Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/09/2026, 12:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_upload.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_upload.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target jaffacakes118_upload.exe
- Size 5.5MB
- Sample260912-pg2qfabe45
- SHA256 9b60635bf858d1f432e726a029c7386ec6d17b2cc2e77845dc647200c7802312
- MD5 2f2be28e5a8a105f9af9f9d6f10c9ad0
- SHA1 db3e3cb91973aba6244f8638129e70a6ee288ebf
- SHA512 e4b3843ea698c1fd9e7308768aa120873c0376336e909159704943c05b53ffc75c5e253b9dc612f76405670cda7ccbad3ebfef15e81d92d462d6bb86ffff99e8
- SSDEEP 49152:9GtlqIuVwASOnPq78IL22+hF0p1AcDs2M319WjTJBkYky5rNDEAcQQavYePr9Sm+:bPELr5KURDjktixo/jS3+LvwvC
- TLSH T173469DA9B67D00D9D86AC1BCC2865227E772B41543B197CF1A6496F60F63AE02F7F700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 29 discord.com 30 discord.com 31 discord.com 13 discord.com 14 discord.com - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 12 api.ipify.org