0b75332fef4331149c0f649f6f1f6d36_JaffaCakes118

General

Target
0b75332fef4331149c0f649f6f1f6d36_JaffaCakes118
Size 1.1MB
Sample240328-vt1a2abe61
SHA256 8d2fc9db7c9f5dcf80faef24bf99af1a4553007d810981fef4026f3fce02a945
MD5 0b75332fef4331149c0f649f6f1f6d36
SHA1 1fe4f525230d70c216baa5634c3c2c77d32873db
SHA512 f736a90eeba5d213c8c6414430304f99e09b4f7f6e40c9be1f6a893db0f6da1ee8461b392b79bf7b03ba6053cf50a556b89e308a1e735d9c957dafc8abceaf4e
SSDEEP 24576:j3B/Urs6o/+TznYNy8sBIbkFARX8yrFycO77hzppXgC/H8W:AL4NlsBIEAt88c7hzpRgC/p
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b75332fef4331149c0f649f6f1f6d36_JaffaCakes118

File Explorer

0b75332fef4331149c0f649f6f1f6d36_JaffaCakes118

.exe 1.1MB

0b75332fef4331149c0f649f6f1f6d36_JaffaCakes118

IMPHASH 9a761cc30337d6ef5b44d15f62f53af5
SHA256 8d2fc9db7c9f5dcf80faef24bf99af1a4553007d810981fef4026f3fce02a945
MD5 0b75332fef4331149c0f649f6f1f6d36
SHA1 1fe4f525230d70c216baa5634c3c2c77d32873db
SHA512 f736a90eeba5d213c8c6414430304f99e09b4f7f6e40c9be1f6a893db0f6da1ee8461b392b79bf7b03ba6053cf50a556b89e308a1e735d9c957dafc8abceaf4e
SSDEEP 24576:j3B/Urs6o/+TznYNy8sBIbkFARX8yrFycO77hzppXgC/H8W:AL4NlsBIEAt88c7hzpRgC/p
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wanomapu_zi.pdb

kernel32

HeapReAlloc UnmapViewOfFile GetCurrentProcess SleepEx ReadConsoleW GetEnvironmentStrings InitAtomTable HeapDestroy FindNextVolumeW WriteConsoleW GetModuleFileNameW CreateActCtxA GetOverlappedResult GetACP ReleaseSemaphore DeactivateActCtx SetLastError GetProcAddress ResetEvent GetAtomNameA LocalAlloc GetModuleHandleA GetProcessShutdownParameters EraseTape VirtualProtect EndUpdateResourceA LCMapStringW lstrcpyA EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW GetCurrentThreadId GetLastError InterlockedDecrement HeapAlloc EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess HeapFree SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer CloseHandle ExitProcess WriteFile FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetOEMCP IsValidCodePage Sleep WideCharToMultiByte RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW RaiseException MultiByteToWideChar GetStringTypeW IsProcessorFeaturePresent HeapSize CreateFileW

Name

.text

Size

1004KB

Virtual Size

1004KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

445KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.zif

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hesusi

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0b75332fef4331149c0f649f6f1f6d36_JaffaCakes118

kernel32

generic