28b8413419b5656cecb272e07079b047_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
28b8413419b5656cecb272e07079b047_JaffaCakes118
Size 5.9MB
Sample240329-weabqsef57
SHA256 9a19b05e6b1086729de47bd9e86d789a62b764e30d944b83d67db89952e77cd4
MD5 28b8413419b5656cecb272e07079b047
SHA1 368a6d3aaab27e40d4c720430c3819e771125e37
SHA512 c7fba15a9c747ba4c463cee9fb45dfd10fd32ac71f60fbb19c98abeaf128327988b7ced480c86273824d1f8d02f8e03975aef7fe048a35ec71052d5e6a217202
SSDEEP 98304:iVQ0x7MTlxFxHfMlJExhGo/IJ2Tr/LIwjl3FQ0HP3c:gdlMTQlMIYTr/MK1CEs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28b8413419b5656cecb272e07079b047_JaffaCakes118

File Explorer

28b8413419b5656cecb272e07079b047_JaffaCakes118

.exe 5.9MB

28b8413419b5656cecb272e07079b047_JaffaCakes118

IMPHASH 219bad55dea5b14593a607fbdc160616
SHA256 9a19b05e6b1086729de47bd9e86d789a62b764e30d944b83d67db89952e77cd4
MD5 28b8413419b5656cecb272e07079b047
SHA1 368a6d3aaab27e40d4c720430c3819e771125e37
SHA512 c7fba15a9c747ba4c463cee9fb45dfd10fd32ac71f60fbb19c98abeaf128327988b7ced480c86273824d1f8d02f8e03975aef7fe048a35ec71052d5e6a217202
SSDEEP 98304:iVQ0x7MTlxFxHfMlJExhGo/IJ2Tr/LIwjl3FQ0HP3c:gdlMTQlMIYTr/MK1CEs
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetFocus MessageBoxA

shell32

SHGetSpecialFolderPathW CommandLineToArgvW

kernel32

HeapAlloc GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineW lstrlenA LocalFree FormatMessageA SizeofResource GetModuleFileNameW FindResourceA GetLastError LoadLibraryA LockResource LoadResource FreeLibrary LoadLibraryExW VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc GetNativeSystemInfo QueryPerformanceCounter GetProcAddress GetProcessHeap IsBadReadPtr GetModuleHandleExW GetModuleHandleA SetDllDirectoryA SetDllDirectoryW OutputDebugStringA GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId

vcruntime140

wcsrchr __C_specific_handler __current_exception __current_exception_context memset memcpy

api-ms-win-crt-string-l1-1-0

strncpy _stricmp _strdup wcsncmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _setmode __p__commode _set_fmode _fileno __stdio_common_vswprintf setvbuf __stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode free realloc malloc

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-runtime-l1-1-0

terminate _register_onexit_function _initialize_onexit_table _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm exit _exit _crt_atexit _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

28b8413419b5656cecb272e07079b047_JaffaCakes118

user32

shell32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic