788f45ada2b264a9ea458f7d125571b0_JaffaCakes118

General

Target
788f45ada2b264a9ea458f7d125571b0_JaffaCakes118
Size 539KB
Sample240401-ybpncsde4y
SHA256 75b40afc06895b53f4a90d06c0b6b0e6b72a2c34883dfd151bfbac51701576c0
MD5 788f45ada2b264a9ea458f7d125571b0
SHA1 cc7cbce75f3f0c2e9eeb5c16f3b0cb690aa46aad
SHA512 7151982e5270c10869a1bbeb8329ec884aff1ec46925fe0bbbe07c70c3c279fe41c48fbf56835fece6341db772fdd98b142dab66d0d84e3f70422906d74de181
SSDEEP 12288:cFLz8rA4TmF2Gfhk0AYumXdw/9ZO9gEwZGEX8cA0/M:Sk3TORlAYumXo9ZO9ssEv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
788f45ada2b264a9ea458f7d125571b0_JaffaCakes118

File Explorer

788f45ada2b264a9ea458f7d125571b0_JaffaCakes118

.exe 539KB

788f45ada2b264a9ea458f7d125571b0_JaffaCakes118

IMPHASH 95764cd3a93b27321012d20c57632d43
SHA256 75b40afc06895b53f4a90d06c0b6b0e6b72a2c34883dfd151bfbac51701576c0
MD5 788f45ada2b264a9ea458f7d125571b0
SHA1 cc7cbce75f3f0c2e9eeb5c16f3b0cb690aa46aad
SHA512 7151982e5270c10869a1bbeb8329ec884aff1ec46925fe0bbbe07c70c3c279fe41c48fbf56835fece6341db772fdd98b142dab66d0d84e3f70422906d74de181
SSDEEP 12288:cFLz8rA4TmF2Gfhk0AYumXdw/9ZO9gEwZGEX8cA0/M:Sk3TORlAYumXo9ZO9ssEv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mecefejabax_dunugogi\27\lupuwi\xomahofo\vudidoloto\94\buk.pdb

kernel32

HeapAlloc GetCurrentProcess GetEnvironmentStringsW SetEvent FlushViewOfFile SleepEx ReadConsoleW InitAtomTable HeapDestroy WriteConsoleW GetModuleFileNameW CreateActCtxA DeactivateActCtx GetProcAddress BeginUpdateResourceW GetAtomNameA LocalAlloc SetEnvironmentVariableA GetOEMCP CreateIoCompletionPort SetConsoleTitleW GetModuleHandleA GetProcessShutdownParameters EraseTape VirtualProtect GetCPInfoExA Module32Next ReleaseMutex EndUpdateResourceA GetVersionExA FindNextVolumeA lstrcpyW LCMapStringW SetLastError SetProcessAffinityMask IsProcessorFeaturePresent HeapReAlloc EncodePointer DecodePointer GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId GetLastError InterlockedDecrement ReadFile HeapFree SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP IsValidCodePage CloseHandle LoadLibraryW WriteFile FreeEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte GetConsoleCP GetConsoleMode Sleep MultiByteToWideChar SetStdHandle RtlUnwind FlushFileBuffers GetStringTypeW HeapSize RaiseException CreateFileW

user32

ClientToScreen

gdi32

GetBitmapBits

winhttp

WinHttpSetOption

Sharing

General

Malware Config

Signatures

File Explorer

788f45ada2b264a9ea458f7d125571b0_JaffaCakes118

kernel32

user32

gdi32

winhttp

generic