General

  • Target

    JaffaCakes118_660effaf33e85bc19be61ab5cfa64fc187bc9902317c292770a5a18683b000ed

  • Size

    4.1MB

  • MD5

    c790bf1bd8420e2deb566231306b99ce

  • SHA1

    a8272fe150185bbb74ef087a1727c5842e3859fa

  • SHA256

    660effaf33e85bc19be61ab5cfa64fc187bc9902317c292770a5a18683b000ed

  • SHA512

    3aaec32118565336be00992ccd1257a454d5bca9c3e7bf8b8667ec025ee1bb8d6d89420bad145e28b0b98f7836691c902ac338154f2edb2d13343c7765b50e5c

  • SSDEEP

    98304:PjnJe1/rNbVTknPhFxzLEhLfHToBwpSOXCU4Xn1lYrVqJefaT:zerNJQjxzODzJSOz4XncrVqJUaT

Malware Config

Extracted

Family

icedid

Botnet

1820688957

C2

timerework.fun

pexxota.space

Attributes
  • auth_var

    6

  • url_path

    /news/

Signatures

  • Icedid family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_660effaf33e85bc19be61ab5cfa64fc187bc9902317c292770a5a18683b000ed
    .zip
  • core.bat
  • license.dat
  • vessel-64.dat
    .dll regsvr32 windows:6 windows x64 arch:x64

    7699a5dff78fd6d7ef6c98d3071356f3


    Headers

    Imports

    Exports

    Sections