d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118
Size 1.9MB
Sample240405-llakzaha73
SHA256 36417a157ba50103b551c55c44377105455f7d3f76add8d0ffe3859ae32bfe64
MD5 d0121aafc70d2e972ee1d23b3460a856
SHA1 2d2015fae69a934832da394d27e93366d5a68b67
SHA512 d9f7adedecba0c92adc1fd0f36627edb313bc4bf3031c9555e3541fb47d945ae4eaf000ed7f3894a0adda5bb37548c6cfda5d5ea3b3d23c2737d4824f44cf3b2
SSDEEP 49152:Qoa1taC070dpTubkoDGaXoJgPCzB6J2KZ:Qoa1taC0kfMsu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118

File Explorer

d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118

.exe 1.9MB

d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118

IMPHASH 95122753ea27818b35f9b51859e4c692
SHA256 36417a157ba50103b551c55c44377105455f7d3f76add8d0ffe3859ae32bfe64
MD5 d0121aafc70d2e972ee1d23b3460a856
SHA1 2d2015fae69a934832da394d27e93366d5a68b67
SHA512 d9f7adedecba0c92adc1fd0f36627edb313bc4bf3031c9555e3541fb47d945ae4eaf000ed7f3894a0adda5bb37548c6cfda5d5ea3b3d23c2737d4824f44cf3b2
SSDEEP 49152:Qoa1taC070dpTubkoDGaXoJgPCzB6J2KZ:Qoa1taC0kfMsu
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

296672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect Sleep GetCurrentProcessId GetCurrentThreadId GetModuleHandleW lstrlenW WideCharToMultiByte MoveFileExW GetTempFileNameW GetTempPathW DeleteFileW MoveFileW WriteFile ReadFile GetFileSize CreateFileW SetFileAttributesW GetModuleFileNameW GetComputerNameA GetSystemTime RaiseException RtlUnwind HeapAlloc HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer TlsAlloc TlsGetValue TlsSetValue InterlockedIncrement SetLastError InterlockedDecrement ExitProcess GetStdHandle HeapCreate HeapDestroy FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW HeapReAlloc HeapSize SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers MultiByteToWideChar GetStringTypeW SetStdHandle WriteConsoleW SetEndOfFile GetProcessHeap CloseHandle GetLastError DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcess GetModuleHandleA CreateProcessW LoadLibraryW SystemTimeToFileTime FindResourceExW FindResourceW LoadResource LockResource SizeofResource LoadLibraryA TlsFree GetProcAddress

user32

FlashWindow

advapi32

CreateServiceW RegCreateKeyExW OpenSCManagerW OpenServiceW QueryServiceConfigW ChangeServiceConfigW StartServiceW CloseServiceHandle RegCloseKey RegOpenKeyExW CryptAcquireContextW CryptReleaseContext GetUserNameW GetUserNameA AllocateAndInitializeSid CheckTokenMembership FreeSid RegQueryValueExW RegSetValueExW

shell32

ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathIsRootW PathAddExtensionW PathAppendW PathRemoveExtensionW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118

kernel32

user32

advapi32

shell32

shlwapi

generic