Overview

overview

10

Static

static

10

#Order#.exe

windows7-x64

10

#Order#.exe

windows10-2004-x64

10

#QTN-20-97...7..exe

windows7-x64

10

#QTN-20-97...7..exe

windows10-2004-x64

10

$70k MT 30JAN.exe

windows7-x64

10

$70k MT 30JAN.exe

windows10-2004-x64

10

03-02-20.exe

windows7-x64

10

03-02-20.exe

windows10-2004-x64

10

20191107145436608.exe

windows7-x64

10

20191107145436608.exe

windows10-2004-x64

10

2019111211...fo.exe

windows7-x64

10

2019111211...fo.exe

windows10-2004-x64

10

2020 ORDERS.exe

windows7-x64

10

2020 ORDERS.exe

windows10-2004-x64

10

624880_ZOC...PT.exe

windows7-x64

10

624880_ZOC...PT.exe

windows10-2004-x64

10

ADMIN DEPT...NT.exe

windows7-x64

10

ADMIN DEPT...NT.exe

windows10-2004-x64

10

AWB_TR0089.exe

windows7-x64

3

AWB_TR0089.exe

windows10-2004-x64

3

Avis de virement.exe

windows7-x64

10

Avis de virement.exe

windows10-2004-x64

10

BL-INVOICE...CS.exe

windows7-x64

10

BL-INVOICE...CS.exe

windows10-2004-x64

10

BMS PO 4820.exe

windows7-x64

10

BMS PO 4820.exe

windows10-2004-x64

10

BSO_191120...df.exe

windows7-x64

10

BSO_191120...df.exe

windows10-2004-x64

10

Bank Information.exe

windows7-x64

10

Bank Information.exe

windows10-2004-x64

10

C.V - Expe...es.exe

windows7-x64

3

C.V - Expe...es.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b3cc4e1f09aa77a31e7071f2a505bfe5f13f9ec3cb73997b0d4a5ac36fc710fa

  • Size

    39.4MB

  • MD5

    740d3f8ce89c4a34cddfb12c0d1014b3

  • SHA1

    4742325ed1711e75a959b2697dd8718dcde18fb4

  • SHA256

    b3cc4e1f09aa77a31e7071f2a505bfe5f13f9ec3cb73997b0d4a5ac36fc710fa

  • SHA512

    ad7ad5210698554000f49fc58b904d02e1932a0e281ff31b6b9c68e76aaa25113747da034502fd8151a61e11ae134d05c7b73a4ff61267e66a1ad8a47f4d9cf6

  • SSDEEP

    786432:q/328rvIhfpHH5mszuEu0+t6I4aBDNvonFk2jZAofnsPUxF:cG8iULEuL6IxronHioffxF

Score
10/10
guloader

Malware Config

Extracted

Family

guloader

C2

https://cranetechllc.ml/omega22.bin

xor.base64

Signatures

  • Guloader family
    guloader
  • AutoIT Executable 24 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 114 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_b3cc4e1f09aa77a31e7071f2a505bfe5f13f9ec3cb73997b0d4a5ac36fc710fa
    .zip
  • #Order#.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • #QTN-20-971-JA04Q7..exe
    .exe windows:4 windows x86 arch:x86

    63704013b32228cc557c4b3e5821db6e


    Headers

    Imports

    Sections

  • $70k MT 30JAN.exe
    .exe windows:4 windows x86 arch:x86

    19a13e5ccff4d9d6cffa8e8c559b2e01


    Headers

    Imports

    Sections

  • 03-02-20.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • 20191107145436608.exe
    .exe windows:4 windows x86 arch:x86

    2bf2565069065961a75419dbe19c494b


    Headers

    Imports

    Sections

  • 2019111211292579875_BankInfo.exe
    .exe windows:4 windows x86 arch:x86

    2b5e2e37ee9510cf892ce44393ac889e


    Headers

    Imports

    Sections

  • 2020 ORDERS.exe
    .exe windows:4 windows x86 arch:x86

    3f6d30f4838bc18012e3edb3a0702512


    Headers

    Imports

    Sections

  • 624880_ZOC10280374040_IFP_PT.exe
    .exe windows:5 windows x86 arch:x86

    c4bb6fff1703eab159993e78134d34e7


    Headers

    Imports

    Sections

  • ADMIN DEPT. INVOICES 482 SGT STATEMENT.exe
    .exe windows:4 windows x86 arch:x86

    a91fee3ffb99aa94560fd3357fc9d750


    Headers

    Imports

    Sections

  • AWB_TR0089.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Avis de virement.exe
    .exe windows:4 windows x86 arch:x86

    81cf32ca1e7de024ec2e93c54acec1b8


    Headers

    Imports

    Sections

  • BL-INVOICE SHIPPING DOCS.exe
    .exe windows:4 windows x86 arch:x86

    7b3194210084c963c1ede14e44419c1d


    Headers

    Imports

    Sections

  • BMS PO 4820.exe
    .exe windows:4 windows x86 arch:x86

    b03f7b8ebd028a7b20b35358952e761d


    Headers

    Imports

    Sections

  • BSO_191120201_430001882_SHpdf.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Bank Information.exe
    .exe windows:4 windows x86 arch:x86

    c81a8c6dcf3a27479c1bf441cbbf699d


    Headers

    Imports

    Sections

  • C.V - Experience Certificates.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • C956PO.exe
    .exe windows:4 windows x86 arch:x86

    9a15a47722329c5215ae9795b0e79a1f


    Headers

    Imports

    Sections

  • CIN - U14012020KA2006PTC038132.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • CV - Resume of Sunil Sharma.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Calendar2Excel.exe
    .exe windows:4 windows x86 arch:x86

    c5648372517d19dbaa2947dbea28ea8f


    Headers

    Imports

    Sections

  • DOC302429042_SDOU.exe
    .exe windows:4 windows x86 arch:x86

    30d586adf78525a99d66dd254bb9aac6


    Headers

    Imports

    Sections

  • DOC37774732.exe
    .exe windows:4 windows x86 arch:x86

    00f3ccdff2d11f583f1b4363c942b89f


    Headers

    Imports

    Sections

  • Doc _45654.exe
    .exe windows:4 windows x86 arch:x86

    3de0b407d1b883c10a0dbd02b56c96e7


    Headers

    Imports

    Sections

  • Docs.exe
    .exe windows:4 windows x86 arch:x86

    a1994712461b77d08945c8b38743cb91


    Headers

    Imports

    Sections

  • Document_Invoice.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • FOENER RFQ 24005-1101259321_PDF.exe
    .exe windows:4 windows x86 arch:x86

    a87ff5796f12b5eb929c1758c7ffb174


    Headers

    Imports

    Sections

  • Following documents.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
    .exe windows:4 windows x86 arch:x86

    abfe664e703fc8f3a4b1d723cd45112c


    Headers

    Imports

    Sections

  • IMAGE221.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • Invoice.exe
    .exe windows:4 windows x86 arch:x86

    c445438308d8f867a6f70dac2261c365


    Headers

    Imports

    Sections

  • LPO-16155152112.exe
    .exe windows:4 windows x86 arch:x86

    a42189d805078ce6275d7996f5d746ec


    Headers

    Imports

    Sections

  • Lëscht vun de Rechnungen fir Dezember 2019 net bezuelt.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • MT Swift copy.exe
    .exe windows:4 windows x86 arch:x86

    19a13e5ccff4d9d6cffa8e8c559b2e01


    Headers

    Imports

    Sections

  • NEW P.O-8T638TYIGFE.exe
    .exe windows:4 windows x86 arch:x86

    15a65137262b72ca333c3d9e481443f2


    Headers

    Imports

    Sections

  • NEW P.O -JANUARY 2020.exe
    .exe windows:4 windows x86 arch:x86

    c400d2d3720d5c828e7f1df974af925e


    Headers

    Imports

    Sections

  • NNBL DRAFT SEA LONGITUDE RBDPL14703MT.pdf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • New Order  PO# 1028020605.exe
    .exe windows:4 windows x86 arch:x86

    8d5ae080bc677f68df1080f0f648afd2


    Headers

    Imports

    Sections

  • New Purchase Order.exe
    .exe windows:6 windows x86 arch:x86

    bc70c4fa605f17c85050b7c7b6d42e44


    Headers

    Imports

    Sections

  • New Year Order.exe
    .exe windows:5 windows x86 arch:x86

    c4bb6fff1703eab159993e78134d34e7


    Headers

    Imports

    Sections

  • New order (#20105).exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • OCEAN BILL OF LADING.exe
    .exe windows:4 windows x86 arch:x86

    1ecc1b10943fe17e226debb53d6ed816


    Headers

    Imports

    Sections

  • ORDER FILE.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Order Feb 2020.exe
    .exe windows:4 windows x86 arch:x86

    163b9386fc1d5b286fad66123886a8d3


    Headers

    Imports

    Sections

  • Order Speciations.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Order list.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • P.O.25890.exe
    .exe windows:4 windows x86 arch:x86

