c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118

General

Target
c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118
Size 14.1MB
Sample240405-axyamaff78
SHA256 f06f8570f6999f01ade88f2c09538759e55539eb7c2d452999e1c66ca83e8c02
MD5 c60a9d97501c8fccb7ce37b52654839b
SHA1 94fc047b6307fd89d39eaad454db89dc1d0809c4
SHA512 5254c7f7f7164e27408bdaefe28b948a0b61e576161bd92d0aecefc7b327687e2f10c80ded601fbcfd0d799d887c4b3895e251d3db0a9ef50b3a58086a53ac45
SSDEEP 12288:R0Xz1CuwA5Rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rpZ:R0X2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118

File Explorer

c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118

.exe 14.1MB

c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118

IMPHASH 01c64e8a0bf942eae9e15adaebb52144
SHA256 f06f8570f6999f01ade88f2c09538759e55539eb7c2d452999e1c66ca83e8c02
MD5 c60a9d97501c8fccb7ce37b52654839b
SHA1 94fc047b6307fd89d39eaad454db89dc1d0809c4
SHA512 5254c7f7f7164e27408bdaefe28b948a0b61e576161bd92d0aecefc7b327687e2f10c80ded601fbcfd0d799d887c4b3895e251d3db0a9ef50b3a58086a53ac45
SSDEEP 12288:R0Xz1CuwA5Rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rpZ:R0X2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16130

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ditasicow\pire.pdb

kernel32

HeapReAlloc lstrlenA GetLocaleInfoA EndUpdateResourceW InterlockedIncrement GetQueuedCompletionStatus ReadConsoleA GetFileAttributesExA CreateActCtxW InitializeCriticalSection GetEnvironmentStrings GetCalendarInfoW FreeConsole InitAtomTable HeapDestroy FindNextVolumeW IsProcessorFeaturePresent GetFileAttributesW ReadFile GetModuleFileNameW DeactivateActCtx GetProcAddress BeginUpdateResourceW GetProcessVersion ResetEvent LoadLibraryA WriteConsoleA LocalAlloc RemoveDirectoryW SetConsoleWindowInfo EraseTape VirtualProtect SetProcessShutdownParameters ReleaseMutex GetCurrentProcessId FindNextVolumeA lstrcpyA WriteConsoleW GetProcessHeap WideCharToMultiByte InterlockedDecrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW HeapCreate InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess SetFilePointer GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CloseHandle CreateFileA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW SetEndOfFile CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118

kernel32

generic