General

  • Target

    JaffaCakes118_a43e9d152796855e2d736ddfa8f65332ae1b4b8be8cd6592ecef9c9ab9ca2394

  • Size

    4.1MB

  • MD5

    ad62d5bf261595d995a5cae07bbcf268

  • SHA1

    9d1832e666258c19de888a16b228bd50d4007497

  • SHA256

    a43e9d152796855e2d736ddfa8f65332ae1b4b8be8cd6592ecef9c9ab9ca2394

  • SHA512

    e6e7cfd5e264c0683b4c9a61abfa677082ab4bc6032c8c6f343f1ad87612212567cb074bd61c2ded8ecc4a985dfcd496ab26a60c3610358dad1aa6f1c1a4c869

  • SSDEEP

    98304:GjnJej/rNbVTknPhFxzLEhLfHToBwpSOXCU4Xn1lYrVqJefaa:kwrNJQjxzODzJSOz4XncrVqJUaa

Malware Config

Extracted

Family

icedid

Botnet

1820688957

C2

timerework.fun

pexxota.space

Attributes
  • auth_var

    6

  • url_path

    /news/

Signatures

  • Icedid family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_a43e9d152796855e2d736ddfa8f65332ae1b4b8be8cd6592ecef9c9ab9ca2394
    .zip
  • core.bat
  • license.dat
  • vessel-64.dat
    .dll regsvr32 windows:6 windows x64 arch:x64

    7699a5dff78fd6d7ef6c98d3071356f3


    Headers

    Imports

    Exports

    Sections