jaffacakes118_27080a6dcd1a35e0f79eecf54d25cec8cecf3b232a4b0f2e24567c4f0009102c[.]bin

resource
jaffacakes118_27080a6dcd1a35e0f79eecf54d25cec8cecf3b232a4b0f2e24567c4f0009102c.bin

resource
unpack001/$PLUGINSDIR/nsExec.dll

jaffacakes118_27080a6dcd1a35e0f79eecf54d25cec8cecf3b232a4b0f2e24567c4f0009102c.bin

IMPHASH c32ba42c73a2bc24d2788f7750d87edb
SHA256 27080a6dcd1a35e0f79eecf54d25cec8cecf3b232a4b0f2e24567c4f0009102c
MD5 e8e297b5bd9ed69e3e4b757eba6a3d16
SHA1 96611cea1b14cc99398838cb2252b1f31ae040ae
SHA512 243df63cf387418b5af5d4a882e736db34a1eeb0acef6eb97acd26fc51beb743a5106b9eb4aa2f15229965204da4ca1b77c95231e1280c42a86e7bd9c91322af
SSDEEP 24576:LSUjOolHQ1+BXwEGat6RfTvYKtXbLo7cXYPsW7hmWS2tmke8j:LColw1+aEGatsYKtTbzW+N8j
TLSH
T1284533098D096D37F39214FBD681A613FFD095850CE95BAFD2B44EA47521BC98D2EB03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

79:bc:3f:60:06:8b:61:3c:8b:0a:0b:81:6e:01:4b:d4:f7:fc:58:b5:68:ac:70:50:3c:e5:0d:10:3a:e3:52:46

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SIA Digimoney,O=SIA Digimoney,L=Riga,ST=Riga,C=LV

Chains

Nov 7, 2024

CN=SIA Digimoney,O=SIA Digimoney,L=Riga,ST=Riga,C=LV

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=SIA Digimoney,O=SIA Digimoney,L=Riga,ST=Riga,C=LV

Serial Number

77:c1:46:d5:e0:97:78:f5:4d:48:2a:2f

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2024 - Mar 26, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

1

Major OS version

5

Entry point

13614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
TLSH
T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

RootsTeen/Honduras.dot

SHA256 85d91cb382798db50e32c2861438a40fbb008aa9a8208b5252890920e1ec3707
MD5 1a10ed75994b6ac50e6eb795baaaa54b
SHA1 837d02a0cdd8a0fc566f50deed75971d487c2759
SHA512 1d6ad486334880ba1ada06ebc215814781c2234e28286467f15e94edc2ddf28559e3c35bc5da6314c220b17fea985f1a3eab05cd85409b20d1bc5faf099ad254
SSDEEP 6144:zfOFVeoK73GafDvk4b8dhmYVSufyOGMTVEVKR93cV:zcVk7WafDz4dsYVtfycTVEVAU
TLSH
T1B9342377C9D0A0A50B0642D99B062CD727ED6735EC6A2BFCCD4D93A8BC0BD1A52C474B
MD5 SHA1 SHA512 SSDEEP TLSH

RootsTeen/Mandatory.dot

SHA256 a900047a3cb8bcf8bcff3850174ec7298ff41372f4aab201bdcfb938754f5c6c
MD5 a5d70dbd526eaf51f3efc9bdb23188dc
SHA1 5def5838beba286c823c8f2c7062331b8322e825
SHA512 4bd44f902608786734fe45a42203c8824ec1f09b8a072a116469f6b1bfdd3003bfe561436de5780d6ee79191b66f16acb91f48696d98769f3ec66eaac1560c07
SSDEEP 12288:S4V35dzU+XaRcUKNMhVCLWPwS5YuYKUEnSPGJ+8yof+XWlV:bVb67KyxwSeuTj+uiWL
TLSH
T1B9C423B3B8C86B0D124BAD010D7448AB4545D067FBA56C87461BFC7EE902336299DBFB
MD5 SHA1 SHA512 SSDEEP TLSH

Asked

SHA256 f80492e8d15109258e64d9ee2cec40496e93be42c8d32a4c75ce200a261ec159
MD5 c604a8200a183a036a5810aa522d0cd7
SHA1 2f4e896188f8724013536a842d6a8c3162d336e6
SHA512 948caadf91142aae638d5e1e78857132f201383f8cf40ad39c15cf2ecb8bc49301386e4d3616f4a94f077f1d3263f4e9d6f943f58e0c84da6097d60426d65948
SSDEEP 1536:6dgebjpcU8VSCxAp1HElS4F1ZoLz3BuXTHdToONU7DYrVMvAS8W+ogxSOaSUHPl1:3U8QCgh+qLzxc9TvNU7DYrVUhijUvlgi
TLSH
T17EB37C516BE611FDD6ABD134CC079A0BFA317816033986DB52E49A636F23BE1523F321
MD5 SHA1 SHA512 SSDEEP TLSH

