7e074b12f3605bffcefa4060e08003e2_JaffaCakes118

General

Target
7e074b12f3605bffcefa4060e08003e2_JaffaCakes118
Size 14.4MB
Sample240402-adaefsag8w
SHA256 1d0276aa6842ab14d2c0343d3d78454c34dfa3ca140f49ee6e3579bd9734bc1d
MD5 7e074b12f3605bffcefa4060e08003e2
SHA1 5c653b2ef1c47e3f45e022c6dad31bebfa310c42
SHA512 231f1805345d585a8e741a4b7f0b23092e8cc22ac13d613703bb53944ec8659bac6d68dca66b5c8b8e6d7dc701f69e106f0cbb6aa33a2c24848b4bc067a93125
SSDEEP 6144:engjLKfnGE+Nj43Gd/50NS0UG4th+d49EOVVVVVVVVVVVVVVVVVVVVVVVVVVVVV7:ZiOE+Nj4Q50k0UGIh+dJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e074b12f3605bffcefa4060e08003e2_JaffaCakes118

File Explorer

7e074b12f3605bffcefa4060e08003e2_JaffaCakes118

.exe 14.4MB

7e074b12f3605bffcefa4060e08003e2_JaffaCakes118

IMPHASH 36c786286bbc25d8ee5ac2239b6c4c04
SHA256 1d0276aa6842ab14d2c0343d3d78454c34dfa3ca140f49ee6e3579bd9734bc1d
MD5 7e074b12f3605bffcefa4060e08003e2
SHA1 5c653b2ef1c47e3f45e022c6dad31bebfa310c42
SHA512 231f1805345d585a8e741a4b7f0b23092e8cc22ac13d613703bb53944ec8659bac6d68dca66b5c8b8e6d7dc701f69e106f0cbb6aa33a2c24848b4bc067a93125
SSDEEP 6144:engjLKfnGE+Nj43Gd/50NS0UG4th+d49EOVVVVVVVVVVVVVVVVVVVVVVVVVVVVV7:ZiOE+Nj4Q50k0UGIh+dJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wis-xiyu\73_fayumi\favatoce.pdb

kernel32

GetCommandLineW FileTimeToDosDateTime GetNativeSystemInfo TlsGetValue GetStringTypeA SetLocalTime HeapAlloc InterlockedIncrement GetCommState ReadConsoleA GlobalSize GetSystemWindowsDirectoryW GlobalLock SetHandleInformation CancelWaitableTimer GetModuleHandleW ActivateActCtx LoadLibraryW TerminateThread GetConsoleAliasExesLengthW GetCompressedFileSizeA GetSystemDirectoryA CompareStringW lstrlenW SetThreadPriority WritePrivateProfileStringW DeactivateActCtx GetNamedPipeHandleStateW GetPrivateProfileIntW VerifyVersionInfoW CreateDirectoryA InterlockedExchange SetCurrentDirectoryA GetStartupInfoA GetCPInfoExW GetLastError GetThreadLocale GetProcAddress GetProcessHeaps SetStdHandle EnterCriticalSection DisableThreadLibraryCalls GetPrivateProfileStringA LoadLibraryA LocalAlloc SetSystemTime SetEnvironmentVariableA GetOEMCP Process32NextW FindNextFileA WriteProfileStringA FindFirstChangeNotificationA QueryMemoryResourceNotification FreeEnvironmentStringsW EnumResourceNamesA WriteProfileStringW GetCurrentDirectoryA GetCurrentThreadId GetCPInfoExA FindAtomW UnregisterWaitEx GetProfileSectionW LCMapStringW CopyFileExA GetVolumeInformationW CreateFileA GetConsoleOutputCP MultiByteToWideChar GetStartupInfoW HeapValidate IsBadReadPtr RaiseException LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW DeleteCriticalSection InterlockedDecrement GetACP GetCPInfo IsValidCodePage TlsAlloc TlsSetValue TlsFree SetLastError QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep ExitProcess GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType HeapDestroy HeapCreate HeapFree VirtualFree GetModuleFileNameA WriteFile HeapSize HeapReAlloc VirtualAlloc RtlUnwind WideCharToMultiByte DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW InitializeCriticalSectionAndSpinCount LCMapStringA GetStringTypeW GetLocaleInfoA FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointer CloseHandle WriteConsoleA

user32

GetMenuItemID

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

7e074b12f3605bffcefa4060e08003e2_JaffaCakes118

kernel32

user32

winhttp

generic