e08412673407254f52ea7bc40fbc3bf6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
e08412673407254f52ea7bc40fbc3bf6_JaffaCakes118
Size 416KB
Sample240406-krvmnafd73
SHA256 579bc3593e099179036f085700d1eed64180ce36588d85583dc91304cf393eab
MD5 e08412673407254f52ea7bc40fbc3bf6
SHA1 1dd5ff0b7f65aad8f14ab52542768f5893a913bd
SHA512 acd1774eefe1dee0f6e9d862fac52e3fb846e346d282891c1bdce8a3eb489770bbfdcd73f9f2748b1c45badb264c392ee498e42fff735f9e6c27e9390771b951
SSDEEP 12288:tLjViy9ZYUQcIl38KZjQg0prnAbiKusJ2:RjVigZYd5RZjQvpr0fJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e08412673407254f52ea7bc40fbc3bf6_JaffaCakes118

File Explorer

e08412673407254f52ea7bc40fbc3bf6_JaffaCakes118

.exe 416KB

e08412673407254f52ea7bc40fbc3bf6_JaffaCakes118

IMPHASH 36ccc34b74479708997cf9f7a419ae31
SHA256 579bc3593e099179036f085700d1eed64180ce36588d85583dc91304cf393eab
MD5 e08412673407254f52ea7bc40fbc3bf6
SHA1 1dd5ff0b7f65aad8f14ab52542768f5893a913bd
SHA512 acd1774eefe1dee0f6e9d862fac52e3fb846e346d282891c1bdce8a3eb489770bbfdcd73f9f2748b1c45badb264c392ee498e42fff735f9e6c27e9390771b951
SSDEEP 12288:tLjViy9ZYUQcIl38KZjQg0prnAbiKusJ2:RjVigZYd5RZjQvpr0fJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8389

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

msvcrt

__wgetmainargs _exit _XcptFilter exit _initterm _amsg_exit __setusermatherr memcpy _controlfp _except_handler4_common ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode _cexit

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId TerminateProcess GetCurrentProcess OpenProcessToken GetCurrentThreadId

kernel32

LeaveCriticalSection EnterCriticalSection DelayLoadFailureHook GetProcAddress GetLastError FreeLibrary InterlockedCompareExchange LoadLibraryExA InterlockedExchange Sleep SetUnhandledExceptionFilter GetModuleHandleA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime UnhandledExceptionFilter DeactivateActCtx LoadLibraryExW ActivateActCtx ReleaseSRWLockShared lstrcmpW AcquireSRWLockShared RegCloseKey RegOpenKeyExW HeapSetInformation lstrcmpiW InitializeSRWLock lstrlenW LCMapStringW ReleaseSRWLockExclusive RegQueryValueExW AcquireSRWLockExclusive ReleaseActCtx CreateActCtxW ExpandEnvironmentStringsW GetCommandLineW ExitProcess SetProcessAffinityUpdateMode RegDisablePredefinedCacheEx GetProcessHeap SetErrorMode RegisterWaitForSingleObjectEx LocalAlloc HeapFree WideCharToMultiByte LocalFree CloseHandle HeapAlloc

ntdll

RtlAllocateHeap RtlLengthRequiredSid RtlSubAuthoritySid RtlInitializeSid RtlCopySid RtlSubAuthorityCountSid RtlInitializeCriticalSection RtlSetProcessIsCritical RtlImageNtHeader RtlUnhandledExceptionFilter EtwEventWrite EtwEventEnabled EtwEventRegister RtlFreeHeap

api-ms-win-security-base-l1-1-0

GetTokenInformation SetSecurityDescriptorDacl AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetLengthSid InitializeAcl

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

rpcrt4

RpcMgmtSetServerStackSize I_RpcMapWin32Status RpcServerUnregisterIf RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcServerUnregisterIfEx RpcServerRegisterIf RpcServerUseProtseqEpW RpcServerListen

Sharing

General

Malware Config

Signatures

File Explorer

e08412673407254f52ea7bc40fbc3bf6_JaffaCakes118

msvcrt

api-ms-win-core-processthreads-l1-1-0

kernel32

ntdll

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

rpcrt4

generic