16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118
Size 1008KB
Sample240329-dhhheage77
SHA256 1ffa8a5e7920aad8eed12d3b8cad4734bc70f5574803068c7cced5c1c191492d
MD5 16c029b794fdb69a481fb51b8d02a2c8
SHA1 1eff5580689b6c8672c00d52beb3efd3741fd77c
SHA512 1291376d0000d8d7fe19f7f7907d25ac4b6f9977ac1a0135d29746723834217290998867e9648e7b424fda210bce43d2832bde6e95777a9971424deaf92ebc62
SSDEEP 24576:dgdhhQGGnnazLpj4VHogiuGPYEZXT60D2+RQraWDw1D:dqgazxcGPtjD29aWK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118

File Explorer

16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118

.exe 1008KB

16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118

IMPHASH a5491ddab3ab64c1c40fad74c1ea58b8
SHA256 1ffa8a5e7920aad8eed12d3b8cad4734bc70f5574803068c7cced5c1c191492d
MD5 16c029b794fdb69a481fb51b8d02a2c8
SHA1 1eff5580689b6c8672c00d52beb3efd3741fd77c
SHA512 1291376d0000d8d7fe19f7f7907d25ac4b6f9977ac1a0135d29746723834217290998867e9648e7b424fda210bce43d2832bde6e95777a9971424deaf92ebc62
SSDEEP 24576:dgdhhQGGnnazLpj4VHogiuGPYEZXT60D2+RQraWDw1D:dqgazxcGPtjD29aWK
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

259908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegUnLoadKeyW RegSetValueExW RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegLoadKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegConnectRegistryW RegCloseKey

user32

LoadStringW MessageBoxA CharNextW MessageBoxW LoadStringW GetSystemMetrics CharUpperBuffW CharNextW

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW WritePrivateProfileStringW WriteFile WideCharToMultiByte WaitForSingleObject VirtualQueryEx VirtualQuery VirtualProtect VirtualFree VirtualAlloc TerminateProcess SignalObjectAndWait SetLastError SetFilePointer SetEvent SetEnvironmentVariableW SetEndOfFile ResetEvent ReadFile OpenEventW MultiByteToWideChar LockResource LoadResource LoadLibraryW LeaveCriticalSection IsBadReadPtr InitializeCriticalSection HeapFree HeapAlloc GetVolumeInformationW GetVersionExW GetTickCount GetThreadLocale GetStdHandle GetProcessHeap GetProcAddress GetPrivateProfileStringW GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileSize GetFileAttributesW GetEnvironmentVariableW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentProcess GetCPInfo InterlockedExchange InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW FindFirstFileW FindClose ExitThread ExitProcess EnumCalendarInfoW EnterCriticalSection DeleteFileW DeleteCriticalSection CreateProcessW CreateFileMappingW CreateFileW CreateEventW CreateDirectoryW CompareStringW CloseHandle Sleep

Name

.text

Size

247KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118

oleaut32

advapi32

user32

kernel32

generic