34452e9645c34ddf7c78a77d9a47bca6_JaffaCakes118

General

Target
34452e9645c34ddf7c78a77d9a47bca6_JaffaCakes118
Size 608KB
Sample240330-fsr6psaa65
SHA256 608443ad35cfda5ca4ebfa1409b44a6aeefe74a3953e8140511f1f5c08c8052d
MD5 34452e9645c34ddf7c78a77d9a47bca6
SHA1 ae392ed9650e9363d785b62fd71c116861cd3a5b
SHA512 bbb2464ac1b948262b1b984af372725efc04e0ad4fc39a9e33962b4afe0910f53b76e7a3ab258a30b0088759633801913023c0b5ae1da1e372cca7c5e4f746da
SSDEEP 12288:2ZGQdqOGxIJqydLqQSeCqsVK8kPRGO35N9mVczXc6:2Z0CWjeCVVK8kP9N9ow
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34452e9645c34ddf7c78a77d9a47bca6_JaffaCakes118

File Explorer

34452e9645c34ddf7c78a77d9a47bca6_JaffaCakes118

.dll 608KB

34452e9645c34ddf7c78a77d9a47bca6_JaffaCakes118

IMPHASH 5d534ecf7d5a7c2dbdd06071c18f8d1f
SHA256 608443ad35cfda5ca4ebfa1409b44a6aeefe74a3953e8140511f1f5c08c8052d
MD5 34452e9645c34ddf7c78a77d9a47bca6
SHA1 ae392ed9650e9363d785b62fd71c116861cd3a5b
SHA512 bbb2464ac1b948262b1b984af372725efc04e0ad4fc39a9e33962b4afe0910f53b76e7a3ab258a30b0088759633801913023c0b5ae1da1e372cca7c5e4f746da
SSDEEP 12288:2ZGQdqOGxIJqydLqQSeCqsVK8kPRGO35N9mVczXc6:2Z0CWjeCVVK8kP9N9ow
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

121477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Cause\417\Organ\Out vi\grand.pdb

kernel32

CreateEventW GetVersion FindClose FindNextFileW FindFirstFileW TlsAlloc TlsSetValue GetTempPathW VirtualProtectEx GetCurrentDirectoryW GetWindowsDirectoryW OpenMutexW CompareStringW CompareStringA GetLocaleInfoW HeapSize GetTimeZoneInformation LCMapStringW LCMapStringA LoadLibraryA InterlockedExchange FreeLibrary SetConsoleCtrlHandler RtlUnwind InitializeCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetStringTypeW MultiByteToWideChar GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID Sleep GetLastError HeapReAlloc HeapAlloc HeapFree InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap DeleteCriticalSection LeaveCriticalSection FatalAppExitA EnterCriticalSection HeapDestroy HeapCreate VirtualFree VirtualAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetTimeFormatA GetDateFormatA TlsGetValue TlsFree SetLastError GetCurrentThread GetACP GetOEMCP SetEnvironmentVariableA

user32

UnregisterHotKey BeginDeferWindowPos TranslateMessage DeferWindowPos CreateMenu GetPropW RegisterWindowMessageW

winscard

SCardIsValidContext SCardListReaderGroupsW SCardListReadersW SCardLocateCardsA SCardLocateCardsByATRW SCardControl SCardDisconnect SCardEndTransaction SCardIntroduceReaderGroupW SCardForgetReaderW SCardForgetReaderGroupW SCardGetAttrib SCardLocateCardsW SCardReconnect SCardReleaseContext SCardReleaseStartedEvent SCardRemoveReaderFromGroupW SCardIntroduceReaderW SCardGetStatusChangeW SCardConnectW SCardCancel SCardBeginTransaction SCardAddReaderToGroupW SCardAccessStartedEvent SCardEstablishContext

Sharing

General

Malware Config

Signatures

File Explorer

34452e9645c34ddf7c78a77d9a47bca6_JaffaCakes118

kernel32

user32

winscard

generic