    9035da69c6d4717ad6efd42cd9ca688b


    Headers

    Imports

    Sections

  • PAYMENT DETAILS_PDF.exe
    .exe windows:5 windows x86 arch:x86

    cb4df74b62cf701bc5b89ca462fffcd9


    Code Sign

    Headers

    Imports

    Sections

  • PDF324561.exe
    .exe windows:4 windows x86 arch:x86

    6b83f234855f26faab73f67f078efc36


    Headers

    Imports

    Sections

  • PO BMS 4820.exe
    .exe windows:4 windows x86 arch:x86

    164797f62cfb2054745d9fa53f2f6e33


    Headers

    Imports

    Sections

  • PO NO.SC-100887.exe
    .exe windows:4 windows x86 arch:x86

    bb3efaade45b7c31c5636ed7f25fe1cc


    Headers

    Imports

    Sections

  • PO#32136578.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • PO#P-130828-01.pdf.exe
    .exe windows:4 windows x86 arch:x86

    c29775b0b3897e748cc5b5fffee569fe


    Headers

    Imports

    Sections

  • PO-0088PI69.exe
    .exe windows:4 windows x86 arch:x86

    d8ebf341eda354d766ea7ee9d1faf222


    Headers

    Imports

    Sections

  • PO-05808T008.exe
    .exe windows:4 windows x86 arch:x86

    bc913d3f75c3e91ca34d9d95b526e4d1


    Headers

    Imports

    Sections

  • PO-ABA-098722.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • PO. 11092873.exe
    .exe windows:4 windows x86 arch:x86

    c8a1d2dc2d9df6cb8d1ce6693da4472e


    Headers

    Imports

    Sections

  • PO.exe
    .exe windows:4 windows x86 arch:x86

    44ea399079905b53537f641ff57bd31f


    Headers

    Imports

    Sections

  • PO1782020.exe
    .exe windows:4 windows x86 arch:x86

    e208b07011aeca010bae06d06bb212b6


    Headers

    Imports

    Sections

  • PO3245_Signed.exe
    .exe windows:4 windows x86 arch:x86

    9c6bc17fd170d171290f273b4699fc6d


    Headers

    Imports

    Sections

  • PRODUCT LIST.exe
    .exe windows:4 windows x86 arch:x86

    900df50e53140a11e74457678924058b


    Headers

    Imports

    Sections

  • Payment Defaulter Notice.exe
    .exe windows:4 windows x86 arch:x86

    e93c22863874539b91d9d52d14e43ee0


    Headers

    Imports

    Sections

  • Payment Details.exe
    .exe windows:6 windows x86 arch:x86

    bc70c4fa605f17c85050b7c7b6d42e44


    Headers

    Imports

    Sections

  • Photo-Sample 7t09250.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Presupuesto de Ventas para Fluiters RQF R21100Q2, DEC 2019.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Proform Invoice no 123 by sea.exe
    .exe windows:4 windows x86 arch:x86

    19a13e5ccff4d9d6cffa8e8c559b2e01


    Headers

    Imports

    Sections

  • Proform Invoice.exe
    .exe windows:4 windows x86 arch:x86

    56d6c0cc678cdd160e4c1a5be043a071


    Headers

    Imports

    Sections

  • Proforma Invoice.exe
    .exe windows:4 windows x86 arch:x86

    cd47a3b8163f5720c79b5380b2605dea


    Headers

    Imports

    Sections

  • Purchase Order-030220 (2).exe
    .exe windows:4 windows x86 arch:x86

    b0a0a4628a39382878e863bc002f8d12


    Headers

    Imports

    Sections

  • Purchase Order.exe
    .exe windows:4 windows x86 arch:x86

    6965bec18850b1c3320dc48efefb2059


    Headers

    Imports

    Sections

  • Purchase order.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • QUOTATION.Pdf.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Quotation.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • RFQ2901202066455343.exe
    .exe windows:4 windows x86 arch:x86

    63704013b32228cc557c4b3e5821db6e


    Headers

    Imports

    Sections

  • Revised_PO#SF389201.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • SEA LONGITUDE NOR tendered at Lubuk Gaung - CASH TO MASTER.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SHIPPING PO=00000301076.exe
    .exe windows:4 windows x86 arch:x86

    20b6b87ea691db844597abafbc675714


    Headers

    Imports

    Sections

  • SKM_C3350191107102300.exe
    .exe windows:4 windows x86 arch:x86

    b8e292de4f0290632885c1d37a305a32


    Headers

    Imports

    Sections

  • SOA DEC 2019.exe
    .exe windows:4 windows x86 arch:x86

    e95b12c491cadb8330273bb2f9f50195


    Headers

    Imports

    Sections

  • SOA JAN 2020.exe
    .exe windows:4 windows x86 arch:x86

    cd47a3b8163f5720c79b5380b2605dea


    Headers

    Imports

    Sections

  • SOA.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • SP3-139-V128 ORDER.exe
    .exe windows:6 windows x86 arch:x86

    bc70c4fa605f17c85050b7c7b6d42e44


    Headers

    Imports

    Sections

  • Scan 50%_swiftoutput098765456789.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Shipment Details.exe
    .exe windows:6 windows x86 arch:x86

    bc70c4fa605f17c85050b7c7b6d42e44


    Headers

    Imports

    Sections

  • Shipping Doc-01022020 .PDF (212KB).exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Shipping invoice for Balance Pymt..exe
    .exe windows:4 windows x86 arch:x86

