soulclose | jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4[.]bin

General

Target
jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.bin
Size 1.3MB
Sample260923-r18dfade62
SHA256 11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4
MD5 4ddb06e3956685e0f902e63c8b543bc5
SHA1 8195b09a3207686162c216347415f0bf384c2497
SHA512 cd6640c3bb9268fe7ff27a75ffcb2faaabc2b8906c6edbef158a4bdb47f928bc26b13b7aad688c46ac5db8cd16402f3782cddb7dfbc8831ed906e82176c2cb30
SSDEEP 24576:sGPiuMdwsNDS5lSsjCqnstLyUktHIiLy/+:xuusNDS5lSHqnstLet3Ly/+
TLSH
T176557011A6F60235E0A6F93069B0520D457A7B25CC63CE1EF644DEDDBBB9972B830237
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm soulclose

Family: Soulclose
Soulclose is a Windows worm written in VisualBasic.
worm soulclose

Detects Soulclose 1 IoCs

resource	yara_rule
sample	family_soulclose

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.bin

jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.bin

.exe 1.3MB

SHA256 11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4
MD5 4ddb06e3956685e0f902e63c8b543bc5
SHA1 8195b09a3207686162c216347415f0bf384c2497
SHA512 cd6640c3bb9268fe7ff27a75ffcb2faaabc2b8906c6edbef158a4bdb47f928bc26b13b7aad688c46ac5db8cd16402f3782cddb7dfbc8831ed906e82176c2cb30
SSDEEP 24576:sGPiuMdwsNDS5lSsjCqnstLyUktHIiLy/+:xuusNDS5lSHqnstLet3Ly/+
TLSH
T176557011A6F60235E0A6F93069B0520D457A7B25CC63CE1EF644DEDDBBB9972B830237
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

6352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths