eaeb3d87132987c5f27f9159c4687fb8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
eaeb3d87132987c5f27f9159c4687fb8_JaffaCakes118
Size 321KB
Sample240410-m55qwsdd85
SHA256 885b28f8e96eea72a53293cd5b5725851e3b1174a970d57fa045ebca0e856a7d
MD5 eaeb3d87132987c5f27f9159c4687fb8
SHA1 1f2884dcbbe93fa83b1098153286a326a4567dfe
SHA512 182b4cb9714125d219426f279ed056c37a7f7b6dc0e08452ea533143bf5633efcb922da6f9bc8af3c367ca66f5605ad3a36e2b25c3efcffda4e8d3ac9c67d004
SSDEEP 6144:iB0FBEbiIGEY724Z0aJe7plFdEz7nQW09YCs0os:y4FZEY724ZzJ+plOQB9YNX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eaeb3d87132987c5f27f9159c4687fb8_JaffaCakes118

File Explorer

eaeb3d87132987c5f27f9159c4687fb8_JaffaCakes118

.dll 321KB

eaeb3d87132987c5f27f9159c4687fb8_JaffaCakes118

IMPHASH 64bde65dcd30225ffb25b89a1cf33031
SHA256 885b28f8e96eea72a53293cd5b5725851e3b1174a970d57fa045ebca0e856a7d
MD5 eaeb3d87132987c5f27f9159c4687fb8
SHA1 1f2884dcbbe93fa83b1098153286a326a4567dfe
SHA512 182b4cb9714125d219426f279ed056c37a7f7b6dc0e08452ea533143bf5633efcb922da6f9bc8af3c367ca66f5605ad3a36e2b25c3efcffda4e8d3ac9c67d004
SSDEEP 6144:iB0FBEbiIGEY724Z0aJe7plFdEz7nQW09YCs0os:y4FZEY724ZzJ+plOQB9YNX
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

154984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryExW GetModuleHandleW RaiseException GetModuleFileNameW EnterCriticalSection InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement LeaveCriticalSection LockResource GetThreadLocale SetThreadLocale CreateFileW FindResourceW CloseHandle BeginUpdateResourceW UpdateResourceW EndUpdateResourceW lstrlenA GetTickCount GetExitCodeThread Sleep TerminateThread LoadResource SizeofResource MultiByteToWideChar lstrcmpiW GetLastError WideCharToMultiByte lstrlenW GetProcAddress LoadLibraryW WriteFile FreeLibrary GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA RtlUnwind LoadLibraryA InterlockedExchange GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetOEMCP GetACP GetCPInfo GetModuleFileNameA GetStdHandle VirtualAlloc VirtualFree HeapCreate HeapFree HeapReAlloc HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread GetCurrentThreadId CreateThread GetCommandLineA GetVersionExA GetProcessHeap GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess HeapDestroy

user32

UnregisterClassA MessageBoxW PostMessageW CharNextW

advapi32

IsTextUnicode RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegQueryValueExW

ole32

CoTaskMemFree CoGetClassObject StringFromGUID2 CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc

oleaut32

UnRegisterTypeLi VarUI4FromStr SysAllocString SysStringByteLen SysAllocStringByteLen VarBstrCmp SysStringLen SysFreeString LoadRegTypeLi LoadTypeLi SysAllocStringLen VarBstrCat RegisterTypeLi VariantClear

rpcrt4

IUnknown_QueryInterface_Proxy NdrOleFree NdrStubForwardingFunction NdrOleAllocate NdrDllRegisterProxy NdrDllCanUnloadNow IUnknown_Release_Proxy NdrCStdStubBuffer2_Release IUnknown_AddRef_Proxy NdrDllGetClassObject NdrDllUnregisterProxy

Name

.text

Size

188KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

177B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shr

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eaeb3d87132987c5f27f9159c4687fb8_JaffaCakes118

kernel32

user32

advapi32

ole32

oleaut32

rpcrt4

generic