e6008a5aba6231eca145cd709a41b498_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
e6008a5aba6231eca145cd709a41b498_JaffaCakes118
Size 1.6MB
Sample240407-2d3vjsgf32
SHA256 18d64df909c3178cd1f25cb6cb0e214941cc3031d1b56ecabf1fdf6f8a5d8eaa
MD5 e6008a5aba6231eca145cd709a41b498
SHA1 b37bb40c3f7b32161be818c973adb3766dab50c2
SHA512 98be9a8f563ecd2254632dcf5ff178961eca37501713e52611a13a8f0f373d4595893d60e993ee2eae3634ec45277f497a20aeb3203d981208a57cc272b17b3d
SSDEEP 49152:0QagM/VkLHwbwexxcTcoOfhc8AxOVnbw+ij/TtChjnbIs:LEVkLAxPo0c8hB9ijSjb5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

e6008a5aba6231eca145cd709a41b498_JaffaCakes118

.exe 1.6MB

e6008a5aba6231eca145cd709a41b498_JaffaCakes118

IMPHASH f2bfd9919363b5d1f6943d99e9886301
SHA256 18d64df909c3178cd1f25cb6cb0e214941cc3031d1b56ecabf1fdf6f8a5d8eaa
MD5 e6008a5aba6231eca145cd709a41b498
SHA1 b37bb40c3f7b32161be818c973adb3766dab50c2
SHA512 98be9a8f563ecd2254632dcf5ff178961eca37501713e52611a13a8f0f373d4595893d60e993ee2eae3634ec45277f497a20aeb3203d981208a57cc272b17b3d
SSDEEP 49152:0QagM/VkLHwbwexxcTcoOfhc8AxOVnbw+ij/TtChjnbIs:LEVkLAxPo0c8hB9ijSjb5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

63:92:05:f1:15:a5:7a:93:e6:13:c4:62:d5:7f:0c:af:2f:93:ab:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=W3i\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=W3i\, LLC,L=Sartell,ST=Minnesota,C=US

Chains

Apr 4, 2024

Minor OS version

Major OS version

Entry point

14548

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\winapps\Windows\MAIN\Installer.Desktop.Application\ReleaseNoMFC\FreezeWrapWin.pdb

comctl32

InitCommonControlsEx

kernel32

GetDiskFreeSpaceW LockFileEx GetTempPathW CreateFileW CreateFileMappingA GetDiskFreeSpaceA FormatMessageW DeleteFileW UnlockFileEx LockFile UnlockFile InterlockedCompareExchange UnmapViewOfFile MapViewOfFile GetFullPathNameW GetFileAttributesExW LoadLibraryW AreFileApisANSI MultiByteToWideChar GetPrivateProfileStringA GetPrivateProfileIntA CopyFileA SystemTimeToFileTime GetLocalTime WritePrivateProfileStringA WaitForSingleObject CreateMutexA ReleaseMutex RtlCaptureStackBackTrace SetUnhandledExceptionFilter GetTickCount GetCurrentThreadId Sleep GetLastError FindResourceExA FindResourceA LoadResource LockResource SizeofResource WideCharToMultiByte GetFileAttributesW SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetLocaleInfoA GetConsoleMode GetConsoleCP RtlUnwind GetStringTypeW GetStringTypeA QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException FormatMessageA GetModuleHandleA LocalAlloc lstrlenA LocalFree BeginUpdateResourceA HeapAlloc GetProcessHeap UpdateResourceA HeapFree EndUpdateResourceA LoadLibraryA EnumResourceNamesA EnumResourceLanguagesA FreeLibrary LoadLibraryExA GetUserDefaultUILanguage GetTempPathA FindFirstFileA FindNextFileA FindClose CreateDirectoryA GetSystemTime GetTempFileNameA DeleteFileA RemoveDirectoryA SetFileAttributesA GetFileAttributesA MoveFileA GetModuleFileNameA GetCurrentDirectoryA GetFullPathNameA GetLongPathNameA CloseHandle GetPrivateProfileSectionNamesA CreateProcessA OpenProcess CreateToolhelp32Snapshot Process32First Process32Next TerminateProcess GetExitCodeProcess Module32First Module32Next GetProcAddress GetCurrentProcessId VirtualQuery GetCurrentThread GetCurrentProcess CreateEventA WaitForSingleObjectEx ResetEvent SetEvent FileTimeToSystemTime GetTimeZoneInformation CreateFileA GetFileTime FileTimeToLocalFileTime TzSpecificLocalTimeToSystemTime GetFileSize ReadFile WriteFile SetFilePointer GetVersionExA GetSystemInfo GetWindowsDirectoryA GetSystemDirectoryA ExpandEnvironmentStringsA GlobalMemoryStatus WaitForMultipleObjects EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapReAlloc HeapSize GetModuleHandleW ExitProcess UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA ExitThread CreateThread GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime HeapCreate VirtualFree VirtualAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetStdHandle InitializeCriticalSectionAndSpinCount

user32

EnumWindows IsWindowEnabled GetWindowThreadProcessId FindWindowExA GetClassNameA EnumChildWindows GetSystemMetrics SystemParametersInfoA GetShellWindow FindWindowA GetDesktopWindow LoadCursorA CreateWindowExA GetClassInfoExA RegisterClassExA GetMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA CallWindowProcA DefWindowProcA SetCursor LoadStringA GetKeyboardState CreatePopupMenu DestroyMenu AppendMenuA TrackPopupMenu SendMessageA SetDlgItemTextA AdjustWindowRectEx OffsetRect SetClassLongA GetDC DrawIcon ReleaseDC GetMessagePos ScreenToClient DialogBoxParamA ClientToScreen SetWindowPos SetTimer KillTimer CreateDialogParamA EndDialog GetDlgItem SendMessageW GetDlgCtrlID ShowWindow EnableWindow SetForegroundWindow UpdateWindow GetSysColor GetSysColorBrush GetCursorPos PostQuitMessage LoadIconA IsIconic GetFocus SetFocus IsWindowVisible InvalidateRgn InvalidateRect MessageBoxExA MessageBoxA IsWindow SetWindowTextA GetWindowTextA GetWindowTextLengthA SetWindowLongA GetWindowLongA DestroyWindow LoadAcceleratorsA WaitForInputIdle ReleaseCapture MoveWindow GetClientRect GetWindowRect PostMessageA

shell32

Shell_NotifyIconA ShellExecuteExA SHGetSpecialFolderPathA

ole32

OleUninitialize CoInitializeSecurity OleInitialize CoCreateGuid StringFromGUID2 CoCreateInstance CoTaskMemFree CoInitialize CoUninitialize CoTaskMemAlloc CoInitializeEx

oleaut32

SafeArrayDestroy SafeArrayUnaccessData VariantClear VariantInit SysStringLen SysFreeString SysAllocStringLen VariantChangeType SysAllocString SafeArrayAccessData SafeArrayCreateVector

psapi

GetModuleFileNameExA EnumProcesses

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

userenv

ExpandEnvironmentStringsForUserA

wininet

InternetCloseHandle InternetReadFileExA InternetErrorDlg HttpQueryInfoA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA InternetConnectA InternetSetOptionA InternetSetStatusCallback InternetCrackUrlA InternetCanonicalizeUrlA InternetCombineUrlA InternetGetCookieA InternetSetCookieA InternetOpenA

shlwapi

UrlEscapeA SHDeleteEmptyKeyA PathRenameExtensionA PathCombineA PathStripPathA PathRemoveFileSpecA PathIsDirectoryEmptyA PathFindExtensionA

urlmon

IsValidURL

advapi32

RevertToSelf RegEnumValueA OpenProcessToken GetTokenInformation IsValidSid GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority SetTokenInformation LookupPrivilegeValueA DuplicateTokenEx ImpersonateLoggedOnUser GetLengthSid AdjustTokenPrivileges RegOpenCurrentUser RegOpenUserClassesRoot RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegDeleteValueA RegQueryInfoKeyA RegEnumKeyExA

gdi32

SetBkColor

comdlg32

GetOpenFileNameA

Name

.text

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

125KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

252KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-ti

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-de

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

275KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-de

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-ti

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e6008a5aba6231eca145cd709a41b498_JaffaCakes118

PE Signature issue

comctl32

kernel32

user32

shell32

ole32

oleaut32

psapi

version

userenv

wininet

shlwapi

urlmon

advapi32

gdi32

comdlg32

generic