darkcloud | JaffaCakes118_4d6b9647083f9bccb7dccb9a78328a5cdb8926e5e2f7f86dd5e796cc4e16b0ca

General

Target
JaffaCakes118_4d6b9647083f9bccb7dccb9a78328a5cdb8926e5e2f7f86dd5e796cc4e16b0ca
Size 260KB
Sample241228-2mse6stnbw
SHA256 4d6b9647083f9bccb7dccb9a78328a5cdb8926e5e2f7f86dd5e796cc4e16b0ca
MD5 1f84e27075d0caaf7fe83b4f432a2fc0
SHA1 b1850b5332c403157849863c9154ad408b1fed8d
SHA512 a3ea861a9eec20edd6793043947d872c9ffafd70c9e0073ae7211f08b71a28314c0af1e1ab61c31ba59d879c6e20e2ffbbdeaa0a9fe4daae92a542cc681d0bfb
SSDEEP 6144:EGwmcjRjRwX8LKQvHU1YvwZQEQvcMeMP7:ELjuXqvICey
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5539828744:AAFvhET_5okhs4LhzuFvFMPuDbhUPvN0rqY/sendMessage?chat_id=1856108848

Signatures

Darkcloud family
darkcloud

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_4d6b9647083f9bccb7dccb9a78328a5cdb8926e5e2f7f86dd5e796cc4e16b0ca

File Explorer

JaffaCakes118_4d6b9647083f9bccb7dccb9a78328a5cdb8926e5e2f7f86dd5e796cc4e16b0ca

.exe 260KB

JaffaCakes118_4d6b9647083f9bccb7dccb9a78328a5cdb8926e5e2f7f86dd5e796cc4e16b0ca

IMPHASH eeb996fe770815da34c7a0a470f34c05
SHA256 4d6b9647083f9bccb7dccb9a78328a5cdb8926e5e2f7f86dd5e796cc4e16b0ca
MD5 1f84e27075d0caaf7fe83b4f432a2fc0
SHA1 b1850b5332c403157849863c9154ad408b1fed8d
SHA512 a3ea861a9eec20edd6793043947d872c9ffafd70c9e0073ae7211f08b71a28314c0af1e1ab61c31ba59d879c6e20e2ffbbdeaa0a9fe4daae92a542cc681d0bfb
SSDEEP 6144:EGwmcjRjRwX8LKQvHU1YvwZQEQvcMeMP7:ELjuXqvICey
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaCyMul __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 __vbaFpCDblR8 ord698 __vbaVarIndexStore __vbaNextEachVar __vbaFreeObjList ord516 __vbaStrErrVarCopy __vbaVarIndexLoadRef _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 __vbaStrCat ord660 __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj ord556 __vbaLenVar _adj_fdiv_m32 ord666 ord667 __vbaAryDestruct __vbaVarXor __vbaVarIndexLoadRefLock __vbaLateMemSt __vbaForEachCollObj __vbaExitProc ord593 ord594 __vbaI4Abs __vbaObjSet ord595 __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaBoolVar ord520 __vbaRefVarAry __vbaVarTstLt __vbaBoolVarNull _CIsin ord709 ord631 __vbaErase __vbaNextEachCollObj __vbaVarCmpGt ord525 __vbaVarZero ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 __vbaGet3 __vbaStrCmp ord529 __vbaVarTstEq __vbaAryConstruct2 __vbaPutOwner3 __vbaDateR8 ord560 __vbaI2I4 __vbaObjVar DllFunctionCall __vbaVarLateMemSt __vbaVarOr __vbaFpUI1 ord564 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaRedim __vbaR8Cy __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 ord710 __vbaStrUI1 __vbaExceptHandler __vbaStrToUnicode ord712 __vbaPrintFile ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord531 ord716 __vbaFPException ord532 ord717 __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaGetOwner3 __vbaVarCat __vbaDateVar ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec ord648 ord570 __vbaVarLateMemCallLdRf __vbaNew2 __vbaInStr _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaVarSetObj __vbaStrCopy __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 ord579 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaAryLock __vbaVarAdd __vbaLateMemCall __vbaStrToAnsi __vbaVarDup __vbaFpI2 ord616 __vbaVarLateMemCallLd __vbaFpI4 __vbaVarCopy ord617 __vbaRecDestructAnsi __vbaLateMemCallLd _CIatan __vbaCastObj __vbaAryCopy ord618 __vbaStrMove ord619 __vbaStrVarCopy __vbaForEachVar _allmul _CItan __vbaAryUnlock _CIexp __vbaMidStmtBstr ord580 __vbaI4ErrVar __vbaFreeStr __vbaFreeObj ord581

Sharing