de64bf8add8576866e581fe45153f034_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
de64bf8add8576866e581fe45153f034_JaffaCakes118
Size 432KB
Sample240406-hxbevsdg97
SHA256 33b81c0f87392de6c114037b0895cd12fa6f40fabb630eede6f05fb957108343
MD5 de64bf8add8576866e581fe45153f034
SHA1 be150f7499820bc3e17aa74cedd5feab1312e58b
SHA512 eb038e279ae7e59e704cde0e782117062480fa02ffa67cc0b2a2913d679affb8d50c678c803ed6de2c9ce1b598f4469316baf5279e14462a2a2b3e599253ff93
SSDEEP 12288:6UCmZiC/02hTIwjXL6LOLA6qrv8LJtOQ7OkO42Q+:wC/02WArLa4fJB2Q+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de64bf8add8576866e581fe45153f034_JaffaCakes118

File Explorer

de64bf8add8576866e581fe45153f034_JaffaCakes118

.exe 432KB

de64bf8add8576866e581fe45153f034_JaffaCakes118

IMPHASH 41721e0f933696d50ab32d544d64dcd3
SHA256 33b81c0f87392de6c114037b0895cd12fa6f40fabb630eede6f05fb957108343
MD5 de64bf8add8576866e581fe45153f034
SHA1 be150f7499820bc3e17aa74cedd5feab1312e58b
SHA512 eb038e279ae7e59e704cde0e782117062480fa02ffa67cc0b2a2913d679affb8d50c678c803ed6de2c9ce1b598f4469316baf5279e14462a2a2b3e599253ff93
SSDEEP 12288:6UCmZiC/02hTIwjXL6LOLA6qrv8LJtOQ7OkO42Q+:wC/02WArLa4fJB2Q+
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

api-ms-win-core-crt-l2-1-0

_initterm _initterm_e __wgetmainargs

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken SetProcessAffinityUpdateMode ExitProcess GetCurrentThreadId GetCurrentProcess GetCurrentProcessId TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount64 GetTickCount

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter SetErrorMode UnhandledExceptionFilter

api-ms-win-service-private-l1-1-3

I_RegisterSvchostNotificationCallback

api-ms-win-core-crt-l1-1-0

qsort_s memset memcpy _wcsicmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetProcAddress LoadLibraryExW

api-ms-win-core-heap-l1-1-0

HeapSetInformation HeapFree GetProcessHeap HeapAlloc

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive AcquireSRWLockShared InitializeSRWLock EnterCriticalSection LeaveCriticalSection ReleaseSRWLockShared

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-core-string-l1-1-0

CompareStringOrdinal MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenKeyExW RegEnumKeyExW RegDisablePredefinedCacheEx RegQueryValueExW RegGetValueW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy

api-ms-win-core-processthreads-l1-1-2

SetProtectedPolicy

rpcrt4

RpcServerUnregisterIfEx I_RpcMapWin32Status RpcServerUseProtseqEpW RpcMgmtSetServerStackSize RpcServerUnregisterIf RpcServerRegisterIf RpcMgmtStopServerListening RpcServerListen RpcMgmtWaitServerListen I_RpcServerDisableExceptionFilter

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl GetLengthSid AddAccessAllowedAce InitializeAcl GetTokenInformation InitializeSecurityDescriptor

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventRegister EventWriteTransfer

api-ms-win-crt-utility-l1-1-0

bsearch_s

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx CreateActCtxW DeactivateActCtx ActivateActCtx

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

ntdll

RtlQueryHeapInformation RtlImageNtHeader _vsnwprintf TpSetTimer TpReleaseTimer TpWaitForTimer TpSetTimerEx EtwEventWrite RtlRunOnceExecuteOnce RtlNtStatusToDosError EtwEventEnabled TpReleaseWait RtlNtStatusToDosErrorNoTeb TpSetWait TpAllocWait EtwEventRegister RtlUnhandledExceptionFilter NtSetInformationProcess RtlSetProcessIsCritical RtlInitializeCriticalSection RtlInitializeSid RtlAllocateHeap RtlSubAuthoritySid RtlGetDeviceFamilyInfoEnum RtlReleaseSRWLockExclusive RtlSubAuthorityCountSid RtlAcquireSRWLockExclusive RtlLengthRequiredSid RtlDeriveCapabilitySidsFromName RtlCopySid RtlFreeHeap TpAllocTimer NtQuerySystemInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

400KB

Virtual Size

992KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

de64bf8add8576866e581fe45153f034_JaffaCakes118

api-ms-win-core-crt-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-service-private-l1-1-3

api-ms-win-core-crt-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processthreads-l1-1-2

rpcrt4

api-ms-win-core-localization-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic