3f0a46b1febcd33e25da42f6b491a273_JaffaCakes118
- SHA256 033570bf95d42dad2652ed0662a2369d954d4580d1b872ea44041697d0edc237
Password
infected
Resubmissions
01/10/2025, 17:19
251001-vwbqfstqz81008/07/2025, 08:09
250708-j16kvavwcx1004/07/2025, 07:35
250704-je4t5afq8z04/07/2025, 04:55
250704-fj7j2axqz904/07/2025, 04:32
250704-e6acdaap9104/07/2025, 04:30
250704-e483xsap8v1004/07/2025, 04:18
250704-exa8bahn4t13/05/2024, 10:29
240513-mjfjwabd2810Behavioral task
behavioral1
Sample
323CANON.EXE_WORM_VOBFUS.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
WORM_VOBFUS.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
WORM_VOBFUS.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
WORM_VOBFUS.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 3f0a46b1febcd33e25da42f6b491a273_JaffaCakes118
- Size 285KB
- Sample250704-e483xsap8v
- SHA256 033570bf95d42dad2652ed0662a2369d954d4580d1b872ea44041697d0edc237
- MD5 3f0a46b1febcd33e25da42f6b491a273
- SHA1 2b98f85d3b6514856dfe55401c68e200a7e21bd3
- SHA512 2545524a7c9052cb1df1d561cc9b9c6b1decbc3c0ca708f3836739657d4f0f8f59a7301499827ec000b1902516d17947d3c9819557b08c356ef665689639e5e9
- SSDEEP 6144:pnt7lIlDAroRJ+RJsKfnwpaxJ9nKcVhvr7DFLPLegEF4x3ddRUYC:pnVyDsnRhKcVhvr7RLPLeF4x3dPtC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects win.vobfus. 2 IoCs
Malware of this family searches for computers on a network and creates copies of itself in folders with open access. For the program to be activated, the user must first run it on the computer.
resource yara_rule static1/unpack001/WORM_VOBFUS.SMIS win_vobfus_auto static1/unpack001/WORM_VOBFUS.SMM2 win_vobfus_auto - Vobfus family
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/323CANON.EXE_WORM_VOBFUS.SM01 unpack001/WORM_VOBFUS.SMA3 unpack001/WORM_VOBFUS.SMIS unpack001/WORM_VOBFUS.SMM2
File Explorer
-
3f0a46b1febcd33e25da42f6b491a273_JaffaCakes118.zip 285KB
-
323CANON.EXE_WORM_VOBFUS.SM01.exe 300KB
-
WORM_VOBFUS.SMA3.exe 212KB
-
WORM_VOBFUS.SMIS.exe 188KB
-
WORM_VOBFUS.SMM2.exe 92KB
323CANON.EXE_WORM_VOBFUS.SM01
- IMPHASH 1096f8af85bd5277016c3c53ff549c21
- SHA256 fe32599d6f2d1a874b65928cfd01a87f9d0a83d2b1e30b8f1148c8ad8aefd985
- MD5 70f0b7bd55b91de26f9ed6f1ef86b456
- SHA1 d774cdaa9082ac15feb9514e7364d76092a6807a
- SHA512 3928885f382a5f833eb2c2b4641b8227138dce4cb161cae3049e837ba13384119ec8aaf70c6e85c99583c07db18bbaab77e19bdc3485f9e23adb3be3d0ab7912
- SSDEEP 3072:XMIQ/iifD4gfGWKdbKsQOO1HobSp0xl6EPpc4VpJzNDdlcjBPZz:XBciib4gfGWcmsQobG0xlfPpndiVPB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
ord582
ord583
ord585
ord187
ord588
MethCallEngine
ord516
ord517
ord518
ord660
ord669
ord593
ord300
ord301
ord595
ord303
ord598
ord305
ord306
ord520
ord307
ord309
ord709
ord631
ord632
EVENT_SINK_AddRef
ord528
DllFunctionCall
ord564
EVENT_SINK_Release
ord311
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord313
ord712
ord607
ord608
ord717
ProcCallEngine
ord535
ord537
ord644
ord645
ord681
ord685
ord578
ord100
ord579
ord616
ord617
ord618
ord619
Name
.text
Size
172KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
124KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=13, version=9782,
WORM_VOBFUS.SMA3
- IMPHASH 2a817e26daa8f0b5c8d734142a40a300
- SHA256 e54bbabcaed8ace734f53234a44ad1e697e9cd2252255b59906fc5e3322c1be6
- MD5 7b19b2b8aed0285eb2b2c5cb81313569
- SHA1 e0a536ed1b6c6f202412079e1213305543b533a3
