4ef7ea6eb6f007e8f0ad9cd6243a21c5_JaffaCakes118

General

Target
4ef7ea6eb6f007e8f0ad9cd6243a21c5_JaffaCakes118
Size 604KB
Sample240331-gmq7wsfd95
SHA256 c72fa2296308b8500ddb8c345035befee0711451d1272df8b6762c608e0cfb82
MD5 4ef7ea6eb6f007e8f0ad9cd6243a21c5
SHA1 b33219154cc6a9db3bb471693542c7982dc5be1a
SHA512 27948e4860c8e8221aa300eb54247e26d0dcc9ae3928c12abe0aca6c970e67ffb8ad70a0807e301eccaac10f9be543c3a185629b292cd12df81ac29e83da5592
SSDEEP 12288:/uIBebwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbiW/:mHb4wqyaDA5sTWiXT2tq07G23/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ef7ea6eb6f007e8f0ad9cd6243a21c5_JaffaCakes118

File Explorer

4ef7ea6eb6f007e8f0ad9cd6243a21c5_JaffaCakes118

.dll 604KB

4ef7ea6eb6f007e8f0ad9cd6243a21c5_JaffaCakes118

IMPHASH 0bdeed4a70b8b1fd5924130bfe75d8bf
SHA256 c72fa2296308b8500ddb8c345035befee0711451d1272df8b6762c608e0cfb82
MD5 4ef7ea6eb6f007e8f0ad9cd6243a21c5
SHA1 b33219154cc6a9db3bb471693542c7982dc5be1a
SHA512 27948e4860c8e8221aa300eb54247e26d0dcc9ae3928c12abe0aca6c970e67ffb8ad70a0807e301eccaac10f9be543c3a185629b292cd12df81ac29e83da5592
SSDEEP 12288:/uIBebwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbiW/:mHb4wqyaDA5sTWiXT2tq07G23/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

114752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\299_Flow\him\bell_opposite\order\Most.pdb

kernel32

FileTimeToLocalFileTime CreateEventW GetVersion FindClose FindNextFileW FindFirstFileW TlsAlloc GetCurrentDirectoryW VirtualProtectEx GetSystemDirectoryW FindFirstChangeNotificationW GetWindowsDirectoryW CompareStringW CompareStringA GetLocaleInfoW HeapSize GetTimeZoneInformation LCMapStringW LCMapStringA LoadLibraryA InterlockedExchange FreeLibrary SetConsoleCtrlHandler RtlUnwind InitializeCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetStringTypeW MultiByteToWideChar GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID Sleep HeapAlloc GetLastError HeapFree InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap DeleteCriticalSection LeaveCriticalSection FatalAppExitA EnterCriticalSection HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetTimeFormatA GetDateFormatA TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThread GetACP GetOEMCP SetEnvironmentVariableA

user32

UnregisterHotKey BeginDeferWindowPos TranslateMessage DeferWindowPos CreateMenu GetPropW RegisterWindowMessageW

winscard

SCardLocateCardsByATRW SCardIsValidContext SCardLocateCardsA SCardListReaderGroupsW SCardReconnect SCardEndTransaction SCardReleaseContext SCardGetAttrib SCardLocateCardsW SCardIntroduceReaderGroupW SCardRemoveReaderFromGroupW SCardAccessStartedEvent SCardForgetReaderW SCardGetStatusChangeW SCardEstablishContext SCardIntroduceReaderW SCardControl SCardAddReaderToGroupW SCardForgetReaderGroupW SCardCancel SCardReleaseStartedEvent SCardConnectW SCardBeginTransaction SCardListReadersW SCardDisconnect

Sharing

General

Malware Config

Signatures

File Explorer

4ef7ea6eb6f007e8f0ad9cd6243a21c5_JaffaCakes118

kernel32

user32

winscard

generic