JaffaCakes118_65ad6ea66f265da765e99f6c29eff4ca13b0463b1e77285c2501e5df5a32286d
- SHA256 65ad6ea66f265da765e99f6c29eff4ca13b0463b1e77285c2501e5df5a32286d
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e93834f6aafd3afa40912103139f648b18064c5c85b2a4f995dff606d158cd91.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e93834f6aafd3afa40912103139f648b18064c5c85b2a4f995dff606d158cd91.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target JaffaCakes118_65ad6ea66f265da765e99f6c29eff4ca13b0463b1e77285c2501e5df5a32286d
- Size 255KB
- Sample241225-c8jbysvqhl
- SHA256 65ad6ea66f265da765e99f6c29eff4ca13b0463b1e77285c2501e5df5a32286d
- MD5 0480227aba351a789e17dc7481fe9845
- SHA1 e913c7b0f82c0ad20ca4db81eba8264a48c9de7d
- SHA512 ab3c4944f4061587def35023a76f71c904f60bb73eb7e88f41d7cbb6c034dacf40e8dbf7aed8d65a00ee5778ebb66d459cde93e9120a960c828b1790cf64f831
- SSDEEP 6144:J3Z1IRmOIeyMZx3LI33//59yhzXjSUnjFfcvd+:JXPhM7Y/5cTSUZsd+
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll
File Explorer
-
JaffaCakes118_65ad6ea66f265da765e99f6c29eff4ca13b0463b1e77285c2501e5df5a32286d.zip 255KB
-
e93834f6aafd3afa40912103139f648b18064c5c85b2a4f995dff606d158cd91.exe 299KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Aqua_14.bmp.jpg 6KB
-
Bryologisk.Jen59KB
-
Sepiolite212/Versify/Undemolishable/Uvederhftigheden/emoji-body-symbolic.symbolic.png.png 193B
-
camera-disabled-symbolic.svg618B
-
gravecloth/Podsolering/Patroons/go-up-symbolic.symbolic.png.png 168B
-
gravecloth/Podsolering/Patroons/network-wireless-encrypted-symbolic.svg977B
e93834f6aafd3afa40912103139f648b18064c5c85b2a4f995dff606d158cd91
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 e93834f6aafd3afa40912103139f648b18064c5c85b2a4f995dff606d158cd91
- MD5 083db2ba5107452aee57ab26cff7a4fe
- SHA1 fc5eaafe57816ebd7fc560b2d66a97323a7fd942
- SHA512 bd012db0a6467a52513eb5916125622bb111b0dce63679a69e62083c8f6a34113fcaade9ece96a0b0cc7d664078a7649d904218b495a03a1515d9fa6de4be9ff
- SSDEEP 6144:bYa6glG2JYtxtI4hitoO1EEl8AbZX/9TLeY9ap4vlno:bYAG2JjUd0t9X/djap21
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cb:81:ab:5b:27:1b:0e:e5:5f:8b:1c:95:64:dd:06:fb:50:d2:3a:3c:24:4f:ed:9f:bb:2a:39:d6:fc:1c:ce:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Straksfradraget denotational amazonian\ ,O=Elaborates,L=Guigneville,ST=Centre-Val de Loire,C=FR
Chains
Jul 24, 2022
Subject
CN=Straksfradraget denotational amazonian\ ,O=Elaborates,L=Guigneville,ST=Centre-Val de Loire,C=FR
Serial Number
0f:d1:03:c6:3a:fb:86:8f
Issuer