- SHA512 31f79937bb4aba8aecd95daf310c9dd22f06f4f842f4bae64502e27e44aa3ef26f25d8d72adae36f25aa4db6f7b229926dc8bda4d09613f7d1f6968a15cc2eb0
- SSDEEP 3072:/lh+mENvtRR3FmHmpF+CklMnQIKAWNBlm/XBq6ciFCdaNdVOvs:9h+NNFRRCmpF+CklMYuFciFC+Ok
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4524
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
ord187
MethCallEngine
ord517
ord518
ord519
ord669
ord301
ord598
ord520
ord307
ord522
ord709
EVENT_SINK_AddRef
ord528
ord529
DllFunctionCall
ord675
ord569
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord606
ord607
ord608
ord717
ProcCallEngine
ord535
ord537
ord644
ord645
ord572
ord681
ord575
ord685
ord578
ord100
ord616
ord617
ord618
ord619
Name
.text
Size
100KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=13, version=9782,
WORM_VOBFUS.SMIS
- IMPHASH 7922e1be820df60496a2bba714aefa66
- SHA256 7f7e5751277a0169ec2eb4492b0489ca850808f64b52e708f716f46ac160e54b
- MD5 634aa845f5b0b519b6d8a8670b994906
- SHA1 82ad537a7acb18702a02b6dd2c6d12eaac0b3656
- SHA512 63a72331fed9c53d593d2b572fc35efe24eb9d5d292cbe891765926de60987fefa0ddc95aa9037384e45f52015ef075c4ce9aaf9bd297e4e437f606104257cbf
- SSDEEP 3072:dzimFU1cIsisNUbaxF6qJDe94aqosAm+w90Z69:tisYGDe94aqosAm+w90C
- MD5 SHA1 SHA512 SSDEEP
-
Detects win.vobfus.
Malware of this family searches for computers on a network and creates copies of itself in folders with open access. For the program to be activated, the user must first run it on the computer.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
ord582
ord583
ord585
ord187
ord587
ord588
MethCallEngine
ord516
ord517
ord519
ord660
ord662
ord591
ord593
ord594
ord301
ord595
ord598
ord520
ord307
ord522
ord631
ord632
EVENT_SINK_AddRef
ord527
ord528
DllFunctionCall
ord670
ord564
ord673
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord710
ord711
ord712
ord606
ord607
ord531
ord717
ProcCallEngine
ord535
ord644
ord645
ord648
ord571
ord572
ord681
ord685
ord578
ord100
ord616
ord617
ord618
ord619
ord546
ord581
Name
.text
Size
144KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=13, version=9782,
WORM_VOBFUS.SMM2
- IMPHASH 07fc16727ba0a209e8399921f9454961
- SHA256 e4d0b740421cfba7e7e4a30a2a69d59486e7347979af94145fb8f335960c33d5
- MD5 4e15d812491ff0454f1e9393675b1c60
- SHA1 ec9291957872191902fb525641040b42e057acd8
- SHA512 9554e4e882a176b7b38b55dc2a80400354aae90a12e7e0c3a4f481e68032423f65f28c439621dc27fdf4c99e8ad10aaed949f140398970480c26aa574b7a5982
- SSDEEP 768:29QXHugT0lvlq/P1vwwrnkjBt1TJk8vK8GSdrD9wGy241ZUb/CxhYLJP30UOEGaK:i0PuBpmUbaxeLd4IfmkBwC8BD+KBq2x
- MD5 SHA1 SHA512 SSDEEP
-
Detects win.vobfus.
Malware of this family searches for computers on a network and creates copies of itself in folders with open access. For the program to be activated, the user must first run it on the computer.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4532
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
ord582
ord583
ord187
ord587
ord588
MethCallEngine
ord513
ord516
ord660
ord591
ord593
ord595
ord301
ord598
ord307
ord631
ord709
ord526
EVENT_SINK_AddRef
ord528
DllFunctionCall
ord676
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord607
ord531
ord716
ord717
ProcCallEngine
ord644
ord645
ord648
ord572
ord681
ord685
ord100
ord615
ord616
ord619
ord546
Name
.text
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=13, version=9782,