JaffaCakes118_22c12442f9ec85f619409b34efefe91b702d128ac6e0ebb4e27c021de64fd394
- SHA256 22c12442f9ec85f619409b34efefe91b702d128ac6e0ebb4e27c021de64fd394
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4783eea1eb0d11b98d15039aa6c9e5297ca7d166d3744c61ee09675f593e7300.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
4783eea1eb0d11b98d15039aa6c9e5297ca7d166d3744c61ee09675f593e7300.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target JaffaCakes118_22c12442f9ec85f619409b34efefe91b702d128ac6e0ebb4e27c021de64fd394
- Size 175KB
- Sample241222-dg1bts1mal
- SHA256 22c12442f9ec85f619409b34efefe91b702d128ac6e0ebb4e27c021de64fd394
- MD5 b6f5664ca3261543c8597f8d430cd931
- SHA1 ca8995bbfd2a50a7355a230e4ff5c32ce73d0f18
- SHA512 c6bf98e51f4446f2c7fc4a7d012ea115d9db1c0c31aaa2d6a55366440e5db26215ec3b6903c59b527922e8a4c1f4d34b8b2119afcfd0b737611c470a480e8ffb
- SSDEEP 3072:DbBANMG8Fo23Deq4ZqPELvGWpiqML3V2lZwPP1xZb+73fXn7tIk6h:PBANMGkoKSq4ZzL+WUqGV2e9Pb4jtIJ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll
File Explorer
-
JaffaCakes118_22c12442f9ec85f619409b34efefe91b702d128ac6e0ebb4e27c021de64fd394.zip 175KB
-
4783eea1eb0d11b98d15039aa6c9e5297ca7d166d3744c61ee09675f593e7300.exe 246KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Marquess.Hyp64KB
-
document-revert.png.png 460B
4783eea1eb0d11b98d15039aa6c9e5297ca7d166d3744c61ee09675f593e7300
- IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
- SHA256 4783eea1eb0d11b98d15039aa6c9e5297ca7d166d3744c61ee09675f593e7300
- MD5 8ec815faae06ac952b5f1b173446946c
- SHA1 df6c7646bad782a890558d0e4324ed01ce81da60
- SHA512 b1f083dc00f485fa2f6acaec22d98d8f547e520638bc9fc0293db90ab263cc7197ed39734f07609ab906375fbc875c82b24e467ea8fac1df09afb554f9a970cc
- SSDEEP 6144:iT4Dt+KsyVTQuVy808j/EP/ZHUr/ic2rsqVAxvOz7:iTKtVTQur084/Q/er1VN
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d0:c8:bb:1f:bc:9c:c7:15:59:ea:97:3a:d6:e7:d5:82:6c:60:01:b1:67:f0:5e:f9:89:cb:4b:fb:5f:0a:05:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Bogtrykkenes plenitide\ ,OU=Hurtigheds Colonopathy Sygemeldtes\ ,O=Uninspirited,L=Thelwall,ST=England,C=GB,1.2.840.113549.1.9.1=#0c17556e70617261646f7840537672646c696c6a65722e556e
Chains
Aug 25, 2022
Subject
CN=Bogtrykkenes plenitide\ ,OU=Hurtigheds Colonopathy Sygemeldtes\ ,O=Uninspirited,L=Thelwall,ST=England,C=GB,1.2.840.113549.1.9.1=#0c17556e70617261646f7840537672646c696c6a65722e556e
Serial Number
1c:47:d0:5c:85:c6:64:e1
Issuer
CN=Bogtrykkenes plenitide\ ,OU=Hurtigheds Colonopathy Sygemeldtes\ ,O=Uninspirited,L=Thelwall,ST=England,C=GB,1.2.840.113549.1.9.1=#0c17556e70617261646f7840537672646c696c6a65722e556e
Timespan
Apr 2, 2022 - Apr 1, 2025
Subject
CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
Serial Number
01
Issuer
CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 1, 2008 - Oct 1, 2033
Subject
CN=DFN-Verein Certification Authority 2,OU=DFN-PKI,O=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V.,C=DE
Serial Number
e3:0b:d5:f8:af:25:d9:81
Issuer
CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2016 - Feb 22, 2031
Subject
CN=DFN-Verein Global Issuing CA,OU=DFN-PKI,O=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V.,C=DE
Serial Number
1b:63:ba:d0:1e:2c:3d
Issuer
CN=DFN-Verein Certification Authority 2,OU=DFN-PKI,O=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V.,C=DE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 24, 2016 - Feb 22, 2031
Subject
CN=PN: Zeitstempel 2022,OU=Geschaeftsstelle,O=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V.,L=Berlin,ST=Berlin,C=DE,2.5.4.65=#13105a6569747374656d70656c2032303232
Serial Number
26:0a:30:98:6c:61:e1:62:c2:28:ed:25
Issuer
CN=DFN-Verein Global Issuing CA,OU=DFN-PKI,O=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V.,C=DE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 21, 2022 - Jan 20, 2025
Minor OS version
0
Major OS version
4
Entry point
13509
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
SetWindowPos
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersion
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
ExitProcess
CopyFileW
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10719
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Marquess.Hyp
- SHA256 eff92f2cdbe549e24173766a6ca7fc4b900133b8b408a38c500df39fc5ce9090
- MD5 14d1a1653c0848ebd4cb955e7e951a6b
- SHA1 8f0c8df68f1e138885e73a6ab5d6831272f6c426
- SHA512 31a49d5ca0e4bfde183669a9b913f385462d298dbdbc5bf5c951927d6aec007a2785f24be6adf3931d74aeb46079dc1d8284e0817848143c382a85fbcd1c371c
- SSDEEP 1536:BHNhKRef8WdCKcVHpAPJhMYsU64Dgh0GqkY8bsp:BthKRe8zHVHU4tU6OD8gp
- MD5 SHA1 SHA512 SSDEEP
document-revert.png
- SHA256 f3dccea2821e3738acdf4460280b94bc21798e0d7d8be94f8f71f265d7d7ecaf
- MD5 60ac1231f6b818f6c78546e5f9ce150f
- SHA1 00f6cb008da8cb4b8f207f2201f991e430e2ea9c
- SHA512 a6d380649c01ba927b9a9c3489b9eb6e5dedc16901be84fae2aac2bb34193091c7ec807f189cfaf84dcbc0b4b5b5bd6d546316b6da41b5ae29a4c40d4d0edd29
- MD5 SHA1 SHA512