e464218ac22202be3b93aee8fef3e8b4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
e464218ac22202be3b93aee8fef3e8b4_JaffaCakes118
Size 420KB
Sample240407-jb265agd74
SHA256 652e1d6e2c9ae99f3542c203905a685df7f4a28e25e5af088d7b6da30ba56ba2
MD5 e464218ac22202be3b93aee8fef3e8b4
SHA1 5cb26d89a3fa50b81b8b720881724d803551f11b
SHA512 53af91ae2419e77ed3d874f7d0669589f84e9200ed7f76f4e0a91d6a060763d82ccb04c0cf33bbeefe104f9ba4b64ade6e996d500eb43f604016e2f060bb72eb
SSDEEP 12288:l0IcSBrNDNemFusFdTZm553AgPuK+Gy/ld:l0eBremFFdTk5DGdd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e464218ac22202be3b93aee8fef3e8b4_JaffaCakes118

File Explorer

e464218ac22202be3b93aee8fef3e8b4_JaffaCakes118

.exe 420KB

e464218ac22202be3b93aee8fef3e8b4_JaffaCakes118

IMPHASH 8d5844fd312e4b4de80e5a985c8df3ac
SHA256 652e1d6e2c9ae99f3542c203905a685df7f4a28e25e5af088d7b6da30ba56ba2
MD5 e464218ac22202be3b93aee8fef3e8b4
SHA1 5cb26d89a3fa50b81b8b720881724d803551f11b
SHA512 53af91ae2419e77ed3d874f7d0669589f84e9200ed7f76f4e0a91d6a060763d82ccb04c0cf33bbeefe104f9ba4b64ade6e996d500eb43f604016e2f060bb72eb
SSDEEP 12288:l0IcSBrNDNemFusFdTZm553AgPuK+Gy/ld:l0eBremFFdTk5DGdd
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

PerfHost.pdb

msvcrt

_initterm __setusermatherr __p__fmode _cexit _exit exit _amsg_exit __set_app_type free _vsnwprintf __wgetmainargs __p__commode __CxxFrameHandler3 malloc _callnewh memcpy _except_handler4_common _controlfp _XcptFilter ?terminate@@YAXXZ memset

ntdll

NtClose NtQueryInformationToken RtlNtStatusToDosError NtOpenThreadToken EtwEventWrite RtlExpandEnvironmentStrings EtwEventRegister RtlReleaseSRWLockShared RtlAcquireSRWLockShared RtlReleaseSRWLockExclusive RtlAcquireSRWLockExclusive EtwEventUnregister

rpcrt4

RpcEpRegisterW RpcRevertToSelf RpcServerInqBindings RpcServerRegisterIfEx RpcServerUseProtseqW RpcServerUnregisterIf RpcBindingVectorFree RpcEpUnregister RpcStringFreeW RpcStringBindingParseW RpcBindingToStringBindingW RpcBindingInqAuthClientW RpcImpersonateClient NdrServerCall2

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetProcAddress FreeLibrary LoadLibraryExW

api-ms-win-core-registry-l1-1-0

RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegCloseKey

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess TerminateProcess GetCurrentProcessId GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-synch-l1-1-0

InitializeSRWLock

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork CreateThreadpoolWork SubmitThreadpoolWork

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus

Sharing

General

Malware Config

Signatures

File Explorer

e464218ac22202be3b93aee8fef3e8b4_JaffaCakes118

msvcrt

ntdll

rpcrt4

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-service-core-l1-1-0

generic