5 SHA1 SHA512 SSDEEP
www.satnet.biz/Install.exe
- IMPHASH 86632da30434ccfc050190a47fb559c4
- SHA256 5f5198fc2d3e2896bacc006b79843ebc022bdaa704e4d0ea17531b99038376a6
- MD5 a2cee1e2af064e875734ab3afb6a660e
- SHA1 de51dccd8c72a51135db4c0ef1dfafc93eeac9d2
- SHA512 9b733d4a3460143afbc96633f242c01d1f92d3d1ee3db76e859428bb7b8f1f635b5c616f4c6ea6321edd1aa60f34115f1b44190f89061e1c931aadcc8b5099c9
- SSDEEP 24576:hwL/dHL3Vhr00qczLg1tF7MceAWuTMq8U3OF7nkPmSEz/C+bsm9:hwxHL3VhA09ngzF7MdAJgnmmdzBr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
13038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_acmdln
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
calloc
exit
memcpy
memset
_itow
??2@YAPAXI@Z
_wcsdup
??3@YAXPAX@Z
free
__p__commode
kernel32
GetModuleHandleA
GetTempPathW
GetModuleHandleW
GetModuleFileNameW
CreateFileW
SetFilePointer
CloseHandle
GetTempFileNameW
FreeLibrary
DeleteFileW
WriteFile
ReadFile
LoadLibraryW
GetProcAddress
GetStartupInfoA
user32
MessageBoxW
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=41, id=1, productName=Unmarked objects,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=14, version=7299,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=5, id=132, productName=VS2008 build 21022, version=21022,
count=8, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
www.satnet.biz/Oktagon Softcam link www.satnet.biz.htm
- SHA256 eab287387197e7b5a78c0cb673ff8719d2059558918e5117f8b0fd052dc106b5
- MD5 138366e862b24e5035119c5272d57aa3
- SHA1 8035b85bfffa0591d3cc19f98c1140d5feb19f06
- SHA512 30c78ce65fe6658a56e9b94e743f73ef8f9e08a72b786d8837258f98298a05bb784e9435a8912dac7e6eabddebfb32cda92f779cacf0c861661b14082a23fb50
- SSDEEP 192:eCfy4AbY5z5gnn8AkABPaXf27Nuz0A0YC3yZvOZvbWN8ewMXnF:eCfV+Y5z5VAkABKWKUYKyRORb0jpXnF
- MD5 SHA1 SHA512 SSDEEP
www.satnet.biz/ReadMe Update.nfo
- SHA256 7f6698aa3153b9762556de4d770b238f30926f862700703f0973c35937e1896d
- MD5 d2f540a6aaf338b98f397637e3aaa709
- SHA1 e5ba8507368e25d80e480e18533d9c835b8747d3
- SHA512 023f43b9793db9fe041a6981e3c4c9ec250301fc874e5b7c7d686cb495bbe04ba8e3ec63a4be46b23eb82fe61aeaf6c407131e5e12bddcfb7ed237288730479c
- MD5 SHA1 SHA512
www.satnet.biz/SITE.url
- SHA256 74633429d252ae10317f7f3d25b29e5e06729b89b6e8ba78bc3e0dfecf4acb8e
- MD5 5386dfdd6c7a3185f0ed2ba9082341e8
- SHA1 9cab1dbe483152a388c7d62558f6cfcfe96a003b
- SHA512 40d35c57a6656f964e67c722af23f18d57c04ce4a44c963b4201c040d68315e6b85c49f5ba8906cd24ac1b7f3efa08ed3faaa2fce62b32aaa2801134e4f12e69
- MD5 SHA1 SHA512
www.satnet.biz/WARNING! Read me!.txt
- SHA256 f3b5086bbe5e2cb7c08aff9663a2d8631128311237f90142a251743674c95734
- MD5 80459f503f62c22c012b3501f6d375f4
- SHA1 f950c4113403b9f7011e15ee8fb2618a64bfe4ac
- SHA512 f552aed644b29c8e61ce2d329a955aca1bb3cbdcd22fbcb8667a7659cb555931b599862519bd54d416d5a12d4a6b3ed62635d0ae431b304cf364ee9ef3aad20d
- MD5 SHA1 SHA512
www.satnet.biz/all Files.jpg
- SHA256 9cb62f2caa44583ec1c8eacf9706513c24f1ba707bb10b8bae71746680d6c797
- MD5 96866badeae876aec808ad8c977827be
- SHA1 2b8bdbc7660647a1c574956d1049ca4a7d016cc7
- SHA512 3f11f4ca1598ae5dae8054591df584fcf915aade8a700738d53bba36bf938f5c9d82c091d14344598b730a675d876c1e11278181f2c26801178a0918e24e822c
- SSDEEP 1536:yC6Sb1McRdxIjDq79fqwxJje7lWsyzzB04/DUKKO+2PYlpDcffKX5:UmMcjmnqhfqwxtKlWsyzzFLUOSX5
- MD5 SHA1 SHA512 SSDEEP
www.satnet.biz/info.txt
- SHA256 205ed4ac31bc1abc312aa41d0cac9324e532db1f8ca8272fe9bd425d4c618853
- MD5 5d1ebfc067411d6eb357139a227d8130
- SHA1 343590606c3e98a6d91c04f8373dfa0c2140124e
- SHA512 6f778a24d7c2c586b69b0654e5a5b283a88c204557323fb68923d1e69791b3a850f53ab0e6fef953201438ce881371fdc465f7a37f6a126af1a6afdf9bd83e15
- SSDEEP 96:GMYCc4ma0WLyGOvrKM+avZWMu9qVziUhINm398VTVVqVTVNV0VxwIHAggHN6Y364:ZbhydKMtWMapiJnOTwvHIY3nl1y6
- MD5 SHA1 SHA512 SSDEEP
www.satnet.biz/www.satnet.biz.htm
- SHA256 c2f6115c0a32d861bb0b4feb7daec8bc796237617d2ade992bdd745a9f741a6e
- MD5 bbbc11fe2fb99945a31891db430aec4d
- SHA1 6ccac25da18165960595a7be1a6e38ccc9325a3b
- SHA512 831de84570511a363e3fae8c0fa61e0d30a56127e957f960a772c4b90d2ce1091f3a7187a82f7ba6b61e08ae735889e67df5dc82bc0fc61f4effaa803c863c0c
- SSDEEP 192:Dafy4TY5z5gnn8AkABN5Xf27Nuz0A0YC3yZvOZvbWN8e2+XnF:DafVTY5z5VAkABDWKUYKyRORb0j2+XnF
- MD5 SHA1 SHA512 SSDEEP