e5ff5f9d2345eb5fe47e5cb809d5a20b_JaffaCakes118

General

Target
e5ff5f9d2345eb5fe47e5cb809d5a20b_JaffaCakes118
Size 96KB
Sample240407-2ca35sgc5v
SHA256 480c07c961f3f823edee54d80622c155ca9361fa6fb691853c56362cb50fcb13
MD5 e5ff5f9d2345eb5fe47e5cb809d5a20b
SHA1 f7abed3d9f4fa7763681f64487b63ad8fb6689a9
SHA512 856e3c69ac303e75a13efe0954233a0af6bef00b28e056aee5ad0b7356ba98679fa4395ad96d68f4a74cd6d9680de2b8d9ebf9c98ed53bc3f656a985cda6fd65
SSDEEP 1536:JDeBq3rgevj+idiZTUvujUx8nHXB1UO4Veow8uDzZYK:JDgq3rgyj+vkzxSx1qVeoRu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e5ff5f9d2345eb5fe47e5cb809d5a20b_JaffaCakes118

File Explorer

e5ff5f9d2345eb5fe47e5cb809d5a20b_JaffaCakes118

.dll 96KB

e5ff5f9d2345eb5fe47e5cb809d5a20b_JaffaCakes118

IMPHASH f12681750a52fcb36b4f4352acca77bf
SHA256 480c07c961f3f823edee54d80622c155ca9361fa6fb691853c56362cb50fcb13
MD5 e5ff5f9d2345eb5fe47e5cb809d5a20b
SHA1 f7abed3d9f4fa7763681f64487b63ad8fb6689a9
SHA512 856e3c69ac303e75a13efe0954233a0af6bef00b28e056aee5ad0b7356ba98679fa4395ad96d68f4a74cd6d9680de2b8d9ebf9c98ed53bc3f656a985cda6fd65
SSDEEP 1536:JDeBq3rgevj+idiZTUvujUx8nHXB1UO4Veow8uDzZYK:JDgq3rgyj+vkzxSx1qVeoRu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLocalTime CreateSemaphoreA TerminateThread WaitForSingleObject ReleaseSemaphore WriteFile ReadFile CreateFileA DeleteFileA SetFileAttributesA GetModuleFileNameA GetDriveTypeA GetLastError WinExec CreateProcessA FindClose FindNextFileA FindFirstFileA SetFilePointer SetEvent GetComputerNameA GetFileSize MoveFileA GetSystemDirectoryA CreateDirectoryA GetModuleHandleA GetCurrentProcessId GetWindowsDirectoryA GetVersion lstrcpyA lstrlenA GetModuleFileNameW MultiByteToWideChar VirtualFreeEx CreateRemoteThread WriteProcessMemory VirtualAllocEx lstrlenW FlushFileBuffers GetProcAddress CreateThread Sleep LocalAlloc LocalFree OpenProcess TerminateProcess CreateEventA CloseHandle VirtualFree VirtualAlloc LCMapStringW ReadProcessMemory lstrcmpiW lstrcmpiA WideCharToMultiByte RtlUnwind GetCommandLineA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ExitProcess GetCPInfo GetACP GetOEMCP LCMapStringA GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue HeapFree HeapAlloc GetCurrentProcess HeapReAlloc HeapSize SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate GetStringTypeA GetStringTypeW InterlockedDecrement InterlockedIncrement SetUnhandledExceptionFilter IsBadReadPtr IsBadWritePtr IsBadCodePtr LoadLibraryA SetStdHandle RaiseException

ole32

CoCreateGuid

ws2_32

send recv socket htons inet_addr connect WSAGetLastError closesocket WSAStartup

advapi32

RegCreateKeyA RegSetValueExA RegDeleteKeyA RegEnumKeyExA RegCloseKey RegOpenKeyExA RegDeleteValueA RegQueryValueExA

Name

.text

Size

48KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PrcWorks

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e5ff5f9d2345eb5fe47e5cb809d5a20b_JaffaCakes118

kernel32

ole32

ws2_32

advapi32

generic