ef548e7c9e1effbea1d8347984974dfa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ef548e7c9e1effbea1d8347984974dfa_JaffaCakes118
Size 12.9MB
Sample240414-x63m2aed5s
SHA256 e46edab1478c55992acc8490b60ae5fba16155c3ba738641f2618247314535d0
MD5 ef548e7c9e1effbea1d8347984974dfa
SHA1 0766d1b260c116b2489fec43673b1d6e50a22139
SHA512 69f1c10cd855eb02407b15f4033855cd03475477974b1b5ced7c5751a537aa71f90e52c78b40c21e297e20c5a4f91738ba57a5029d4f632cf78724dc3540b3c5
SSDEEP 49152:UQsPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPn:UQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef548e7c9e1effbea1d8347984974dfa_JaffaCakes118

File Explorer

ef548e7c9e1effbea1d8347984974dfa_JaffaCakes118

.exe 12.9MB

ef548e7c9e1effbea1d8347984974dfa_JaffaCakes118

IMPHASH 884a6cc0756a2248c9ad01f883000702
SHA256 e46edab1478c55992acc8490b60ae5fba16155c3ba738641f2618247314535d0
MD5 ef548e7c9e1effbea1d8347984974dfa
SHA1 0766d1b260c116b2489fec43673b1d6e50a22139
SHA512 69f1c10cd855eb02407b15f4033855cd03475477974b1b5ced7c5751a537aa71f90e52c78b40c21e297e20c5a4f91738ba57a5029d4f632cf78724dc3540b3c5
SSDEEP 49152:UQsPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPn:UQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15283

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xezosus hiva3\tegofujusur-riw.pdb

kernel32

OpenEventA GetDiskFreeSpaceA WTSGetActiveConsoleSessionId LocalAlloc VirtualProtect GetFileAttributesExW CloseHandle PeekConsoleInputW GetProcAddress GetShortPathNameA GlobalAlloc GetNumberFormatA GetModuleHandleW GetSystemDefaultLCID lstrlenA TryEnterCriticalSection SetConsoleTitleW GlobalMemoryStatus EncodePointer DecodePointer GetCommandLineW RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection FlushFileBuffers GetLastError WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode DeleteCriticalSection FatalAppExitA ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar HeapSize ReadFile ReadConsoleW HeapFree HeapAlloc SetLastError GetCurrentThread GetCurrentThreadId GetProcessHeap GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CreateSemaphoreW SetStdHandle SetFilePointerEx WriteConsoleW SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapReAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW GetStringTypeW CreateFileW SetEndOfFile

advapi32

RegOpenKeyA RegSetKeySecurity RegLoadKeyA AreAllAccessesGranted RegDeleteKeyW LockServiceDatabase RegCreateKeyExW RegUnLoadKeyA SetThreadToken AreAnyAccessesGranted

Name

.text

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.juyuv

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ceyiba

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12.6MB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ef548e7c9e1effbea1d8347984974dfa_JaffaCakes118

kernel32

advapi32

generic