jaffacakes118_c42b0d200c2022fba3332dd1078cf1412ba37eb52bd74acf7edb4672b1d0f330.zip
- SHA256 49b733f928098fb41e7f029c863d8d217f59bf180a6b5f50c22fa3c357f8d259
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c42b0d200c2022fba3332dd1078cf1412ba37eb52bd74acf7edb4672b1d0f330.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target jaffacakes118_c42b0d200c2022fba3332dd1078cf1412ba37eb52bd74acf7edb4672b1d0f330.zip
- Size 327KB
- Sample260930-mkhqmaxvev
- SHA256 49b733f928098fb41e7f029c863d8d217f59bf180a6b5f50c22fa3c357f8d259
- MD5 653abb578666b41da2db25732ac5f03f
- SHA1 b5717021c24db88e0fcb4dd91829c8f5f5a68fff
- SHA512 56da51bc75aff83c0272375452bcbde884fc595433844dfd26cae22078f8f76f27b361eadc87a58fa95b246fb22f014d3250a5b23af8c6d34bddb43e411b21db
- SSDEEP 6144:WQdldp/JwhBzaCEQ/1nyYUOes7b4VuoS9DRCd4t32ACux3q4tKaGtJ2vssW+:HD/JOBWCVxUOes7EVufA4Z2631Gbu
- TLSH T11F6423CCC9547C655143ACAA64D5DEBA395DFA12407E7CDE1CCC0723F5A1A21F3E428A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/c42b0d200c2022fba3332dd1078cf1412ba37eb52bd74acf7edb4672b1d0f330.exe
File Explorer
-
jaffacakes118_c42b0d200c2022fba3332dd1078cf1412ba37eb52bd74acf7edb4672b1d0f330.zip.zip 327KB
-
c42b0d200c2022fba3332dd1078cf1412ba37eb52bd74acf7edb4672b1d0f330.exe.exe 588KB
c42b0d200c2022fba3332dd1078cf1412ba37eb52bd74acf7edb4672b1d0f330.exe
- IMPHASH 998ddab33ef31a656472652329849589
- SHA256 c42b0d200c2022fba3332dd1078cf1412ba37eb52bd74acf7edb4672b1d0f330
- MD5 f27e401f211c1ec6b903b55223a36bf4
- SHA1 d6c7e39edb6cdbb393c84d31008ff9f131462903
- SHA512 5bd3c33dd7bed7df79821710011b14401d39d09739f5fdc96b7404f0d484b83c39f05ffbb433402263689ad7b77bfcfb4d75f1d63c71a141aa031ab8a64e8e41
- SSDEEP 12288:GcRgVbIT/aB78Y9aJkDmzvFLg46Lmor16:XRgV0nSSdL4LrrE
- TLSH T1B4D4AD67AC786011FE85C2B05CE10C9CD4AF94E77191912A12CC719F39ABBEEC58F9D8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
3c:27:db:e0:55:e1:44:78:af:af:42:cf:41:e1:27:fa:2a:de:7c:e5:5f:af:04:1a:38:44:75:07:b3:56:1c:5d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Gary Kramlich,O=Gary Kramlich,POSTALCODE=53210,STREET=2653 N 54TH ST,L=MILWAUKEE,ST=Wisconsin,C=US
Chains
Jan 1, 2023
CN=Gary Kramlich,O=Gary Kramlich,POSTALCODE=53210,STREET=2653 N 54TH ST,L=MILWAUKEE,ST=Wisconsin,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Gary Kramlich,O=Gary Kramlich,POSTALCODE=53210,STREET=2653 N 54TH ST,L=MILWAUKEE,ST=Wisconsin,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
0e:11:40:f5:5f:a8:0c:58:28:59:60:d0:46:82:fd:0b:14:ee:b8:ba
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Gary Kramlich,O=Gary Kramlich,POSTALCODE=53210,STREET=2653 N 54TH ST,L=MILWAUKEE,ST=Wisconsin,C=US
Chains
Jan 1, 2023
CN=Gary Kramlich,O=Gary Kramlich,POSTALCODE=53210,STREET=2653 N 54TH ST,L=MILWAUKEE,ST=Wisconsin,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Gary Kramlich,O=Gary Kramlich,POSTALCODE=53210,STREET=2653 N 54TH ST,L=MILWAUKEE,ST=Wisconsin,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Gary Kramlich,O=Gary Kramlich,POSTALCODE=53210,STREET=2653 N 54TH ST,L=MILWAUKEE,ST=Wisconsin,C=US
Serial Number
f6:ad:45:18:8e:55:66:aa:31:7b:e2:3b:4b:8b:2c:2f
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2024
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
5
Entry point
18809
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LoadLibraryA
VirtualAlloc
LockResource
LoadResource
SizeofResource
VirtualProtect
GetModuleHandleW
GetLastError
CreateMutexA
GetModuleHandleA
FreeConsole
lstrlenW
CreateThread
Sleep
CreateHardLinkA
WaitForSingleObject
FindResourceW
SetConsoleCtrlHandler
GetCommandLineA
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
gdi32
SetTextColor
CreateFontIndirectA
SelectObject
SetBkMode
advapi32
RegDeleteKeyA
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
501KB
Virtual Size
501KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=28, id=132, productName=VS2008 build 21022, version=21022,
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=86, id=131, productName=VS2008 build 21022, version=21022,
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=90, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,