b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118

General

Target
b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118
Size 608KB
Sample240404-khx2esae3x
SHA256 c28ffcfb26e3c131d375874f5e222b770c69c91da313b8568e0f1bb2562ef9be
MD5 b3b37517a4b3fed4b3f36a12ed3bab01
SHA1 5f5486a5c2b8871e47616e7b6057a1dff820d882
SHA512 1d5a06e57a6932fdaa4724d04b86014560e688d066bff599dd215cb4e9ddce73a941a680592d177f6bf83b595d74fac9a015db00cf0d830e0e6c36e2c2f4623b
SSDEEP 12288:LZGQdqOG9NJqydLqQSeCqsVK8kPRGO35N9mVZzXc6O:LZ0/WjeCVVK8kP9N9oVU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118

File Explorer

b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118

.dll 608KB

b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118

IMPHASH e317cd3074621a3fd5cdd6645d803dd0
SHA256 c28ffcfb26e3c131d375874f5e222b770c69c91da313b8568e0f1bb2562ef9be
MD5 b3b37517a4b3fed4b3f36a12ed3bab01
SHA1 5f5486a5c2b8871e47616e7b6057a1dff820d882
SHA512 1d5a06e57a6932fdaa4724d04b86014560e688d066bff599dd215cb4e9ddce73a941a680592d177f6bf83b595d74fac9a015db00cf0d830e0e6c36e2c2f4623b
SSDEEP 12288:LZGQdqOG9NJqydLqQSeCqsVK8kPRGO35N9mVZzXc6O:LZ0/WjeCVVK8kP9N9oVU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

121477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Cause\417\Organ\Out vi\grand.pdb

kernel32

CreateEventW GetVersion FindClose FindNextFileW FindFirstFileW TlsAlloc TlsSetValue GetTempPathW VirtualProtectEx GetCurrentDirectoryW GetWindowsDirectoryW OpenMutexW CompareStringW CompareStringA GetLocaleInfoW HeapSize GetTimeZoneInformation LCMapStringW LCMapStringA LoadLibraryA InterlockedExchange FreeLibrary SetConsoleCtrlHandler RtlUnwind InitializeCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetStringTypeW MultiByteToWideChar GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID Sleep GetLastError HeapReAlloc HeapAlloc HeapFree InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap DeleteCriticalSection LeaveCriticalSection FatalAppExitA EnterCriticalSection HeapDestroy HeapCreate VirtualFree VirtualAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetTimeFormatA GetDateFormatA TlsGetValue TlsFree SetLastError GetCurrentThread GetACP GetOEMCP SetEnvironmentVariableA

user32

UnregisterHotKey BeginDeferWindowPos TranslateMessage DeferWindowPos CreateMenu GetPropW RegisterWindowMessageW

winscard

SCardLocateCardsByATRW SCardIsValidContext SCardLocateCardsA SCardListReaderGroupsW SCardReconnect SCardEndTransaction SCardReleaseContext SCardGetAttrib SCardLocateCardsW SCardIntroduceReaderGroupW SCardRemoveReaderFromGroupW SCardAccessStartedEvent SCardForgetReaderW SCardGetStatusChangeW SCardEstablishContext SCardIntroduceReaderW SCardControl SCardAddReaderToGroupW SCardForgetReaderGroupW SCardCancel SCardReleaseStartedEvent SCardConnectW SCardBeginTransaction SCardListReadersW SCardDisconnect

Sharing

General

Malware Config

Signatures

File Explorer

b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118

kernel32

user32

winscard

generic