01b5b716cf9b9802b46635638d889a85_JaffaCakes118

General

Target
01b5b716cf9b9802b46635638d889a85_JaffaCakes118
Size 13.9MB
Sample240328-kwcbwaee92
SHA256 fdbbaf0c8b94aee61088e99700484f54fdf62ce20954195c4b92fde85e732c57
MD5 01b5b716cf9b9802b46635638d889a85
SHA1 782283c2d14476450c01cf334894c8b013879fc3
SHA512 a1adca70a104df4dee66443817d732a0e1ed0d497c833e8b7f7428fad332166946e981197740910c723bb11026aee24737e9a4b8674f9698f99905c1f67f3abc
SSDEEP 98304:dEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE3:
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01b5b716cf9b9802b46635638d889a85_JaffaCakes118

File Explorer

01b5b716cf9b9802b46635638d889a85_JaffaCakes118

.exe 13.9MB

01b5b716cf9b9802b46635638d889a85_JaffaCakes118

IMPHASH 613eed189326e5150348769c0b41fcc9
SHA256 fdbbaf0c8b94aee61088e99700484f54fdf62ce20954195c4b92fde85e732c57
MD5 01b5b716cf9b9802b46635638d889a85
SHA1 782283c2d14476450c01cf334894c8b013879fc3
SHA512 a1adca70a104df4dee66443817d732a0e1ed0d497c833e8b7f7428fad332166946e981197740910c723bb11026aee24737e9a4b8674f9698f99905c1f67f3abc
SSDEEP 98304:dEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE3:
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mogaduhesutun\hihekeyolo63-pi.pdb

kernel32

lstrlenA HeapAlloc EndUpdateResourceW ReadConsoleA GetCurrentProcess SetEvent SleepEx BackupSeek CreateActCtxW GetEnvironmentStrings InitAtomTable HeapDestroy GetFileAttributesA FindNextVolumeW GetTapePosition WriteConsoleW GetModuleFileNameW ReleaseSemaphore DeactivateActCtx InterlockedExchange GetLastError GetProcAddress BeginUpdateResourceW RemoveDirectoryA GetProcessVersion LocalAlloc CreateIoCompletionPort GetModuleHandleA VirtualProtect SetProcessShutdownParameters GetCurrentProcessId FindNextVolumeA lstrcpyA GetCommandLineW HeapSetInformation GetStartupInfoW HeapFree SetFilePointer EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess CloseHandle GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers Sleep RtlUnwind LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException MultiByteToWideChar HeapReAlloc IsProcessorFeaturePresent HeapSize LCMapStringW GetStringTypeW CreateFileW

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lipafo

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.yowo

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

13.7MB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

01b5b716cf9b9802b46635638d889a85_JaffaCakes118

kernel32

generic