Dim

SHA256 787a4671988aa740bd461e3d670f2f8cc32a12f5b4dc3df435352ec51a223480
MD5 4b0aaef1e5f2039a0965e21bf6d071e7
SHA1 2befc8b14fdd7ca29993bc4fbf7c02c2bb487228
SHA512 13855fe332ab7497b871c9f2739c1349e40c3e13b4f0e2a4e41e9bd0c99a38c2236189d0f8c3d5d221abb37939f5173634eb135e822eedf5c077e04e746bc3f7
SSDEEP 768:sU5KSOM4qPpDOAI/VkrbOhIs28Oc1q/fHwRTyaecoiyiwXpmHDZJbQHuLwV/h5Fj:jj4upDK9q4Dw3c61RG314
TLSH
T123435C653AA853CCC5BEF560E613D40BE7E2B80543F99B0B02BE96921F97723742E315
MD5 SHA1 SHA512 SSDEEP TLSH

Hebrew

SHA256 643f2f7fc32d89b1a506dbf4d43dab847b25b56dab58b8d34bf254a53b844427
MD5 9a8ee91e0d45de47e966c6fea7623c14
SHA1 d37752b98e58564d05856524cc574f6b90b2be69
SHA512 a1e4c19da1040d973f4a12719d3910f325135cd62795dff0e7e14d6949771e14e4f946392cb1916c3fc871ae7e79fdb0c26b843655a9cd4a1446807ced89c9c1
SSDEEP 1536:5IU15AG73prFCtNwFqGqUqHHM/cZ+nVz1gNlySkcFsw:5t2wQGq/hoVRgNkSXF/
TLSH
T195939E1122B111FED1EFA17A8A5A6517EB72B8450B20C7C703E189F73327BD11BAB352
MD5 SHA1 SHA512 SSDEEP TLSH

Len

SHA256 0ff840887d2e77ffcee0ae2e7efb790963def6ebd0b2529c9f7b8a62b500fb8e
MD5 672f593108157e3cdcf50d9eb29f837d
SHA1 dd0c7f4965c98faaf16ff60158b9d56dcac1e21e
SHA512 33ea3c0a566d3bb13514de05687de25381d1b7b52d718da79a89efd8678d67f271c20087f7f8267ae5311e82f0bbebf67ff9b36f23ebc8e4e1f32b18fde768a8
SSDEEP 1536:vzxwWGntxujL4k55TpMMAO+cTcoFykhUHTlTMsqu60Oond:uH04k5h6m/Fy0UhMsqu5Oond
TLSH
T117636B5A32B492A9CDBED025CB06C50BE7F2780946F5DB4F06B94FA66F13B71192E301
MD5 SHA1 SHA512 SSDEEP TLSH

Nbc

SHA256 1235a47907b0f0f7aa98158bbe039a3e6315a1c60da6ecaacb906863c43c7f67
MD5 8b45ee4c935d1e9c3222e0b662b1a89a
SHA1 b49489782d31ab1cb5b118072d53d51366e4426d
SHA512 cddf92571e7daf55d9bb9d154a9a2d0e3b5b2f0484e564c81e9a40ce5d9551910c86d67e95c2ef499e0582703089a3dcd1b7519392feb6a2afa1135b6045535b
SSDEEP 1536:HY6aFNrKNjeiatvMp6EDRYJ7kIz8DkgIhPkN9KnmT1cg3ZDctGbKBXka:HkFNrsjeinlsgIhs3kmTmwZDgGbDa
TLSH
T15B732AA931A483DCE9FEF562C613C40BE3E1B8418BFD9A1F13BA96421F13762652D711
MD5 SHA1 SHA512 SSDEEP TLSH

Notebooks

SHA256 1b0688f3e698166e9df89be3955cc589e24dcbffe6552c88197d41f94033fd25
MD5 1354efe03c4da8f198eda9bf6832aed8
SHA1 47a8867e60405120c7aa2937c35e2c15b011da10
SHA512 19ab4536709577ce04342e1fe6072d2fc6061dbb22220a409764c03b56fa908c128d37c71dd7a622db2212ff7b422f3c657a3a5513986e3bd93b8af11385189e
SSDEEP 1536:VB6j6rs84dvTcAXjKd1bS1wwQOchO+534IY1GsTrkerRIb:Vw6uId1bvhOYSQurhrRIb
TLSH
T1D5732B9673E9184AD2332BBC5EA2CBD14616B9001B319D1F1A45B60F6F6A1C7CF29F31
MD5 SHA1 SHA512 SSDEEP TLSH

