JaffaCakes118_30fc1041b3c56d616a7e19750bf513a80578167a45d6e0ff359fa6b6c31c50c7
- SHA256 30fc1041b3c56d616a7e19750bf513a80578167a45d6e0ff359fa6b6c31c50c7
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
70849a1efa87c9363c62cdd0ca1ac5db34e13ae1e6803f5bcf4be9660b487156.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
70849a1efa87c9363c62cdd0ca1ac5db34e13ae1e6803f5bcf4be9660b487156.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/orcyebry.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/orcyebry.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target JaffaCakes118_30fc1041b3c56d616a7e19750bf513a80578167a45d6e0ff359fa6b6c31c50c7
- Size 347KB
- Sample241224-mrr8msvpbz
- SHA256 30fc1041b3c56d616a7e19750bf513a80578167a45d6e0ff359fa6b6c31c50c7
- MD5 1f902fd086c25392ab5b3b99520c3132
- SHA1 41f3f7c0c5dcc531f4f2b4107c5a92c309277a2a
- SHA512 533cdec3c7b7b50ef42341da4df27585085aeeeecd0245a2e7ea6c4208270e46194a01f5290f819177204d6cfa7c2f809ae63d1385df023aa4f177a0ee5da836
- SSDEEP 6144:kWxAlzz5l78a5sG5+B9LOUQKXry1S4KEwxtNWXtyJlUHINhrA4W0juCzVk4k:dAlzAa5/+BNS7S3xmtyzqQxDW0pzS4k
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/70849a1efa87c9363c62cdd0ca1ac5db34e13ae1e6803f5bcf4be9660b487156 unpack002/$PLUGINSDIR/orcyebry.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/70849a1efa87c9363c62cdd0ca1ac5db34e13ae1e6803f5bcf4be9660b487156 nsis_installer_1 static1/unpack001/70849a1efa87c9363c62cdd0ca1ac5db34e13ae1e6803f5bcf4be9660b487156 nsis_installer_2
File Explorer
-
JaffaCakes118_30fc1041b3c56d616a7e19750bf513a80578167a45d6e0ff359fa6b6c31c50c7.zip 347KB
-
70849a1efa87c9363c62cdd0ca1ac5db34e13ae1e6803f5bcf4be9660b487156.exe 358KB
-
$PLUGINSDIR/orcyebry.dll.dll 175KB
-
qoe2vmywdiuaupj212KB
70849a1efa87c9363c62cdd0ca1ac5db34e13ae1e6803f5bcf4be9660b487156
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 70849a1efa87c9363c62cdd0ca1ac5db34e13ae1e6803f5bcf4be9660b487156
- MD5 7e9e3aeebbafdb0a1fa065ee5ad217ec
- SHA1 6064e1dbc3129e3f69e701946d54191b42eb6a92
- SHA512 27fb97317d7484c3c770eb5073b682a76dd76bcb93c3475c979e0d7bf781f7d7de71a51761ea9ee239e53a2d39ad1e986cdc9efa22389934088daef3dec70d33
- SSDEEP 6144:rGiF3GRJUnjyWkqKwmT20Wv60Dir1SNuaeTUqUPcLPTS43RIWi1ov2+fmIN5UgK:h3OJMLk5tESVTU8DTS43R4ovPfmWu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12515
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/orcyebry.dll
- IMPHASH 42fdddd539779b8353a7a66526b0af44
- SHA256 a9b13e44fc7a247368e980cf20889619100caad4387662b639923eda30bcf9b9
- MD5 3b4056f9ef87716b0e0ed45da70d258f
- SHA1 59efd5883fee51f07066e92753be09454444da62
- SHA512 accbe50cc40caf0b4b2d0569b67fbcaa64edf35a68104e23e7d941be7ccf2548ae9d1e9b4b271caff0f828220055f50f9176c9eed0871a1c056f6e7cc1d8a04d
- SSDEEP 3072:Kjv/DLvAkNjGyy0M+zFsrOhH/7rsYVI6yzVwU2gcw8BZDptiwJn6RUJ7h+Bk4:KjfvAkFGy7gEf/ItWLpwsptiC6WJ7h+x
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
shlwapi
SHRegDeleteUSValueA
PathMakePrettyA
StrCmpIW
PathFileExistsA
PathIsSystemFolderA
PathRemoveExtensionA
PathRelativePathToW
PathIsUNCServerA
PathAddExtensionW
StrChrA
SHQueryInfoKeyA
PathMatchSpecW
ole32
OleCreateLinkFromDataEx
OleDestroyMenuDescriptor
OleQueryCreateFromData
SNB_UserUnmarshal
OleGetClipboard
CreateClassMoniker
loadperf
UnloadPerfCounterTextStringsA
LoadPerfCounterTextStringsW
LoadPerfCounterTextStringsA
user32
SetWindowContextHelpId
ToUnicodeEx
EnumClipboardFormats
MapDialogRect
GetLastActivePopup
GetKeyboardLayoutNameA
SetFocus
PostMessageA
GetWindowContextHelpId
CreateCursor
mscms
IsColorProfileTagPresent
OpenColorProfileA
GetColorDirectoryA
wsock32
WSAStartup
ord1106
WSAAsyncGetHostByName
ioctlsocket
connect
WSAAsyncGetServByName
ord1130
setsockopt
MigrateWinsockConfiguration
sendto
ord1116
ahaty
bpuzplozj
ccri
einpppjgj
hwhoyd
kvqdsz
lppo
pthfhtcqh
swohdluyyih
vrpvwvdy
wudmv
Name
.text
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=257, version=25203,
count=45, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
qoe2vmywdiuaupj
- SHA256 12e9b4e52a94b3d508473d8b29034ca5c8ac27b28feb188762d34b15c9ce017d
- MD5 a1521852de6b7d5e8925d066d54bb204
- SHA1 6209d472b88b7c7a6c87a0fbc0336edf1be47f3f
- SHA512 868241584499710a451f4a2ffe3f6730deaf2a57fc87fc5b2839d065cf72ae000595c84e737bc36e0949aeff6dda82234654c1e59fa71143fef4f67a6383bed7
- SSDEEP 6144:UMMzGAOxxEuCrffCGSfP7paEvJTUq6hqaxEzE+:+CAOxmTQ1JTUyNE+
- MD5 SHA1 SHA512 SSDEEP