a27f999d279a9b0a06af4ecdc9eb39e1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a27f999d279a9b0a06af4ecdc9eb39e1_JaffaCakes118
Size 6.6MB
Sample240403-wbc88agb4x
SHA256 643789beaf9683bc8cb084f5d270ed7a30969d5a70016cb393fda59a064f7934
MD5 a27f999d279a9b0a06af4ecdc9eb39e1
SHA1 d0455ffff34952110b4e3fa384d1394e49a7c596
SHA512 b133dd34f0d682887d05fe1465be523de76e1c3ba72cd7d11266d7b001e8018643239ef64dc15f771b3e39cd9957e9502e8649089c113e3f1eb467b91d24b261
SSDEEP 49152:qdJTnLF3wxROMZ/e6rrQBx1feqij/XG8IUWvZeB1iPt9yZ5R80qUvPhUm1b5ElhD:2R3at0Ug9C5R9v51EnZ8ynG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a27f999d279a9b0a06af4ecdc9eb39e1_JaffaCakes118

File Explorer

a27f999d279a9b0a06af4ecdc9eb39e1_JaffaCakes118

.exe 6.6MB

a27f999d279a9b0a06af4ecdc9eb39e1_JaffaCakes118

IMPHASH 57c9b357ae0cb2f414b0a5873e2f216d
SHA256 643789beaf9683bc8cb084f5d270ed7a30969d5a70016cb393fda59a064f7934
MD5 a27f999d279a9b0a06af4ecdc9eb39e1
SHA1 d0455ffff34952110b4e3fa384d1394e49a7c596
SHA512 b133dd34f0d682887d05fe1465be523de76e1c3ba72cd7d11266d7b001e8018643239ef64dc15f771b3e39cd9957e9502e8649089c113e3f1eb467b91d24b261
SSDEEP 49152:qdJTnLF3wxROMZ/e6rrQBx1feqij/XG8IUWvZeB1iPt9yZ5R80qUvPhUm1b5ElhD:2R3at0Ug9C5R9v51EnZ8ynG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler AreFileApisANSI CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateThread CreateWaitableTimerA CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetProcAddress GetProcessAffinityMask GetProcessHeap GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetTickCount GetVersionExA GetVersionExW HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter ReadFile ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetProcessPriorityBoost SetThreadContext SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread SystemTimeToFileTime TerminateProcess TlsGetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthread _beginthreadex _cexit _endthreadex _errno _fmode _initterm _localtime64 _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset qsort realloc signal strcmp strcspn strlen strncmp strrchr vfprintf

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

348KB

Virtual Size

348KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

398KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

345B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a27f999d279a9b0a06af4ecdc9eb39e1_JaffaCakes118

kernel32

msvcrt

generic