    5016330e4c64f88a06baa0f437a84130


    Headers

    Imports

    Sections

  • Swift copy.exe
    .exe windows:4 windows x86 arch:x86

    0a1599d7a6c3c60dfbf07d3e0c0e2af3


    Headers

    Imports

    Sections

  • Swift.exe
    .exe windows:4 windows x86 arch:x86

    56d6c0cc678cdd160e4c1a5be043a071


    Headers

    Imports

    Sections

  • TT COPY.exe
    .exe windows:4 windows x86 arch:x86

    80fdf97c26f83962311900807d9085ee


    Headers

    Imports

    Sections

  • TT Statement.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • The Original Copy.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • UPDATE SOA USD-1227.41.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • URGENT ENQUIRY.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Untitled_20120_160110-1.exe
    .exe windows:4 windows x86 arch:x86

    e95b12c491cadb8330273bb2f9f50195


    Headers

    Imports

    Sections

  • Unusual location & IP Address.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bin_2CE6.exe
    .exe windows:4 windows x86 arch:x86

    d8c40e233c4d93537e08543c35416828


    Headers

    Imports

    Sections

  • bin_4B66.exe
    .exe windows:4 windows x86 arch:x86

    75a552359792887e4cc6a8ab103a4432


    Headers

    Imports

    Sections

  • bin_C237.exe
    .exe windows:4 windows x86 arch:x86

    c6056a17868441e937f66a79db10d3e7


    Headers

    Imports

    Sections

  • bin_protected_9DE6C1F.exe
    .exe windows:4 windows x86 arch:x86

    8085a6b0b4ca0c1b791a27a4468c7f15


    Headers

    Imports

    Sections

  • devis.exe
    .exe windows:4 windows x86 arch:x86

    02cb3117697d866b8016b32f3eea7a80


    Headers

    Imports

    Sections

  • dhl_doc7348255141.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • documento.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • new order -85486.exe
    .exe windows:4 windows x86 arch:x86

    8338f454c70c460f708c4e649cb98ffb


    Headers

    Imports

    Sections

  • payment 000012223.exe
    .exe windows:4 windows x86 arch:x86

    a1994712461b77d08945c8b38743cb91


    Headers

    Imports

    Sections

  • po 23232 signed.exe
    .exe windows:4 windows x86 arch:x86

    9c6bc17fd170d171290f273b4699fc6d


    Headers

    Imports

    Sections

  • products inquiry.exe
    .exe windows:4 windows x86 arch:x86

    4b59f7c3f6d66308de0637b4ff46742d


    Headers

    Imports

    Sections

  • products_inquiry.exe
    .exe windows:4 windows x86 arch:x86

    d5082d832b587e0f572abcf15aa919dc


    Headers

    Imports

    Sections

  • proforma invoice.exe
    .exe windows:4 windows x86 arch:x86

    47d15737507401c43dc8309fc74626de


    Headers

    Imports

    Sections

  • purchase order RFQ-HL51L07..exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • shipping doc.exe
    .exe windows:4 windows x86 arch:x86

    48f40250705c3c5bcb3746e7cfe9173b


    Headers

    Imports

    Sections

  • statement of account.exe
    .exe windows:4 windows x86 arch:x86

    5c72154f6aa370634ef6626d8ed06994


    Headers

    Imports

    Sections

  • swift.exe
    .exe windows:5 windows x86 arch:x86

    00be6e6c4f9e287672c8301b72bdabf3


    Headers

    Imports

    Sections

  • swiftcopy 433.exe
    .exe windows:4 windows x86 arch:x86

    ae42fffce57762433476311fc5ba0c1a


    Headers

    Imports

    Sections

  • swiftcopy.exe
    .exe windows:4 windows x86 arch:x86

    44e8a8a22cc4124331392306abd664c2


    Headers

    Imports

    Sections

  • updated statement.exe
    .exe windows:4 windows x86 arch:x86

    19a13e5ccff4d9d6cffa8e8c559b2e01


    Headers

    Imports

    Sections

  • w3TM24p.exe
    .exe windows:4 windows x86 arch:x86

    9421eac76679fe27a1a3dd6db426b1c9


    Headers

    Imports

    Exports

    Sections