jaffacakes118_7c457731e4460a956cc3beb9ce72a32b92afff7e1e9bc033ceaaace0fb0673ac.bin
- SHA256 7c457731e4460a956cc3beb9ce72a32b92afff7e1e9bc033ceaaace0fb0673ac
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
remote.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
remote.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
tongy.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
tongy.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
tongy.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
tongy.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_7c457731e4460a956cc3beb9ce72a32b92afff7e1e9bc033ceaaace0fb0673ac.bin
- Size 471KB
- Sample260912-l74e6seq6v
- SHA256 7c457731e4460a956cc3beb9ce72a32b92afff7e1e9bc033ceaaace0fb0673ac
- MD5 ddf2aae5814dfda2c6b5eff031670ee5
- SHA1 8e15964eaa54776146949325934cd75ee3d3022d
- SHA512 a964f8ac8161fe932f926c6fca2eb773db0a3e92bc1a067f5519b9705fca9b6cc99fd45d32a87d5f101c7966de7453826c1191ec4397df9b263026028b4cedb1
- SSDEEP 6144:mqBV32xAfIN/8KSt+1Z+qrVUz71j+anqYOpCzmIHjFQ4Ga2aSmdVZlOzmwzJeHij:12xQEgqrVIwYOYiIDwarSqVQomJ
- TLSH T1ACA4232AF7266AD0893054620AAC2D1E99737C78907776FF651ED0C1B4EBABA014F317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/remote.exe unpack001/tongy.exe
File Explorer
-
jaffacakes118_7c457731e4460a956cc3beb9ce72a32b92afff7e1e9bc033ceaaace0fb0673ac.bin.zip 471KB
-
remote.exe.exe 226KB
-
tongy.bat.bat 1KB
-
tongy.exe.exe 780KB
remote.exe
- IMPHASH c23e0f5571e5e94de6253fc13da502cb
- SHA256 b5cdd118a8777e574ad8af03431c2b46a0c86c22d83a9b99983ffe127e22c740
- MD5 c480cd656cf6df15aa63c5627e9b26a7
- SHA1 37546006d384eef7398f1a7cf10346911549ced7
- SHA512 84c720a117e81fcd30297798a04d173f75dc8541df8a54c7734394a0cd796c16c6e5856c217e82b67043cd8de56fafa51b8d5c8f1861191bee8e201725dc713d
- SSDEEP 6144:niWPBmYwQJY0Tj8YOuf5H+qWIFC9HuO3CU5q0:iWPBmXQd6wFACUN
- TLSH T177345C59339408F8E4679239C9924645E772BC6A0731EBCF03A4436ADF336D0AD3E762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
32512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\Projects\Win32\Application\bin\Release_x64\RunRemoteExe_x64.pdb
kernel32
K32GetModuleFileNameExA
ReadFile
GetProcAddress
GetModuleHandleA
OutputDebugStringA
CloseHandle
GetCurrentProcessId
SetUnhandledExceptionFilter
GetCurrentProcess
OpenProcess
GetCurrentThreadId
DeleteFileA
FreeLibrary
LoadLibraryA
GetModuleFileNameA
SetEndOfFile
ReadConsoleW
SetFilePointer
GetFileSize
CreateDirectoryA
CreateFileA
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
TerminateThread
CreateRemoteThread
GetLastError
HeapFree
HeapAlloc
EncodePointer
DecodePointer
AreFileApisANSI
MultiByteToWideChar
GetCommandLineA
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
HeapSize
Sleep
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MoveFileExW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
HeapReAlloc
WriteConsoleW
SetStdHandle
FlushFileBuffers
CreateFileW
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
shlwapi
PathFileExistsA
PathRemoveFileSpecA
PathAppendA
PathFindFileNameA
dbghelp
MiniDumpWriteDump
advapi32
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
wininet
HttpOpenRequestW
HttpQueryInfoW
InternetCrackUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFileExA
InternetSetOptionExW
InternetSetStatusCallbackW
HttpSendRequestW
Name
.text
Size
139KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=207, version=61219,
count=11, id=205, version=50929,
count=69, id=207, version=50929,
count=208, id=206, version=50929,
count=2, id=188, version=30716,
count=1, id=190, version=30716,
count=168, id=1, productName=Unmarked objects,
count=17, id=185, version=30716,
count=1, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=5, id=211, version=61219,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
tongy.bat
- SHA256 2e964893b14fec1f63c2fc1dc5e65f0a00070cb501524e9190169b43da173796
- MD5 071fd9aada7631d79ee0e8625ea11f98
- SHA1 61da1e724dc79ae286cd201516d71dd776cac044
- SHA512 fccbe78c000cf1126842728fc12ca32e78fb5bbbc155432a899b62b4382106b1ca56a41c480662681f2ee1f6e8b2464e700c5451c8182520f23803bfaf26b5ca
- TLSH T111319F002CD1AB9674AA19C3DFA5D18A33F1D4A07022E2987295C0D3B0D5DE64FEB5AE
- MD5 SHA1 SHA512 TLSH
tongy.exe
