5ad64bb7be7914ad793ae5ccb98a571e_JaffaCakes118

General

Target
5ad64bb7be7914ad793ae5ccb98a571e_JaffaCakes118
Size 1.1MB
Sample240331-w6xakshc99
SHA256 18ae9ea1c1d71b33777c8772248580f17a2bcecf1aa0e8f71ec15d4b33d5253b
MD5 5ad64bb7be7914ad793ae5ccb98a571e
SHA1 60aeca403754af25ff307050496a70eabe706a8a
SHA512 a08299221b3bcca7808c84480785656bd49dc439b028bf6b1cd44682a6b6c43ffed84c3f452d3578f9408adcf79233ad86a65b619d60004fbd6b2a30df4f7019
SSDEEP 24576:xTcsunDS/lXSKgG3DSRGNp0IMXgZlnLei6Qpf8H89IS:VAWlXqbAp0XMnqLc8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ad64bb7be7914ad793ae5ccb98a571e_JaffaCakes118

File Explorer

5ad64bb7be7914ad793ae5ccb98a571e_JaffaCakes118

.exe 1.1MB

5ad64bb7be7914ad793ae5ccb98a571e_JaffaCakes118

IMPHASH 9a761cc30337d6ef5b44d15f62f53af5
SHA256 18ae9ea1c1d71b33777c8772248580f17a2bcecf1aa0e8f71ec15d4b33d5253b
MD5 5ad64bb7be7914ad793ae5ccb98a571e
SHA1 60aeca403754af25ff307050496a70eabe706a8a
SHA512 a08299221b3bcca7808c84480785656bd49dc439b028bf6b1cd44682a6b6c43ffed84c3f452d3578f9408adcf79233ad86a65b619d60004fbd6b2a30df4f7019
SSDEEP 24576:xTcsunDS/lXSKgG3DSRGNp0IMXgZlnLei6Qpf8H89IS:VAWlXqbAp0XMnqLc8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\sil-dafunotepon bolinebihaw98\gekib.pdb

kernel32

HeapReAlloc UnmapViewOfFile GetCurrentProcess SleepEx ReadConsoleW GetEnvironmentStrings InitAtomTable HeapDestroy FindNextVolumeW WriteConsoleW GetModuleFileNameW CreateActCtxA GetOverlappedResult GetACP ReleaseSemaphore DeactivateActCtx SetLastError GetProcAddress ResetEvent GetAtomNameA LocalAlloc GetModuleHandleA GetProcessShutdownParameters EraseTape VirtualProtect EndUpdateResourceA LCMapStringW lstrcpyA EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW GetCurrentThreadId GetLastError InterlockedDecrement HeapAlloc EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess HeapFree SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer CloseHandle ExitProcess WriteFile FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetOEMCP IsValidCodePage Sleep WideCharToMultiByte RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW RaiseException MultiByteToWideChar GetStringTypeW IsProcessorFeaturePresent HeapSize CreateFileW

Name

.text

Size

1004KB

Virtual Size

1003KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

445KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nusavu

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pudipuv

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5ad64bb7be7914ad793ae5ccb98a571e_JaffaCakes118

kernel32

generic