CN=Straksfradraget denotational amazonian\ ,O=Elaborates,L=Guigneville,ST=Centre-Val de Loire,C=FR
Timespan
Dec 24, 2021 - Dec 23, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Aqua_14.bmp
- SHA256 ad65a5c48a49bf1b8b14940a773c54c56152587535b0fe62a9d2ae9a8fa5d3c7
- MD5 0a3769737de59c1f090d3643457de2db
- SHA1 42422e32230aa8309823c3c36824b08bce76578b
- SHA512 e1fbd8df12fe79506671eb06f7822f2b9e03b1bb993b81234ab2d802bc5515dc7bf708a46509eadc70a35d08269027c2ab6accd0582010b3f00c5220308f884f
- SSDEEP 192:oXRnQNCs7AGtYP0DUchR88zHh1wkBiCKfAD6BnJ/vt8KD:KRQNCqtA0DXhwkB9S3/vtFD
- MD5 SHA1 SHA512 SSDEEP
Bryologisk.Jen
- SHA256 d78bef3649be21663415513714b41afbdcfa73150af4db57394facc533d2fa19
- MD5 8469630daef7ab935bdddbae75ae1357
- SHA1 ca489ddaf7867b54f184b925562b25a3a6a4757f
- SHA512 5cf55ca2e8de3c5ff8d8d0f3916b762ebbbb6dc9e8290e7706638b7566a4d057321b9ea6f7176e11e85af20f83ebfa6a60e200596e8f193cd4489ad4a7ea3f2e
- SSDEEP 768:Q7C3lRKMqn6/fS/QX6qko83E+cVcN/0AP+lZ3VzLz2IqHLXDLo+ZEI/b:Q7CrJ/ms6qko83rcVcNGoIqHrDAIz
- MD5 SHA1 SHA512 SSDEEP
Sepiolite212/Versify/Undemolishable/Uvederhftigheden/emoji-body-symbolic.symbolic.png
- SHA256 7a08d7b1cc724a453a0c3eb2f36369d7fd6ac6bd965ce0b4d075d570ed369a9b
- MD5 f492568998d5783731d50d7ca73ac7a3
- SHA1 e87b96367bdb02176067336a1cce3b32ebdcb3b2
- SHA512 2c6c726426ea6dd4c7ccc141152e24dd46bdb11d3db45ed7ba6eac06de922f69e5172d5431d63b9acf96e54b89857317ca0f87880f7b03c43af9f7416ee95c73
- MD5 SHA1 SHA512
camera-disabled-symbolic.svg
- SHA256 2291ee4d0c9d67901805031986bb37842b74d391ce191b83029f15b632480a90
- MD5 aa84f7e11cd73e4add65b6a11444d9e3
- SHA1 866c314dc7f13554f5e707afcf2ed738910d2442
- SHA512 bb81a59eef135f9b97fb5858f1c0deff1de461369b17548b348be9b02ee2ba3554ed54dbb8514f21f74d0c929db6cc294eb967e4effdc3f802fbaeca7ddefdaa
- MD5 SHA1 SHA512
gravecloth/Podsolering/Patroons/go-up-symbolic.symbolic.png
- SHA256 5392b1c05c4ae043517d1c704bf738345c0a6e59c0d3a57d6fc3334ca2ae765d
- MD5 718dd4516c6c7c5d3fb16963c8417bb9
- SHA1 f3dd214fb3dd9642beee9cd9124894dc1059fc36
- SHA512 5b66006ab3221bc1fc1eb28e5630f2e7df2c937d4c1c59d1e699b4a4fb91e1a4c7b32bb25f8e37f1311ee6154a149a419a29cfbcebc94b145ddcc15537ad3578
- MD5 SHA1 SHA512
gravecloth/Podsolering/Patroons/network-wireless-encrypted-symbolic.svg
- SHA256 cf4f235f2427a673fac1603ec07ec0fdb401e2502a53c27f33cad96ae1570b88
- MD5 a689628cee1687dd3216c90757e0aff8
- SHA1 59d8dd6e1724921c7a4c5a0809fa6745b6e328c0
- SHA512 e1250065165e77f8c78c9c947e845537cbf5d8c41f9d744a5f0b4b6fcfd8a17dfb68fc9974f9574ded7dbf8a0db3942276d75a64a60bb97ea81fcb3218f27dc4
- MD5 SHA1 SHA512