- IMPHASH 91780199ecea8614db1a850c464a5ca3
- SHA256 4d99c98bf7780ecb977885823821980aa91e21d62b39d956d82ac35013d1120d
- MD5 f450586da21319024136656269dacf3a
- SHA1 18bc0372d22c9aa30c7c38121c8ef1bcaaa15c79
- SHA512 d8d678126ae5dcd3290dc70c2aff8a8742471784677ce1344c7842cb68bebe12fd29ccf3fd16d4902af403721e039a6b5d321109221164ba953036d38239273b
- SSDEEP 12288:C2JlJR7L/mrnGA92C5HzrVMkVo/Oy6RguUE:C2xZbmrGAH5TrVMuoGy6RgbE
- TLSH T19105BFA1F6D180F1C214153128A6B73EABB69A4E4E16CEC3D345ED5E6D32481B63723F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
422437
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
DuplicateHandle
lstrcpynA
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
InterlockedDecrement
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
TerminateProcess
GetLocalTime
GetSystemTime
GetTimeZoneInformation
WriteFile
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
ReadFile
lstrlenW
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetUserDefaultLCID
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
GetFileAttributesA
RaiseException
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
InterlockedIncrement
user32
OpenClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
GetCursorPos
MessageBoxA
SetWindowPos
SendMessageA
DestroyCursor
SetParent
GetClipboardData
PostMessageA
GetTopWindow
GetParent
CloseClipboard
wsprintfA
GetFocus
GetClientRect
InvalidateRect
ValidateRect
UpdateWindow
EqualRect
GetWindowRect
SetForegroundWindow
IsWindow
RegisterClassA
DestroyMenu
IsChild
ReleaseDC
IsRectEmpty
FillRect
GetDC
SetCursor
LoadCursorA
SetCursorPos
SetActiveWindow
GetSysColor
SetWindowLongA
GetWindowLongA
RedrawWindow
EnableWindow
IsWindowVisible
OffsetRect
PtInRect
DestroyIcon
IntersectRect
InflateRect
SetRect
SetScrollPos
SetScrollRange
GetScrollRange
SetCapture
LoadIconA
TranslateMessage
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
CreatePopupMenu
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
EnumDisplaySettingsA
LoadImageA
SystemParametersInfoA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetMenu
SetMenu
PeekMessageA
GetWindowTextA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
UnregisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
GetClassNameA
GetDesktopWindow
LoadStringA
GetSysColorBrush
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
gdi32
GetClipRgn
CreatePolygonRgn
SelectClipRgn
DeleteObject
CreateDIBitmap
GetSystemPaletteEntries
CreatePalette
StretchBlt
SelectPalette
RealizePalette
GetDIBits
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
CreateRoundRectRgn
GetTextColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBitmap
SelectObject
CreatePen
PatBlt
CombineRgn
SetStretchBltMode
FillRgn
CreateSolidBrush
CreateFontIndirectA
GetStockObject
GetObjectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
ExcludeClipRect
MoveToEx
LineTo
CreateRectRgnIndirect
SetBkColor
CreateRectRgn
GetTextMetricsA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
winmm
midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegCreateKeyExA
shell32
ShellExecuteA
Shell_NotifyIconA
ole32
CLSIDFromProgID
OleInitialize
OleUninitialize
CLSIDFromString
CoCreateInstance
OleRun
oleaut32
VariantCopyInd
VariantInit
SysAllocString
SafeArrayDestroy
SafeArrayCreate
SafeArrayPutElement
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
UnRegisterTypeLi
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantChangeType
VariantClear
SafeArrayGetElement
comctl32
ImageList_Destroy
ord17
ws2_32
ioctlsocket
recv
getpeername
accept
recvfrom
WSAAsyncSelect
closesocket
inet_ntoa
WSACleanup
comdlg32
ChooseColorA
GetSaveFileNameA
GetOpenFileNameA
GetFileTitleA
Name
.text
Size
532KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
108KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
72KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=43, id=14, version=7299,
count=187, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=87, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=592, id=1, productName=Unmarked objects,
count=75, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=25, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=31, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,