Overview

overview

10

Static

static

3

JaffaCakes...dc.exe

windows7-x64

10

JaffaCakes...dc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    0s
  • max time network
    2s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2025, 19:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_9573b06e5dbcb0a2dac71b4ba63da8dc.exe

  • Size

    500KB

  • MD5

    9573b06e5dbcb0a2dac71b4ba63da8dc

  • SHA1

    457ea5edcfea4b67c47fdd8eed27e9bfbd6e970a

  • SHA256

    a2c7d8f49e2a4d74df79df52b5a7aa0eb0ea546383ae020cc6e104d97aa8c216

  • SHA512

    c91368e11cb992c86ffd4595ae41a80c024f8e3d921f68be30ec78335ed41b97f5b3da4d3b337aa12dd04e38fbf5262500b16ecb9028ecde3827f2fa02618458

  • SSDEEP

    6144:kj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionj7E4:u6onxOp8FySpE5zvIdtU+Ymef

Score
10/10
pykspaworm

Malware Config

Signatures

  • Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Pykspa family
    pykspa
  • Detect Pykspa worm 1 IoCs
    worm

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9573b06e5dbcb0a2dac71b4ba63da8dc.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9573b06e5dbcb0a2dac71b4ba63da8dc.exe"
    1⤵
      PID:2412
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_9573b06e5dbcb0a2dac71b4ba63da8dc.exe*"
        2⤵
          PID:1980

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        Filesize

        320KB

        MD5

        5203b6ea0901877fbf2d8d6f6d8d338e

        SHA1

        c803e92561921b38abe13239c1fd85605b570936

        SHA256

        0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060

        SHA512

        d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471

        Download Submit

      • C:\Windows\SysWOW64\pdwsidmiaqplzcogyc.exe
        Filesize

        256KB

        MD5

        3aea6d8ffa787a939ffda762dbaf06eb

        SHA1

        d0347934096795180cb4dd48876d39c0e8d0c27f

        SHA256

        b4d9334444534b4c9de637fd0997f15b596210e355fb0279e3b449e977fb7d83

        SHA512

        726b4aebbea8c8f3f5c123f9edb70b772ade611c21e5567f7b7236a60135de71b16307ad5c196c17034e032e0179c9a08a33c91ac48c5738d522fc0011fcff51

        Download Submit

      • \Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        Filesize

        92KB

        MD5

        876df6c4cc8fb660506d7b7684b82b0e

        SHA1

        42dce806d219be27fcb312aaa16a608164273b7b

        SHA256

        82abc27ad2332e72892d60f15f9090dad0efd6bf4c30a9075803a9b137cc9b7a

        SHA512

        38c4500a93e3aa89aaa0e0b81ed89f1a8cfbd6ea33c4fab1155c74fd1159ebc18f7fb362e873f556da6d98f979e8a282b07cbd35c79f77f028087a0f5ad181fa

        Download Submit

      • memory/2412-0-0x0000000000400000-0x000000000047D000-memory.dmp

        Filesize

        500KB

        Download