c8623c3b0823a6e18beae9b8a7345bba_JaffaCakes118

General

Target
c8623c3b0823a6e18beae9b8a7345bba_JaffaCakes118
Size 738KB
Sample240405-cz79qaaf24
SHA256 a5c8eb6c897258f7ba995c557ca172ae7850225f5e39b94c58024a278b52951c
MD5 c8623c3b0823a6e18beae9b8a7345bba
SHA1 62bc0c717ab1d4fdfa39b0b80bcd8d70be78dff0
SHA512 fdf45104d2da130bc92b1601b36fb632db0d5d0a971a3bb6325c55d49195f7cbe1bb1537a53d08f9bb6964a87a835bc105c3db9c5f470e9a352288c5684e962a
SSDEEP 12288:JAwSfxL/2Dc3jDLLmt0LDQewsHjhWW1d9cbO0qIlp7+x9xhIS2:6GewsHjoW1d9czNa98
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8623c3b0823a6e18beae9b8a7345bba_JaffaCakes118

File Explorer

c8623c3b0823a6e18beae9b8a7345bba_JaffaCakes118

.exe 738KB

c8623c3b0823a6e18beae9b8a7345bba_JaffaCakes118

IMPHASH ead69853b7cb1b3bd5e661d99b54cf07
SHA256 a5c8eb6c897258f7ba995c557ca172ae7850225f5e39b94c58024a278b52951c
MD5 c8623c3b0823a6e18beae9b8a7345bba
SHA1 62bc0c717ab1d4fdfa39b0b80bcd8d70be78dff0
SHA512 fdf45104d2da130bc92b1601b36fb632db0d5d0a971a3bb6325c55d49195f7cbe1bb1537a53d08f9bb6964a87a835bc105c3db9c5f470e9a352288c5684e962a
SSDEEP 12288:JAwSfxL/2Dc3jDLLmt0LDQewsHjhWW1d9cbO0qIlp7+x9xhIS2:6GewsHjoW1d9czNa98
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

114646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mavinject32.pdb

kernel32

RaiseException GetLastError DecodePointer HeapSetInformation InitializeCriticalSectionEx CloseHandle LocalFree WriteProcessMemory ReadProcessMemory WideCharToMultiByte DeleteCriticalSection OpenProcess CreateFileW FlushFileBuffers SetUnhandledExceptionFilter OutputDebugStringW FreeLibrary LoadLibraryW GetProcAddress GetCurrentProcess WaitForSingleObject GetModuleHandleW CreateRemoteThread VirtualFreeEx VirtualAllocEx DuplicateHandle ExitProcess VirtualQueryEx TerminateProcess SetLastError VirtualProtectEx IsWow64Process VirtualQuery LoadLibraryExW IsDebuggerPresent EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetStringTypeW EncodePointer HeapFree GetCommandLineW IsProcessorFeaturePresent GetCPInfo RtlUnwind HeapAlloc UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetCurrentThreadId GetProcessHeap GetModuleHandleExW HeapSize GetStdHandle GetFileType GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW

shell32

CommandLineToArgvW

ntdll

NtQueryInformationProcess RtlNtStatusToDosError

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

c8623c3b0823a6e18beae9b8a7345bba_JaffaCakes118

kernel32

shell32

ntdll

advapi32

generic