2e31becd6f048e88711a289110b41021_JaffaCakes118

General

Target
2e31becd6f048e88711a289110b41021_JaffaCakes118
Size 10.0MB
Sample240329-17js4abh97
SHA256 f9184e1c98e13ad7ac25e5fdcf56bb27988775d2a9be11df778ae7b9639ce083
MD5 2e31becd6f048e88711a289110b41021
SHA1 167fde1d6dfef1f02c8ab9d5e1abb9c7c8188acf
SHA512 cbea83dd37619d954cb7a7825c97e70bf488d802622be355d56c0680c2c71b214ad23a4eca4c46ed22dd60998c4026e66556e59b40589524eabb165696da151a
SSDEEP 98304:SEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE0:
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e31becd6f048e88711a289110b41021_JaffaCakes118

File Explorer

2e31becd6f048e88711a289110b41021_JaffaCakes118

.exe 10.0MB

2e31becd6f048e88711a289110b41021_JaffaCakes118

IMPHASH 613eed189326e5150348769c0b41fcc9
SHA256 f9184e1c98e13ad7ac25e5fdcf56bb27988775d2a9be11df778ae7b9639ce083
MD5 2e31becd6f048e88711a289110b41021
SHA1 167fde1d6dfef1f02c8ab9d5e1abb9c7c8188acf
SHA512 cbea83dd37619d954cb7a7825c97e70bf488d802622be355d56c0680c2c71b214ad23a4eca4c46ed22dd60998c4026e66556e59b40589524eabb165696da151a
SSDEEP 98304:SEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE0:
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mogaduhesutun\hihekeyolo63-pi.pdb

kernel32

lstrlenA HeapAlloc EndUpdateResourceW ReadConsoleA GetCurrentProcess SetEvent SleepEx BackupSeek CreateActCtxW GetEnvironmentStrings InitAtomTable HeapDestroy GetFileAttributesA FindNextVolumeW GetTapePosition WriteConsoleW GetModuleFileNameW ReleaseSemaphore DeactivateActCtx InterlockedExchange GetLastError GetProcAddress BeginUpdateResourceW RemoveDirectoryA GetProcessVersion LocalAlloc CreateIoCompletionPort GetModuleHandleA VirtualProtect SetProcessShutdownParameters GetCurrentProcessId FindNextVolumeA lstrcpyA GetCommandLineW HeapSetInformation GetStartupInfoW HeapFree SetFilePointer EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess CloseHandle GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers Sleep RtlUnwind LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException MultiByteToWideChar HeapReAlloc IsProcessorFeaturePresent HeapSize LCMapStringW GetStringTypeW CreateFileW

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lipafo

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.yowo

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9.9MB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2e31becd6f048e88711a289110b41021_JaffaCakes118

kernel32

generic