Older

SHA256 2cf3c8f88b67e6ed91b369576e9200b72833fff01a412b79783b7591339a8186
MD5 9473138e9d174781f7be7fee26964149
SHA1 ed9f1e84a4f07895de4b5f4ea85e240bb2e2f49b
SHA512 49fcdcc9814fd7d4794d9179eb4707ede7f0be575048357d50889c10a6602bf454d0b47a315d1012d24c87e4e18276c125bf5f90cb30f4193b16694559ba1113
TLSH
T1F92197DB47C9DCF9E86C01B4C5624299303973B8E35B8E823FB9116AAD3F414EBA8505
MD5 SHA1 SHA512 TLSH

Only

SHA256 7d169f391657ea01d783631b6d4e4620c9a887549c7179cd5cdf4eae1dcaef73
MD5 422e1c971a12ba15ab00fea1e4baa404
SHA1 2c89fde5d28aafbaa716ea71ddcd0c4c85d0cb24
SHA512 dc024bb9dbd28a30e4320aec86f81a5a6284ce8d833907215af23ca36d617e9cbcb93594d4c1546f66f68653f2d2b6ff3bde7bb8fbb46eee041db8f9b9fc9856
SSDEEP 3072:gKenii0yD1LoanUveooL4x7KBgtEnsjAZNL1iBZ4trwnNX51l:g1vRBHPoonCJv
TLSH
T1C7E36B59A56460AFD16BC071CA5D8E0BE6B6758A3B207F6F03E10F521F23E80529F35B
MD5 SHA1 SHA512 SSDEEP TLSH

Phrase

SHA256 3e527cf47111ee2b18f0b4834b353bb69b1d9fde073d2e3bc64954d62e435cde
MD5 21e99c89719d0865a06b2884dcaafe36
SHA1 d3d375c42aaaa5aafcbc14773bfb8f932f4390cb
SHA512 2e59cf675ce751be7505b8d22eb10365270eb1996ef24a014c48423081b5a86a975e6591af7ed122ee7a733e8b1ab522625e43915b1cb4db8fa634b2d0cab72b
SSDEEP 384:2wftIQXoSpu88888888888888888888888888888zv888888NfU84444Qnooooo3:2ex/Smz
TLSH
T14853DF051335C62B7FCBF57B5343D65A4BF96BAD9183512E2024BAB1B8303B5137E8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Still

SHA256 d58cc4cac36d5409cb54d467eb113f55dc1617a22928b7ce1ae659c92c136e69
MD5 ebe115177da300760554e2f49aac7259
SHA1 ec955661b64ea66ea36ade6d6463176e0da0b3a8
SHA512 a62abf011c8fd3e6fca8ee0cb4277c367a8187dff42feaea7d5d4fadebba57fb9a9472357e78b8c1c8929f052e6dfd0baf101e17f97eb1720c33fb585e5f672f
SSDEEP 3072:FzxsPR1yciPWprowM3Qm23DjOH4IoVcfIHaAtr3:RiPDviPWprowbzxIoyIHdd3
TLSH
T131E3490DB2E555D8CCA1A5F08E95C5C2D2B2B8471E62893F8DA47B2BBEB3E315D15330
MD5 SHA1 SHA512 SSDEEP TLSH

Working

SHA256 53c23825a40b0bc9aa4590dee2a944cb7eba55738fdb7cfee46bc17757517ff3
MD5 19db9aaf78325ce972c977ee65e2368f
SHA1 4d6b9e5885a8b6b2a5abf52a248fd06675eea38f
SHA512 6a206808d32dbd0f65f836932f80c0cd7925ee544df836ea015ada62786ba0b712335af31810a2e74fa79d65c6e700debfafb356a43a5387784a5037d62da1b8
SSDEEP 1536:KcgbrnoZwknr63EYrDWyu0uZo2+9B4u0SQ:Kc2oZxr6DWy4ZNo4TSQ
TLSH
T116C3A1439A991A47D173BA3074AFC73F0A247C4F5B74BDBA071D3F0EA9216409A65372
MD5 SHA1 SHA512 SSDEEP TLSH

Zones

SHA256 4780cbeec382a21c495d8c94699d54b3500ab140dd3d47580665d24211afc929
MD5 5b368bb46e0bce1a1fdb60ed9d1a1fbd
SHA1 6a60245a0caba5f045b951c0723c0bb43ea43cdd
SHA512 464c459e4abbddda3bd30e41d93860d6766ea8aef0c162d00671f44b441184da1c2fa946011af7c1c761fe803ce3bac343dc95e2ec1255173152f7777d7c3559
SSDEEP 3072:eRMsKz50/0DIPEXbeTjDiNyWEfGxciSvbDb4wo36sVtTL:eRS505EXoiNy8xciSzn4w66snH
TLSH
T16AE38D07B2B941E9D62FE020A507E10BEAB1FC0A153CCA4BE1909D63EF93B711A5F745
MD5 SHA1 SHA512 SSDEEP TLSH

