JaffaCakes118_954b75a2c0fb7a8350307cfbc283e65ab46c000ad652236a1d5d5a9f9af950b5

General

Target
JaffaCakes118_954b75a2c0fb7a8350307cfbc283e65ab46c000ad652236a1d5d5a9f9af950b5
Size 677KB
Sample241230-b2ff2stmfm
SHA256 954b75a2c0fb7a8350307cfbc283e65ab46c000ad652236a1d5d5a9f9af950b5
MD5 84e521846bad031000476000e626a29e
SHA1 170653dbaada2aad0bd5ff22327e9731e375b10a
SHA512 16c09b8b4973c09bd8f3444d4341cc6544266ba092877e12452db9f27492b4a271c40cc2d7cbdb2a54592ba5b59ba128d0c90807880650b10b69c9854cebe364
SSDEEP 12288:QypiZF/GdV7Ba66tLFlKmjuWlRsgZw57NvSRxll4b/9+Sik7H4fQ2yrq8El8ykp+:QzLM7Ba6+LK85sgZwNNKX41sfQ2yNjV+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe

File Explorer

JaffaCakes118_954b75a2c0fb7a8350307cfbc283e65ab46c000ad652236a1d5d5a9f9af950b5

.zip 677KB
15921dcecdfca5c112a8494590c21339

.cab 677KB
Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe

.exe 841KB

JaffaCakes118_954b75a2c0fb7a8350307cfbc283e65ab46c000ad652236a1d5d5a9f9af950b5

SHA256 954b75a2c0fb7a8350307cfbc283e65ab46c000ad652236a1d5d5a9f9af950b5
MD5 84e521846bad031000476000e626a29e
SHA1 170653dbaada2aad0bd5ff22327e9731e375b10a
SHA512 16c09b8b4973c09bd8f3444d4341cc6544266ba092877e12452db9f27492b4a271c40cc2d7cbdb2a54592ba5b59ba128d0c90807880650b10b69c9854cebe364
SSDEEP 12288:QypiZF/GdV7Ba66tLFlKmjuWlRsgZw57NvSRxll4b/9+Sik7H4fQ2yrq8El8ykp+:QzLM7Ba6+LK85sgZwNNKX41sfQ2yNjV+
MD5 SHA1 SHA512 SSDEEP

Password

infected

Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 898019809aff31148304abc19ab0514838d5ed4ae75318fe8865b4e5b139d52f
MD5 42d33f1103e99970b5a2bd66cc7abacf
SHA1 18b40de46605a148bd005f07f1396ea4be30f962
SHA512 471ef7e285ae5bb0db67e6722dde3877180d980f1cef271bf81e8c1f8c3fbd26ffa435eb04b0ef14ae6898ac26ed8b235eb9b203947aa4020955e5989e22fbbc
SSDEEP 12288:Duup9hCcfZ/2Yp45XWCPrpLlafo3arpcYVx1Izq+lG/hS2zG9+aw9cNq0p2W:qrk/2Yp4JWKmhpcewu+lghjZqN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

861478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

JaffaCakes118_954b75a2c0fb7a8350307cfbc283e65ab46c000ad652236a1d5d5a9f9af950b5

15921dcecdfca5c112a8494590c21339

Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_954b75a2c0fb7a8350307cfbc283e65ab46c000ad652236a1d5d5a9f9af950b5

15921dcecdfca5c112a8494590c21339

Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe

mscoree

dotnet