57adc8f2d8b412478bbe12f650d204d9_JaffaCakes118

General

Target
57adc8f2d8b412478bbe12f650d204d9_JaffaCakes118
Size 324KB
Sample240331-seygsadh9t
SHA256 75ebc3327a9adb4a9a7a78dbe0927c25d53a7e8a3cfd2fead2580e7dcbea44a4
MD5 57adc8f2d8b412478bbe12f650d204d9
SHA1 68e44600199d09d089b0d1578877baa1c4328ad3
SHA512 65899b1cf4d8a9efcbce235c89b668d4c75fee3315ac293815e54eb6bb657d6ba51422df7d37f479d3c710791c55e6f441b0f5593b6828e89b3752f61eba0d78
SSDEEP 6144:IIUQFwFFglbbdDFnQk5LoFfGl6G9hCaY7B/:MawolbbxFQAh70
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57adc8f2d8b412478bbe12f650d204d9_JaffaCakes118

File Explorer

57adc8f2d8b412478bbe12f650d204d9_JaffaCakes118

.exe 324KB

57adc8f2d8b412478bbe12f650d204d9_JaffaCakes118

IMPHASH 0dd592f35b48076810a8314d458b6b4b
SHA256 75ebc3327a9adb4a9a7a78dbe0927c25d53a7e8a3cfd2fead2580e7dcbea44a4
MD5 57adc8f2d8b412478bbe12f650d204d9
SHA1 68e44600199d09d089b0d1578877baa1c4328ad3
SHA512 65899b1cf4d8a9efcbce235c89b668d4c75fee3315ac293815e54eb6bb657d6ba51422df7d37f479d3c710791c55e6f441b0f5593b6828e89b3752f61eba0d78
SSDEEP 6144:IIUQFwFFglbbdDFnQk5LoFfGl6G9hCaY7B/:MawolbbxFQAh70
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cin.pdb

kernel32

HeapReAlloc lstrlenA GetLocaleInfoA EndUpdateResourceW GetQueuedCompletionStatus GetCurrentProcess SetEvent BackupSeek GetConsoleTitleA ReadConsoleW WriteFile CreateActCtxW InitializeCriticalSection GetEnvironmentStrings InitAtomTable HeapDestroy FindNextVolumeW IsProcessorFeaturePresent GetFileAttributesW GetModuleFileNameW DeactivateActCtx InterlockedExchange GetProcAddress BeginUpdateResourceW PrepareTape GetProcessVersion WriteConsoleA LocalAlloc RemoveDirectoryW SetConsoleWindowInfo GetModuleHandleA VirtualProtect SetProcessShutdownParameters ReleaseMutex GetCurrentProcessId FindNextVolumeA lstrcpyA WriteConsoleW ReadFile WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW HeapCreate InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess SetFilePointer GetModuleHandleW ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CloseHandle CreateFileA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW SetEndOfFile GetProcessHeap CreateFileW

Name

.text

Size

225KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

39.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.novexa

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fil

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

57adc8f2d8b412478bbe12f650d204d9_JaffaCakes118

kernel32

generic