jaffacakes118__8e9e9978e568745ba9d2a9a9bd3b2915
- SHA256 8adb76df73923c679f0d8138d7459b6c8189348ed517dd7f8262fd84eedb4139
Behavioral task
behavioral1
Sample
19e.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
19e.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
19e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
19e.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
_help.url
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
_help.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target jaffacakes118__8e9e9978e568745ba9d2a9a9bd3b2915
- Size 50KB
- Sample260919-m5bstaed89
- SHA256 8adb76df73923c679f0d8138d7459b6c8189348ed517dd7f8262fd84eedb4139
- MD5 8e9e9978e568745ba9d2a9a9bd3b2915
- SHA1 6171624a1c60a42d886968bf21659b0ef0527c93
- SHA512 045e2a91402e6843af6bfff54ffaa7ff303a4dbc7bffb2eda0cd986efa44f0d81ce03401ff43058d3e766c2fdd1173329f3d6817eb8701cfff61d2dda476377d
- SSDEEP 1536:yN+geZ9szrS7Ue4m/cOPY3HMyYd4849WBfF9j:SALurS7Uep/RQ3HMDyB9Wt
- TLSH T1273301E2D110B7B9E7414366ABFD912272B2C80CE2D057B190A769728CC5BC0D3EF61E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/19e.dll upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/19e.dll unpack001/19e.exe
File Explorer
-
jaffacakes118__8e9e9978e568745ba9d2a9a9bd3b2915.zip 50KB
-
19e.cfg2KB
-
19e.dll.dll 29KB
-
19e.exe.exe 53KB
-
19e.ini69B
-
_help.url81B
-
_read.txt219B
19e.cfg
- SHA256 db7a3f2531dafdc33110d2264b4e63223e0017c8b27dcc0757e57419dc28682b
- MD5 e1917c81e2d3554774a6b2f42c5ed7ac
- SHA1 50fd7d6a17a20db86b0576a6906b8f49a88fb234
- SHA512 e46f24aa0cb842a6ba51b8c849006faaf8b802e439ffe8c128256bd7a0bc9b8aaa125b859e21fa57fda5d7ceba4c186d2d0697fd804e43e5f1e93b195b773c73
- TLSH T13851B85337C9CDB2F1B3832E93503202F53F2DE5E6167288B6E7CA5C1EE5941682428E
- MD5 SHA1 SHA512 TLSH
19e.dll
- SHA256 a01c2fd73ef6af06396c4caeefff8f58cac80d8b6748f8201d867b023141eeb6
- MD5 57b47a1b7e740b650a3d5dc19d6ddcc0
- SHA1 a7bdd61a271ac66210189a9f7dc475e7b20803ea
- SHA512 fedefe2c397dd1bb1d51cf872473f40dbaf8570bb38f89d2107a5fd2c01b5f3d689f02fc9343f30bf7a54539f45f12fecc3c569ed4f84fe2a7969ea237ceb50c
- SSDEEP 768:g4jf0vJvT3pyML3ZylRFtQTih7xr2WOsJPMDCV2kMgUitN2C1:IBvjUs3IwiH2sJUeVwVC1
- TLSH T1CFD29E77A9AA0CD1F7424A3561A7D80C993CBE701D3252DF126AB875D230D0EDBC9B4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
105376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
UPX0
Size
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
19KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=385, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
19e.exe
- IMPHASH e9367ab1b2a21ff8e392e7ff8f87352b
- SHA256 18b267127fb5e05c24bd879c81a88ac0be9805113818861aec8f992190720cf3
- MD5 70a99d296600f17f4aab637f644d97d7
- SHA1 000019012d03e9961332d95b92ffe90b7efaea6b
- SHA512 2e4b563e23cd8558b44401b1d15731506079f448cfe578073412aae16c93c2347cd2c2d809e84d6ee852c15f3218c99f059a949ed2797ef46a8c5df12ddfd6dc
- SSDEEP 768:R8mzZ8Rvao9dByUkbqB1HihtPAWy6T6FL2GBErazW3O82nU5teP8GHpVQNo:qmV8pb9u1FyQKL2GBErazMj2nVEe0o
- TLSH T167338D07B8C5C077CAD2417118B28F3DB7BB59B245660E436B64EA792D3366BED36103
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20875
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
SetThreadContext
SuspendThread
Sleep
ResumeThread
OpenProcess
WriteProcessMemory
VirtualProtectEx
GetThreadContext
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
ExitProcess
ReadProcessMemory
GlobalAlloc
GetWindowsDirectoryA
GetTempPathA
CopyFileA
GetSystemDirectoryA
SetFileAttributesA
FindNextFileA
MoveFileA
TerminateProcess
CreateProcessA
SetCurrentDirectoryA
GetModuleFileNameA
LoadLibraryA
GlobalFree
GetModuleHandleA
DeleteFileA
FindFirstFileA
GetVersion
GetFileType
HeapDestroy
SetFilePointer
GetProcAddress
SetEndOfFile
RtlUnwind
GetStartupInfoA
GetCommandLineA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapFree
GetLastError
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetStringTypeW
HeapAlloc
HeapCreate
VirtualFree
WriteFile
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
GetStringTypeA
FlushFileBuffers
ReadFile
VirtualAlloc
HeapReAlloc
SetStdHandle
GetACP
CreateFileA
GetCPInfo
GetOEMCP
user32
MessageBoxA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
advapi32
RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=15, id=14, version=7299,
count=61, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=9, id=19, version=8034,
count=82, id=1, productName=Unmarked objects,
count=24, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
19e.ini
- SHA256 b4d8571187b110633ed5b2bde57f4d0e331f9772381d6ed03183b995988f88ff
- MD5 f4b149d43b986da28a21caf43938afbd
- SHA1 6a9aee8bf87351783535f4a15e3ae528ce1dc280
- SHA512 9c48a1768f4f82d4bd31680fe97d40b3d67f7b32a3bacf6fcaa4c6d727d3c8be83bda029285df86c2de9b34e4e875ca00884efedd70f4fe50c86c5736e9bc0d3
- TLSH T114A002988C49E045501E6159631CBF68484EDA1E690B3F1832D3A94D24A187F456E2C5
- MD5 SHA1 SHA512 TLSH
_help.url
- SHA256 cc039bfcfc465ae824fbccebf5cc6fac9a68160d9d71a788657e20615d2d98ec
- MD5 877175b27b31922873f9e5052fc241c2
- SHA1 1e87af5c8108999384cfb20324f848d974a59313
- SHA512 f8a990ff74a59b8ebfaa02be14ab702139159d9595867f38579d6e5d897e15d7ffa8a1889df02bb4eb75aca32e3cd1fea5ab6ddf9f9807f45792a2844acc7ca9
- TLSH T1C4A012CD4A0ED0C84023C80C307CCC144805709040C2C0C84281DD2938870801444748
- MD5 SHA1 SHA512 TLSH
_read.txt
- SHA256 5b0f1935ae260b565e713160dd8b073bc6e11af515bd959073f5c1f3eb0fc3b5
- MD5 4ab6be2fe9364dd90f73fc011e83d13a
- SHA1 cbc62a8f51c3efabf8cc56137e1b722901948bc2
- SHA512 937d7d5cf7b736715b0c33d1f27a0564be315089654e5009f9439e47cd780e6a8321e259e7977b732bfc6e3f16b796edd67f703115a7f367db2989779a0481bc
- TLSH T1C8D0A74C9B0790EC0572445D24BCEA86C09956E3DAC8159AF094DCEE31C30D48EF8A4F
- MD5 SHA1 SHA512 TLSH