Static task
static1
Behavioral task
behavioral1
Sample
BitcoinBlackmailer.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
BitcoinBlackmailer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Ransom.Jigsaw.B.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Ransom.Jigsaw.B.exe
Resource
win10v2004-20241007-en
General
-
Target
b1e3b5c1bd78584ce102d10ca4c8dfc5_JaffaCakes118
-
Size
469KB
-
MD5
b1e3b5c1bd78584ce102d10ca4c8dfc5
-
SHA1
4f2ef55e73a35a31997b5b52302b8b420a028ae6
-
SHA256
6e5ef96557f4603fecfda52f9963687725f72ab1f805795ebdb091cc67c832a2
-
SHA512
f7aadd115f4ba3b247bd1cfdf1bd619fddf97ac6ed97fbbb78ebfdb23c4becac00fe85f6dc2592ae6e211071856c3147645a5374fcfc738a230224ed64a12dbf
-
SSDEEP
6144:qRUaln76uvhnBWDGXtydJ0/F6tkM9FLPv4cHGQQQeiuq9QrVbxOxcXt5ws/:f0n76uvtBRXUJ0/F+D9Ocmpfq41OYDwu
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/BitcoinBlackmailer.exe.dis unpack001/Ransom.Jigsaw.B.exe.dis
Files
-
b1e3b5c1bd78584ce102d10ca4c8dfc5_JaffaCakes118.zip
-
BitcoinBlackmailer.exe.dis.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
!mmUPp Size: 209KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
Ransom.Jigsaw.B.exe.dis.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
!mmUPp Size: 209KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