JaffaCakes118_63feb06b82ab8b1e98679b303f91a6231e551fbbf01cc4bc48bfba5980f30d33
- SHA256 63feb06b82ab8b1e98679b303f91a6231e551fbbf01cc4bc48bfba5980f30d33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3eac85459e4de2a6ab0b4703278e728920f4bc1bf2d0ed5454e8f5f02a0a78ab.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
3eac85459e4de2a6ab0b4703278e728920f4bc1bf2d0ed5454e8f5f02a0a78ab.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target JaffaCakes118_63feb06b82ab8b1e98679b303f91a6231e551fbbf01cc4bc48bfba5980f30d33
- Size 677KB
- Sample241230-d5jc8axjay
- SHA256 63feb06b82ab8b1e98679b303f91a6231e551fbbf01cc4bc48bfba5980f30d33
- MD5 4405120ee64bd755cf9980cf8b3c9749
- SHA1 02c00aebeb743e5ffbed140e21baf96108f3b6f2
- SHA512 c422774d16efbd18b0d20c5afddd15d506a11d75b124a4e905b6a34307725ab6d690ae9bded405545ea23fab6977db7c3f3cfabe97574c5bad5a0a636d6a7a25
- SSDEEP 12288:Iw/mYGp1NimFQ/f/Fkhj6ofKfcT1mZG2eD5ppt5d0lwLuE:ISmYGp1NimFQ/f+16cCckZG/VrKlwLuE
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3eac85459e4de2a6ab0b4703278e728920f4bc1bf2d0ed5454e8f5f02a0a78ab
File Explorer
-
JaffaCakes118_63feb06b82ab8b1e98679b303f91a6231e551fbbf01cc4bc48bfba5980f30d33.zip 677KB
-
3eac85459e4de2a6ab0b4703278e728920f4bc1bf2d0ed5454e8f5f02a0a78ab.exe 814KB
3eac85459e4de2a6ab0b4703278e728920f4bc1bf2d0ed5454e8f5f02a0a78ab
- IMPHASH 8e49cd737c177fb9961f518322505e61
- SHA256 3eac85459e4de2a6ab0b4703278e728920f4bc1bf2d0ed5454e8f5f02a0a78ab
- MD5 293d130d2a76caf1890cd4e14b235bfb
- SHA1 68f3bc6281107181de6f7f0e22ceebe1d478d038
- SHA512 4d8d15f5a939f143bdb88fdc204fd8a51b72dd045a5731b4b105f2cab0fa4f13de0a08df1115948857f42670d82d31cae6cb411987033af5af87b60e2722af14
- SSDEEP 24576:8uJI75bMVNiwFQ/fG1mW4CwZWzVlIlwCF:8uJNNioxACwAVlSz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
45600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\wocorivekobol\yukud_reheg.pdb
kernel32
VerifyVersionInfoA
VerifyVersionInfoW
WriteConsoleInputA
EnumDateFormatsW
FindNextFileW
CopyFileExA
DnsHostnameToComputerNameW
ReadConsoleOutputCharacterW
SetConsoleActiveScreenBuffer
LockFile
GetProfileSectionA
QueryDosDeviceW
RequestWakeupLatency
GetProcessPriorityBoost
GetDriveTypeW
GlobalGetAtomNameA
DeleteFileA
FindNextVolumeMountPointW
TlsGetValue
SizeofResource
WriteConsoleInputW
GetConsoleTitleW
GetComputerNameExW
OpenEventA
CallNamedPipeA
GetModuleHandleW
GetSystemDirectoryA
GetDriveTypeA
BuildCommDCBAndTimeoutsA
GetProcAddress
GetModuleHandleA
GetShortPathNameA
GetCommandLineW
InterlockedIncrement
InterlockedExchange
CopyFileW
CreateActCtxW
FormatMessageW
EnterCriticalSection
FindNextVolumeW
CreateIoCompletionPort
LoadLibraryA
CreateNamedPipeW
GetSystemDefaultLangID
GetConsoleAliasesLengthA
WriteProfileSectionW
AddAtomW
InterlockedDecrement
HeapFree
_hwrite
InterlockedCompareExchange
GetStartupInfoW
CreateMailslotW
GetCPInfoExW
GetSystemWow64DirectoryW
GetLastError
GetPrivateProfileIntW
GetConsoleAliasExesLengthW
DebugBreak
SetLastError
LoadLibraryW
FindNextFileA
VirtualAlloc
GetACP
lstrcpyA
GetConsoleAliasA
GetDiskFreeSpaceExA
TerminateProcess
EnumResourceLanguagesA
SetConsoleTextAttribute
GlobalGetAtomNameW
CreateJobSet
MoveFileW
lstrcpynA
EnumSystemLocalesA
GetPrivateProfileSectionNamesW
GetFileAttributesW
FileTimeToSystemTime
CopyFileA
GetTapeParameters
lstrcmpW
SetEvent
MoveFileA
CreateMutexA
FindResourceW
GetCommState
FormatMessageA
CreateFiber
GetConsoleFontSize
LocalAlloc
SetFileShortNameA
lstrcpyW
HeapLock
GetFileAttributesA
SetCalendarInfoW
GetSystemWindowsDirectoryW
GetConsoleAliasesW
EnumDateFormatsExW
GetComputerNameW
GetPrivateProfileStructW
_hread
LocalFlags
OpenWaitableTimerA
EnumResourceNamesW
CreateFileMappingW
SetProcessShutdownParameters
lstrcpynW
WriteConsoleW
FreeUserPhysicalPages
WriteConsoleOutputCharacterW
OpenJobObjectW
CreateFileW
SetCurrentDirectoryA
GlobalWire
GetFileInformationByHandle
GetProfileSectionW
CommConfigDialogW
CreateFileA
GetDefaultCommConfigA
LocalFree
Sleep
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
HeapValidate
IsBadReadPtr
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameW
GetCurrentProcess
IsDebuggerPresent
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
GetOEMCP
GetCPInfo
IsValidCodePage
SetFilePointer
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
OutputDebugStringA
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CloseHandle
user32
CharToOemBuffW
CharUpperA
GetMessageTime
LoadMenuA
advapi32
AbortSystemShutdownW
Name
.text
Size
198KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
586KB
Virtual Size
622KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vukipiv
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.kozoca
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ketoreb
Size
512B
Virtual Size
150B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=150, version=20413,
count=23, id=149, productName=VS2008 build 21022, version=21022,
count=136, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=201, id=1, productName=Unmarked objects,
count=63, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,