9e4a5a885fda8f38847f4f27cf21c52a_JaffaCakes118

General

Target
9e4a5a885fda8f38847f4f27cf21c52a_JaffaCakes118
Size 11.3MB
Sample240403-dhmr5aea5v
SHA256 96cbde3b6581f41951448104432acd2ee0069d14a86ce150d73736c89eae7bd4
MD5 9e4a5a885fda8f38847f4f27cf21c52a
SHA1 1b30daa0661d9e0205f9499d6a1b4caa7e9e37f1
SHA512 6bd1ef9ce3e0cdb336ad2d3dd795d0ae00e9736f7349cdaafc87a3192e7ee362a1628ec8d423ef75cc37cb7910c087019e5ae21278f342f750f5ac7e3a5226a9
SSDEEP 196608:fb/////////////////////////////////////////////////////////////f:f
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9e4a5a885fda8f38847f4f27cf21c52a_JaffaCakes118

File Explorer

9e4a5a885fda8f38847f4f27cf21c52a_JaffaCakes118

.exe 11.3MB

9e4a5a885fda8f38847f4f27cf21c52a_JaffaCakes118

IMPHASH a9424a96bcb9e21c7e2701c8df603c55
SHA256 96cbde3b6581f41951448104432acd2ee0069d14a86ce150d73736c89eae7bd4
MD5 9e4a5a885fda8f38847f4f27cf21c52a
SHA1 1b30daa0661d9e0205f9499d6a1b4caa7e9e37f1
SHA512 6bd1ef9ce3e0cdb336ad2d3dd795d0ae00e9736f7349cdaafc87a3192e7ee362a1628ec8d423ef75cc37cb7910c087019e5ae21278f342f750f5ac7e3a5226a9
SSDEEP 196608:fb/////////////////////////////////////////////////////////////f:f
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yitik1-xus79_xohumina.pdb

kernel32

GetThreadContext SearchPathW SetInformationJobObject FindFirstChangeNotificationW lstrlenA CopyFileExW InterlockedDecrement GetSystemWindowsDirectoryW GetProfileStringW SetConsoleScreenBufferSize FreeEnvironmentStringsA CreateNamedPipeW SetCommState GetCommandLineA FindResourceExA GetPrivateProfileIntA SetFileShortNameW LoadLibraryW GetSystemWow64DirectoryW HeapDestroy CreateSemaphoreA GetBinaryTypeA GetModuleFileNameW GetStartupInfoW LCMapStringA GetLastError SetLastError GetProcAddress SetStdHandle LocalAlloc GetNumberFormatW FindAtomA CreateIoCompletionPort HeapSetInformation GetCurrentDirectoryA OutputDebugStringA GetCPInfoExA FindAtomW DeleteFileW GetSystemTime GetCommandLineW InterlockedIncrement DecodePointer GetModuleHandleW ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer WriteFile GetStdHandle EnterCriticalSection LeaveCriticalSection RtlUnwind GetACP GetOEMCP GetCPInfo IsValidCodePage TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId TlsFree SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW HeapValidate IsBadReadPtr HeapCreate SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode WriteConsoleW OutputDebugStringW MultiByteToWideChar GetStringTypeW LCMapStringW HeapAlloc GetModuleFileNameA HeapReAlloc HeapSize HeapQueryInformation HeapFree IsProcessorFeaturePresent FlushFileBuffers ReadFile RaiseException CreateFileW CloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

9e4a5a885fda8f38847f4f27cf21c52a_JaffaCakes118

kernel32

generic