RootsTeen/Olympus.dot

SHA256 4f02b62d331023da7410b30e4af517090dac92ef20349c00316c57eb761bb808
MD5 d3c5ff64444c59080b03f564068b46ca
SHA1 3eeaf5e82de9917cb248bb1a874e864f0917e9fa
SHA512 5325883cbd0eb21d81da2ae911a5a17f2885675dd7a9891316f11ad3cb540ed542043f7799d571d7f01eb522090e17e8db88a669a2af18536778420365536603
TLSH
T1B1211AB9003136F03C766642B488BA7CC203CD1F31258C4647664CF1193DCC98F8A22E
MD5 SHA1 SHA512 TLSH

RootsTeen/Photography.dot

SHA256 0fdc39fb521c2b85d5542030d6600561dfe92eebdaa72d9c71d57f088b5279aa
MD5 a9be171886ffa9cc011eb12ba161de07
SHA1 58398204e32be74564950a3aef000b4b4a09640a
SHA512 97f4eacaf99cf5ee93cdd34cbf8814a2bc46c48b39bcbd4a2d13afb607a4f08448e1217a2077f76c706838cf06cb8b7852626f4e689f282c4d0e6ac4fbe2916e
SSDEEP 6144:21AMi+UidGaoJWlQb8cxN7gSZR9G4/+bpYUSqPS2uH9FKiS2rptL4Csn:21TiZwObXxNMSZi44WqZU9trIx
TLSH
T1DB4423846B971909B534BE758FF4512B915EFE495A6AD23B2C04F342A68D00BC48F3ED
MD5 SHA1 SHA512 SSDEEP TLSH

RootsTeen/Regular.dot

SHA256 fae5b15cf74bee7b70dd2428a3a23268a2e51db7a75a00c5bdcb564b8f6de527
MD5 9153dc8e2fecb24c0238500834893e5e
SHA1 ee6e68f9dbcb94986b89b1922e07aa9aebc8df3b
SHA512 b0a6b2083c6e4e4bebf30b7d4430c9eda3afedab8c232165b075a9a64ab05f26b310fed76d60dc2441b392d4027aba8d5d23ebcfbb3b04978f81769882402430
SSDEEP 384:6Gw01wGFUEIv0L8RUBpMImFJngGblFAC46x+JhswNTJiDDQgLXHB+kMPBjGOnfG5:ltldAR9FJnv6C4eAhswBsDDQgL3BQPBM
TLSH
T15FB24CF176961C17FF93BBB1A6E08B0AB531D3653A354058ED9F029C865CC251738B2B
MD5 SHA1 SHA512 SSDEEP TLSH

RootsTeen/Workshop.dot

SHA256 09318b4ec3ffadf032a6973deee6f7959f5093c9f3a1848343492e1f850372ad
MD5 c17dbe9aeee9735f5a0a25011928a605
SHA1 c02264c6f4bd8958e1aae24ea20130ff01a14f0c
SHA512 a0eb2e602d8d1718bcd21d2b8e6c8d8abf1f88aba67ca258f6e1fdab6afd1f29b46e06cc625d932b496691a74f48deea89ed526b5b00e188a1222d04f5dd3231
SSDEEP 1536:93YiGB7BvXA7df/iY/ji6wBslagtSCIryNtD8JhK3z+K2xmIqynKXzSlr1PF:d8adf/iUjbla1C2cD8Js+hmIqA6gr1PF
TLSH
T17BB312E0783B5CA6D1382BE67C735B80687F95B424E1736355D4B90CA316AA839FDCB0
MD5 SHA1 SHA512 SSDEEP TLSH

jaffacakes118_27080a6dcd1a35e0f79eecf54d25cec8cecf3b232a4b0f2e24567c4f0009102c.bin

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

RootsTeen/Honduras.dot

RootsTeen/Mandatory.dot

Asked

Dim

Hebrew

Len

Nbc

Notebooks

Older

Only

Phrase

Still

Working

Zones

RootsTeen/Olympus.dot

RootsTeen/Photography.dot

RootsTeen/Regular.dot

RootsTeen/Workshop.dot

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_27080a6dcd1a35e0f79eecf54d25cec8cecf3b232a4b0f2e24567c4f0009102c.bin

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

RootsTeen/Honduras.dot

RootsTeen/Mandatory.dot

Asked

Dim

Hebrew

Len

Nbc

Notebooks

Older

Only

Phrase

Still

Working

Zones

RootsTeen/Olympus.dot

RootsTeen/Photography.dot

RootsTeen/Regular.dot

RootsTeen/Workshop.dot