General
-
Target
0d7df2c6da6eb477449e7af2dc0ced59_JaffaCakes118
-
Size
553KB
-
Sample
240625-k47gzs1akf
-
MD5
0d7df2c6da6eb477449e7af2dc0ced59
-
SHA1
7487ac20a3509fb382992263fbd0ab174a443264
-
SHA256
03a38eeb5667a804d66732f0939c0ee4e4d7679cf64b1cd38675fdae051580f0
-
SHA512
972e6e68598576530c651cc6f44a03205bc01928bf81971ad1d369a14e13ae342a57450eea8c006e35e1e82eee97e48ad97a955609be634bbadc6ed9d0b263ea
-
SSDEEP
6144:ArZDMAYloj1/L8YEAQwgG5hs+dRany7KJBT62XpXSPUxRIgtOw3p+ummN:6DMAzjN4YEAFKsayOJ1JiYc6M
Static task
static1
Behavioral task
behavioral1
Sample
0d7df2c6da6eb477449e7af2dc0ced59_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0d7df2c6da6eb477449e7af2dc0ced59_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
0d7df2c6da6eb477449e7af2dc0ced59_JaffaCakes118
-
Size
553KB
-
MD5
0d7df2c6da6eb477449e7af2dc0ced59
-
SHA1
7487ac20a3509fb382992263fbd0ab174a443264
-
SHA256
03a38eeb5667a804d66732f0939c0ee4e4d7679cf64b1cd38675fdae051580f0
-
SHA512
972e6e68598576530c651cc6f44a03205bc01928bf81971ad1d369a14e13ae342a57450eea8c006e35e1e82eee97e48ad97a955609be634bbadc6ed9d0b263ea
-
SSDEEP
6144:ArZDMAYloj1/L8YEAQwgG5hs+dRany7KJBT62XpXSPUxRIgtOw3p+ummN:6DMAzjN4YEAFKsayOJ1JiYc6M
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-