Overview

overview

10

Static

static

3

JaffaCakes...c9.exe

windows7-x64

10

JaffaCakes...c9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    0s
  • max time network
    3s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2025, 18:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_8ffa0d45d09347276beea00bea0457c9.exe

  • Size

    644KB

  • MD5

    8ffa0d45d09347276beea00bea0457c9

  • SHA1

    ed4dbc24083034aeb1e45c6e29f815f819d882d0

  • SHA256

    24ec6c4ca5205bad2e59f36bc875928bc2ef33aeb6fbc6c9f9b3a54f843dce6e

  • SHA512

    7fc0beef115ca984adad9f13e4476195908469cff043ed5b481fff59b881e8d4f102dd337981803bb6252dac3d763ada0049e9225d3d58a07d72ecb92f9c6877

  • SSDEEP

    12288:j6onxOp8FySpE5zvIdtU+YmefT9/mqOplf2AQNWxgqFjj:Zwp8DozAdO98fplf2MJ

Score
10/10
pykspaworm

Malware Config

Signatures

  • Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Pykspa family
    pykspa
  • Detect Pykspa worm 1 IoCs
    worm

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ffa0d45d09347276beea00bea0457c9.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ffa0d45d09347276beea00bea0457c9.exe"
    1⤵
      PID:2544
      • C:\Users\Admin\AppData\Local\Temp\hrnoqjwarbx.exe
        "C:\Users\Admin\AppData\Local\Temp\hrnoqjwarbx.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_8ffa0d45d09347276beea00bea0457c9.exe*"
        2⤵
          PID:2036

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\hrnoqjwarbx.exe
        Filesize

        320KB

        MD5

        5203b6ea0901877fbf2d8d6f6d8d338e

        SHA1

        c803e92561921b38abe13239c1fd85605b570936

        SHA256

        0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060

        SHA512

        d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471

        Download Submit

      • C:\Windows\SysWOW64\jaurldpkcrarucllfq.exe
        Filesize

        384KB

        MD5

        9414784e20ebcd371f07faed435b083a

        SHA1

        9837c18a14e799576280c85780bd3112eb820319

        SHA256

        bbc41b88b4ca5861a1dcbc5436840cf58e6990835e68accfaf420e12a727f59a

        SHA512

        feac942b76babbda416677fb50783805ee4ed6a2972b40b263e73acd17d56c6c27acc50c82196bd54e4fb66b05c670a5513cb7c74d7f2371827ee3e9a6dc41c6

        Download Submit