e9b2cf13770038c1121a41ea15e45b1a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
e9b2cf13770038c1121a41ea15e45b1a_JaffaCakes118
Size 52KB
Sample240409-llvadafb2v
SHA256 4e31bf014b79cd82df3027fd277beded2b2aec026ab27b2b4302c7aaecddc42f
MD5 e9b2cf13770038c1121a41ea15e45b1a
SHA1 1301db7d614083883fb40d8d8d3ba79bda5f5976
SHA512 e8a9860f9b079efcb0ea4aa9b952597dd758c67cc372ca2a4741f18000f1639a9904413faf16288dc3dd2203c1c6c8e92ad400a8dc26b33f4da0dca3e9aa7fb9
SSDEEP 1536:CTUY6gdWLq2+aGTlFVkl1fGmijtCkNrgp:RedDaCe1f/cN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9b2cf13770038c1121a41ea15e45b1a_JaffaCakes118

File Explorer

e9b2cf13770038c1121a41ea15e45b1a_JaffaCakes118

.dll 52KB

e9b2cf13770038c1121a41ea15e45b1a_JaffaCakes118

IMPHASH 22b508364ba465018c8451bfc69d9c8c
SHA256 4e31bf014b79cd82df3027fd277beded2b2aec026ab27b2b4302c7aaecddc42f
MD5 e9b2cf13770038c1121a41ea15e45b1a
SHA1 1301db7d614083883fb40d8d8d3ba79bda5f5976
SHA512 e8a9860f9b079efcb0ea4aa9b952597dd758c67cc372ca2a4741f18000f1639a9904413faf16288dc3dd2203c1c6c8e92ad400a8dc26b33f4da0dca3e9aa7fb9
SSDEEP 1536:CTUY6gdWLq2+aGTlFVkl1fGmijtCkNrgp:RedDaCe1f/cN
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33147

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcessId GetCommandLineW CreateDirectoryA CloseHandle Process32Next Process32First CreateThread GetProcAddress LoadLibraryA FreeLibrary Sleep MoveFileA WritePrivateProfileStringA RemoveDirectoryA DisableThreadLibraryCalls InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement HeapDestroy GetShortPathNameA GetModuleHandleA GetExitCodeProcess WaitForSingleObject CreateProcessA EnterCriticalSection LeaveCriticalSection ExitProcess GetModuleFileNameA WideCharToMultiByte lstrlenW lstrlenA MultiByteToWideChar FindFirstFileA GetPrivateProfileStringA SetFileAttributesA DeleteFileA LocalFree FindNextFileA GetSystemDirectoryA

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyExA RegQueryInfoKeyA RegEnumKeyExA RegCloseKey GetNamedSecurityInfoA BuildExplicitAccessWithNameA SetEntriesInAclA SetNamedSecurityInfoA RegDeleteKeyA RegCreateKeyExA

shell32

SHGetSpecialFolderPathA CommandLineToArgvW

ole32

CoMarshalInterThreadInterfaceInStream CoUninitialize CoGetInterfaceAndReleaseStream CoInitialize CoCreateInstance

oleaut32

SysStringLen LoadRegTypeLi SysFreeString SysAllocString VariantClear

msvcrt

strcpy _strlwr _strupr _adjust_fdiv malloc _initterm free fopen fseek ftell fread fclose strcmp _purecall _wcslwr wcsstr memset strstr strrchr sprintf strcat ??3@YAXPAX@Z memcmp memcpy atoi strchr _stricmp _access strncpy strncmp strlen ??2@YAPAXI@Z

shlwapi

SHDeleteValueA SHSetValueA SHDeleteKeyA

Sharing

General

Malware Config

Signatures

File Explorer

e9b2cf13770038c1121a41ea15e45b1a_JaffaCakes118

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

generic