7129b73538a3c95543d5faad8a0733e7_JaffaCakes118

General

Target
7129b73538a3c95543d5faad8a0733e7_JaffaCakes118
Size 608KB
Sample240401-nynpgaeb35
SHA256 71a398c306c255f9b285a0d5f192fcfa060fd5414c94c544fe5795b1140e0c38
MD5 7129b73538a3c95543d5faad8a0733e7
SHA1 0d791e51fb81a96a690be1f4cd9349475a9bfa84
SHA512 3f0a6f133dfd679028afd9f834f78ef0bfb21211e8e088143cbaaf4ba53a7d6ad266c2d3131cad2e11b8d7d4f76a64fe196c78749c707cd07fb6a93917bde21a
SSDEEP 12288:NZGQdqOGs8JqydLqQSeCqsVK8kPRGO35N9mVEzXc6:NZ01WjeCVVK8kP9N9oI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7129b73538a3c95543d5faad8a0733e7_JaffaCakes118

File Explorer

7129b73538a3c95543d5faad8a0733e7_JaffaCakes118

.dll 608KB

7129b73538a3c95543d5faad8a0733e7_JaffaCakes118

IMPHASH f3365777c64be56b4998dc4b02b58f1e
SHA256 71a398c306c255f9b285a0d5f192fcfa060fd5414c94c544fe5795b1140e0c38
MD5 7129b73538a3c95543d5faad8a0733e7
SHA1 0d791e51fb81a96a690be1f4cd9349475a9bfa84
SHA512 3f0a6f133dfd679028afd9f834f78ef0bfb21211e8e088143cbaaf4ba53a7d6ad266c2d3131cad2e11b8d7d4f76a64fe196c78749c707cd07fb6a93917bde21a
SSDEEP 12288:NZGQdqOGs8JqydLqQSeCqsVK8kPRGO35N9mVEzXc6:NZ01WjeCVVK8kP9N9oI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

121477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Cause\417\Organ\Out vi\grand.pdb

kernel32

CreateEventW GetVersion FindClose FindNextFileW FindFirstFileW TlsAlloc TlsSetValue GetTempPathW VirtualProtectEx GetCurrentDirectoryW GetWindowsDirectoryW OpenMutexW CompareStringW CompareStringA GetLocaleInfoW HeapSize GetTimeZoneInformation LCMapStringW LCMapStringA LoadLibraryA InterlockedExchange FreeLibrary SetConsoleCtrlHandler RtlUnwind InitializeCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetStringTypeW MultiByteToWideChar GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID Sleep GetLastError HeapReAlloc HeapAlloc HeapFree InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap DeleteCriticalSection LeaveCriticalSection FatalAppExitA EnterCriticalSection HeapDestroy HeapCreate VirtualFree VirtualAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetTimeFormatA GetDateFormatA TlsGetValue TlsFree SetLastError GetCurrentThread GetACP GetOEMCP SetEnvironmentVariableA

user32

BeginDeferWindowPos DeferWindowPos GetPropW TranslateMessage UnregisterHotKey CreateMenu RegisterWindowMessageW

winscard

SCardLocateCardsByATRW SCardIsValidContext SCardLocateCardsA SCardListReaderGroupsW SCardReconnect SCardEndTransaction SCardReleaseContext SCardGetAttrib SCardLocateCardsW SCardIntroduceReaderGroupW SCardRemoveReaderFromGroupW SCardAccessStartedEvent SCardForgetReaderW SCardGetStatusChangeW SCardEstablishContext SCardIntroduceReaderW SCardControl SCardAddReaderToGroupW SCardForgetReaderGroupW SCardCancel SCardReleaseStartedEvent SCardConnectW SCardBeginTransaction SCardListReadersW SCardDisconnect

Sharing

General

Malware Config

Signatures

File Explorer

7129b73538a3c95543d5faad8a0733e7_JaffaCakes118

kernel32

user32

winscard

generic