jaffacakes118_11972973981.zip
- SHA256 ee99bf443495ed66eb89842a2fd0a1602557ea543be035f127a54901a1c6bb7f
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1743f4a392b6d2ad0d47a7a57e277e1a29ecf459275b604919a6131739afdaad.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1743f4a392b6d2ad0d47a7a57e277e1a29ecf459275b604919a6131739afdaad.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target jaffacakes118_11972973981.zip
- Size 16.2MB
- Sample260922-n26pfsdf49
- SHA256 ee99bf443495ed66eb89842a2fd0a1602557ea543be035f127a54901a1c6bb7f
- MD5 709edfaa300fae35015626ae69887ca1
- SHA1 f82b4d37a8b9622cf2ea13be14a8e86f7dc0810f
- SHA512 8b49c2f22aa37cee8a1427879053e2ce6a10fef66a305d4be7b3f56cb23c7b9d92d8fb686a9f3bbbe8b7c90864b66cf8fa01fcf77dcb2e1d3f89d65ce694343f
- SSDEEP 393216:2t//wGmfVNPhv1X3T1xjoNuYW4LXgH3h/+7AhzD:25YvfLTX3JZiuY9LQHxHB
- TLSH T11C0733AE5078C6AB29CB2D3145D40DEA1C5F0033A6DEFAAD39990357F7EA9B4C15308D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/1743f4a392b6d2ad0d47a7a57e277e1a29ecf459275b604919a6131739afdaad
File Explorer
-
jaffacakes118_11972973981.zip.zip 16.2MB
-
1743f4a392b6d2ad0d47a7a57e277e1a29ecf459275b604919a6131739afdaad.exe 20.5MB
1743f4a392b6d2ad0d47a7a57e277e1a29ecf459275b604919a6131739afdaad
- IMPHASH de79444535980bb1ec949331a1b89433
- SHA256 1743f4a392b6d2ad0d47a7a57e277e1a29ecf459275b604919a6131739afdaad
- MD5 5225371f32a1ba8a5daa8f14ce64e8bf
- SHA1 8f9221f0fd7c5cfe50f12337b5ce35f4c07c6e3e
- SHA512 a5e1af8d9e26202ea874661476692f400b07595f06992b82dcff950fcfaf31e052c2b85460ec20f761a10618ca4b9591ec97bd5a1642d3c2f7657468f79f8f17
- SSDEEP 196608:7sb6uVDaIoYu4c6XsL5hePNABvAw819mJxaMR/wiArvjtbJYvwRYrs0VXuoWk5CM:Qb6ukx4dAvdRJxsRtOeYLmcDF
- TLSH T1DE2712C7E59541F8C0C3857062466396B5B0B85E82BCAE3F3EC52C023E25EA7964DF76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
c8:92:22:dd:cf:7f:56:57:67:b6:f7:9a:c1:f5:e6:46:4e:eb:d1:c7:94:4e:29:2e:65:3b:8f:ac:1c:c3:9a:26
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=200204019,CN=VS Revo Group Ltd.,O=VS Revo Group Ltd.,L=Ruse,C=BG,1.3.6.1.4.1.311.60.2.1.3=#13024247,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 1, 0001
PE Signature issue
Digest
e6:90:63:c4:7a:75:ec:48:3a:46:18:53:e0:af:41:36:a5:06:36:1b
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=200204019,CN=VS Revo Group Ltd.,O=VS Revo Group Ltd.,L=Ruse,C=BG,1.3.6.1.4.1.311.60.2.1.3=#13024247,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 1, 0001
Subject
CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Issuer
CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
May 15, 2026
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=200204019,CN=VS Revo Group Ltd.,O=VS Revo Group Ltd.,L=Ruse,C=BG,1.3.6.1.4.1.311.60.2.1.3=#13024247,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
07:ed:13:4b:1e:cf:56:1a:9e:b5:b0:53:88:bf:f0:47
Issuer
CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 27, 2021 - Aug 6, 2024
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 29, 2022 - Mar 14, 2033
Minor OS version
0
Major OS version
6
Entry point
14334658
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
MessageBoxW
pdh
PdhGetFormattedCounterValue
kernel32
SetThreadContext
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
iphlpapi
GetIfEntry2
netapi32
NetApiBufferFree
secur32
AcceptSecurityContext
advapi32
RegSetValueExW
bcrypt
BCryptGenRandom
shell32
CommandLineToArgvW
ole32
CoSetProxyBlanket
ws2_32
shutdown
ntdll
NtQuerySystemInformation
crypt32
CertOpenStore
powrprof
CallNtPowerInformation
oleaut32
GetErrorInfo
psapi
GetModuleFileNameExW
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
499KB
Virtual Size
499KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata0
Size
9.6MB
Virtual Size
9.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata1
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata2
Size
9.2MB
Virtual Size
9.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