jaffacakes118_4df8c16e03c7a359a37723ad47a4b4e508009aa0eab5977eb35a9f15d8073982.bin
- SHA256 4df8c16e03c7a359a37723ad47a4b4e508009aa0eab5977eb35a9f15d8073982
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
UnZoom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
UnZoom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Zoom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Zoom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target jaffacakes118_4df8c16e03c7a359a37723ad47a4b4e508009aa0eab5977eb35a9f15d8073982.bin
- Size 694KB
- Sample260925-vpgccssz9n
- SHA256 4df8c16e03c7a359a37723ad47a4b4e508009aa0eab5977eb35a9f15d8073982
- MD5 500a220837e42db8ba0ab3642d354d17
- SHA1 48f71a30dee3b46d0c240aa0e3b73819caa19160
- SHA512 46a9176771f9c6bc43bed9069ccaf746b0accd8ce989f5616199e03cb60a40ad4dfbe019bf1335d0cb6abb864edbb6147fd5250429b754a4c05c59d99c223498
- SSDEEP 12288:mMhuidwz49bqnadmxV/dpEqnnm3fwVpxExf9No+SiApZ7:mMBKMOXp7nm3f4S30HZ7
- TLSH T1A1E42369255C259CFE8F2D1280862A43687D0FB3FAA2CF3BA6D96765C13305F49FE051
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/UnZoom.exe unpack001/Zoom.exe
File Explorer
-
jaffacakes118_4df8c16e03c7a359a37723ad47a4b4e508009aa0eab5977eb35a9f15d8073982.bin.zip 694KB
-
File_id.diz1KB
-
Guide.hlp62KB
-
Readme.txt4KB
-
UnZoom.exe.exe 22KB
-
Zoom.exe.exe 674KB
File_id.diz
- SHA256 e573ba6079e3c7cf30f66374f399ac6e07370882ec2f6dc85166308682226230
- MD5 8a599c08f99bf29ba37a11472f9b9fb0
- SHA1 c9fbaaca188ee70f051e8bc4b35a405fa497dc4d
- SHA512 52da2ce209ffa3dfb392409517edc14d85aaf9c6444f2bea1b2762b76d2553b7765db7c4a38016262a662fd8bc5d60620d585edfb613de7a5baddc0aba3f40c2
- TLSH T18C314E5F6F11922B2273C761210F6F97E73A096270638A61706A00583FF4947422FDDE
- MD5 SHA1 SHA512 TLSH
Guide.hlp
- SHA256 a54069b704a8277ead6aa835ea69f7c4bb693a8c84527d3f80b784ece3aad439
- MD5 e6efade39a862eca3488a1e37b469d64
- SHA1 50d30a3001dcfead359888c5b34e8e032a6388f2
- SHA512 1b2c43a7ce4c876c01dee6811ae59b889c1641b4fc4d1d2d01d386e6594911e3d56014343c4e13379f9bec52bbbaf56d26734d94a09a1249d829e708d0d96bf1
- SSDEEP 768:5d9timEa8CmQaw9TaoSE4w5G2umRx79qkh5MOM:5/tzTTaoH5um7BqGM
- TLSH T15453FE17B7801AEBD036E376084FCBB95EA661985771020A349C903D3FE3BDEF55A498
- MD5 SHA1 SHA512 SSDEEP TLSH
Readme.txt
- SHA256 f4cdf9abce995e201955bbee0b8c0289e3788b2d2b929d84febecb89bb8015d5
- MD5 0fdcc04df5c3277b1bf5180d7ac54a19
- SHA1 d93ffb773179bb5af3298e3f2b65c56bc0b002cd
- SHA512 88b8f221364738c7855f0f4750b51fff623230ef04cc097811cfa9c5bf929708424452317e47f282679a4a8d49c34f9f8175da318a795aac2451b53c845d21f4
- SSDEEP 96:LCuvY0Ua5riIRUFVDNmt8dcQorKt+SGzvgG:d9UaZiVk8JuKtLGzYG
- TLSH T1A19142AF6E068F3226A1C215110EBFD7FB298615E112066674357338769CA8A863F9DC
- MD5 SHA1 SHA512 SSDEEP TLSH
UnZoom.exe
- IMPHASH 76fe6dc560c8ed5fc320aef6e698749a
- SHA256 64e7efe5498d4a5f4575fda1ea051fd48e0c0d99de3f6c0751fac874d38a6ae9
- MD5 e1bf3e83950caac204a0003e730ae628
- SHA1 41fb3e020fe552fe4ab46b9f1054e44bf3e524b0
- SHA512 ca549d368651c12a6ff40541e33b27b5fb9698a44625edd437b47bd36de5af252d70675c4e9e0f5c2b37de658dec3c9ad3dfb9e5c612b04dd6b39cf72b55b566
- SSDEEP 384:xrjApMM5KLJK0cDGFCwMlPwd4a/s7KoDL9+A8ZJoZVKMP8PAMcND9yHkKLJGApMz:J8pMMwLJKWC7lPwd4Us7KoDLQA8ZJoZ9
- TLSH T128A2521FB284E41AF9B580B91C2692BB0975BC705C56AB27BF80EF4F29376E1D010727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4708
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm50
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord595
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
ord525
__vbaChkstk
EVENT_SINK_AddRef
ord529
__vbaVarTstEq
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
ord608
__vbaFPException
__vbaVarCat
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaStrToAnsi
__vbaVarCopy
ord616
ord617
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Zoom.exe
- SHA256 574982211af39c034571405bf78f1dd67ce6c4ede0c4e9a205571091b79ac9ef
- MD5 9814c9ece9b0ac156f420ae2ea30ea5f
- SHA1 43d9addabe9b368c0f91ba3c28039a6cebb74777
- SHA512 2e38540f06ef8ba51ec208b313da38f4ac82f7038dfeb3d2af1e3c8efaab6947b94983591a7a9026d4289674b9f1f9a8425cd9f84422655d3616241ddfbfd217
- SSDEEP 12288:+FHHNIQzVtGVM2EsJ9S8Bs18mKJZP4JrkdpeVBssK7sxi4qpdsTCbLq+/snZMGT:+FnNZB8S2Ecw71fKJZQJCpeVBwa8mEDC
- TLSH T1A2E42397CA94E1CFC092603996C7A36908FCAD3DEA7A1BD5D3F26F51AE770A21D01131
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3469579
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
654KB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE