Overview

overview

8

Static

static

7

1b212040f0...18.dll

windows7-x64

8

1b212040f0...18.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1b212040f074d2cb1427f81f59075ce1_JaffaCakes118

  • Size

    5.4MB

  • Sample

    240701-nmzycsygqf

  • MD5

    1b212040f074d2cb1427f81f59075ce1

  • SHA1

    f1b796868e6c02dd5fc4f31572abd67c1afb9c76

  • SHA256

    909a3dfca4c1a9f392a27d76d9e84c71b04994f271aef608344d0211823b60d7

  • SHA512

    0faa3782c2af58cd381cc1e7ff281dba6cffb58e36f75197d41fc442d30ad77c7605f3ea8d92d20bda0249ed63756798ea009ef331e00ad7f5d84f9087b49619

  • SSDEEP

    98304:DXEs8Ca0XPke8RcX+dWHW5+r+JuHac1DL5dBMScy8MZLTzgX:gExsqlZu3sddFcy82zgX

Score
8/10
vmprotect

Malware Config

Targets

    • Target

      1b212040f074d2cb1427f81f59075ce1_JaffaCakes118

    • Size

      5.4MB

    • MD5

      1b212040f074d2cb1427f81f59075ce1

    • SHA1

      f1b796868e6c02dd5fc4f31572abd67c1afb9c76

    • SHA256

      909a3dfca4c1a9f392a27d76d9e84c71b04994f271aef608344d0211823b60d7

    • SHA512

      0faa3782c2af58cd381cc1e7ff281dba6cffb58e36f75197d41fc442d30ad77c7605f3ea8d92d20bda0249ed63756798ea009ef331e00ad7f5d84f9087b49619

    • SSDEEP

      98304:DXEs8Ca0XPke8RcX+dWHW5+r+JuHac1DL5dBMScy8MZLTzgX:gExsqlZu3sddFcy82zgX

    Score
    8/10
    vmprotect

    • Blocklisted process makes network request

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks