f1fef622821788beb88015c369117693_JaffaCakes118

General

Target
f1fef622821788beb88015c369117693_JaffaCakes118
Size 13.1MB
Sample240415-1mphvabc8w
SHA256 94f8d13f54940706972abc5eac4ce0c559fafa2b4c9f17ce14fe2e368ee5a203
MD5 f1fef622821788beb88015c369117693
SHA1 63b323c8ca7c73beec434ba9f30d98dc4bec9e87
SHA512 d08c4c2a533bcc40e139ec15e2edc45d9d16cdd3c9a317f545a9e7affb881c2776097c6ccde17deb303adefeb86f36eea9142713012bca2ec2c2dc6219b37aaa
SSDEEP 98304:12UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUk:1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1fef622821788beb88015c369117693_JaffaCakes118

File Explorer

f1fef622821788beb88015c369117693_JaffaCakes118

.exe 13.1MB

f1fef622821788beb88015c369117693_JaffaCakes118

IMPHASH 5df7fcee9d56b838e7defe1e8f1c7195
SHA256 94f8d13f54940706972abc5eac4ce0c559fafa2b4c9f17ce14fe2e368ee5a203
MD5 f1fef622821788beb88015c369117693
SHA1 63b323c8ca7c73beec434ba9f30d98dc4bec9e87
SHA512 d08c4c2a533bcc40e139ec15e2edc45d9d16cdd3c9a317f545a9e7affb881c2776097c6ccde17deb303adefeb86f36eea9142713012bca2ec2c2dc6219b37aaa
SSDEEP 98304:12UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUk:1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAlloc GetSystemDirectoryW GetSystemWindowsDirectoryA DeleteVolumeMountPointW LeaveCriticalSection GetFileAttributesA SetConsoleMode Beep WritePrivateProfileSectionW GetTimeZoneInformation MultiByteToWideChar lstrlenW GetStdHandle GetLongPathNameW GetThreadLocale GetProcAddress CreateJobSet ReadFileEx RemoveDirectoryA PrepareTape GetVolumePathNameW CreateFileMappingA LocalAlloc IsWow64Process WritePrivateProfileStringA LockResource HeapLock FindNextFileA WriteProfileStringA GetModuleHandleA VirtualProtect GetConsoleCursorInfo OpenSemaphoreW AreFileApisANSI CommConfigDialogW ReadConsoleW ReadFile SetEndOfFile CreateFileW TlsSetValue GetDateFormatA GetWindowsDirectoryA ConvertFiberToThread GetTickCount GetCommProperties FindFirstFileExW FlushConsoleInputBuffer FindCloseChangeNotification InterlockedCompareExchange HeapFree CreateJobObjectW WritePrivateProfileSectionA GetStringTypeA lstrlenA DebugActiveProcess CreateMutexW GetFileSize FillConsoleOutputCharacterA GetTempFileNameW GetComputerNameA RegisterWaitForSingleObject WideCharToMultiByte EncodePointer DecodePointer EnterCriticalSection DeleteCriticalSection GetStringTypeW GetLastError GetCommandLineW GetCPInfo RaiseException RtlUnwind HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsFree GetStartupInfoW GetModuleHandleW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsDebuggerPresent GetProcessHeap GetCurrentThreadId ExitProcess GetModuleHandleExW HeapSize CloseHandle GetFileType GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetACP GetOEMCP HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx LoadLibraryExW SetStdHandle FlushFileBuffers OutputDebugStringW WriteConsoleW

user32

GetMenuInfo GetClipboardSequenceNumber GetMonitorInfoA

advapi32

QueryServiceStatus ConvertToAutoInheritPrivateObjectSecurity RegConnectRegistryA ReportEventW ObjectPrivilegeAuditAlarmW SetKernelObjectSecurity DuplicateTokenEx GetAce AddAuditAccessObjectAce RegEnumKeyExA PrivilegeCheck CreateServiceA EqualSid LookupAccountNameA RegQueryMultipleValuesW DeleteAce GetUserNameW OpenEventLogW ObjectOpenAuditAlarmA RegSetValueA LookupPrivilegeNameW

Sharing

General

Malware Config

Signatures

File Explorer

f1fef622821788beb88015c369117693_JaffaCakes118

kernel32

user32

advapi32

generic