f21f4614358cdb18bcc75489077f6e50_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
f21f4614358cdb18bcc75489077f6e50_JaffaCakes118
Size 13.1MB
Sample240415-2yzcvsaf26
SHA256 7a975f0197744ff65ed0c6ab56576c5b40bf11176e6f43f9945072a9bb3660e0
MD5 f21f4614358cdb18bcc75489077f6e50
SHA1 3fbcc2f1bd4dce604cfb468ef882ce93388f1015
SHA512 95f8f87568983cc69a13b4d023520364e52ceb241474aeb1bd4a91b59d483b002653c15b0bb6b9b8aff76f363a305aabc03872696440f76f0e2e1e71431583c5
SSDEEP 49152:Yjrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrj:e
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f21f4614358cdb18bcc75489077f6e50_JaffaCakes118

File Explorer

f21f4614358cdb18bcc75489077f6e50_JaffaCakes118

.exe 13.1MB

f21f4614358cdb18bcc75489077f6e50_JaffaCakes118

IMPHASH 3b770c930332f681fc31290486bd58a3
SHA256 7a975f0197744ff65ed0c6ab56576c5b40bf11176e6f43f9945072a9bb3660e0
MD5 f21f4614358cdb18bcc75489077f6e50
SHA1 3fbcc2f1bd4dce604cfb468ef882ce93388f1015
SHA512 95f8f87568983cc69a13b4d023520364e52ceb241474aeb1bd4a91b59d483b002653c15b0bb6b9b8aff76f363a305aabc03872696440f76f0e2e1e71431583c5
SSDEEP 49152:Yjrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrj:e
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4100

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

DllRegisterServer FindExecutableA Shell_NotifyIconW StrRChrW SHGetDataFromIDListW DragQueryPoint ShellExecuteA SHGetDataFromIDListW DragQueryFileW ShellExecuteA SHGetFolderPathA Shell_NotifyIconW

comsvcs

RecycleSurrogate CoLoadServices CoLoadServices RecycleSurrogate SafeRef CoLoadServices RecycleSurrogate RecycleSurrogate CoEnterServiceDomain

cmpbk32

PhoneBookCopyFilter PhoneBookLoad PhoneBookLoad PhoneBookEnumCountries PhoneBookLoad

user32

LoadIconW LoadIconW LoadIconW PeekMessageA PostMessageA LoadIconW GetDlgItemTextW LoadCursorW GetDlgItemTextW GetPropW PostMessageA GetMessageW GetClassLongA DialogBoxParamW FindWindowA CreateDesktopA GetDlgItemTextW GetPropW CreateDesktopA DialogBoxParamW LoadMenuW DispatchMessageA LoadCursorW DialogBoxParamW

advapi32

RegSaveKeyW CryptSignHashW RegSaveKeyW RegLoadKeyW RegUnLoadKeyW RegRestoreKeyA OpenServiceA RegOpenKeyW RegOpenKeyW LogonUserW LogonUserW LogonUserW RegOpenKeyW InitializeSid

shlwapi

UrlIsW UrlGetLocationW UrlCompareW UrlIsW UrlCombineA UrlCompareW PathIsURLW PathIsRootA PathIsRootA UrlGetPartA PathIsRootA UrlCanonicalizeA UrlUnescapeA PathIsRootA

msimg32

AlphaBlend TransparentBlt TransparentBlt AlphaBlend AlphaBlend DllInitialize AlphaBlend GradientFill

kernel32

VirtualFree AddAtomW LoadLibraryA OpenFileMappingA TlsSetValue LoadLibraryW WriteConsoleA LoadLibraryA HeapAlloc AddAtomW FindFirstFileA LoadLibraryW GetCurrentProcess OpenFileMappingA MoveFileExA GetCurrentDirectoryA GetShortPathNameA GetSystemTime FindAtomA AllocConsole FindFirstFileA VirtualAlloc LoadLibraryW GetCurrentDirectoryA CreateSemaphoreA WaitForSingleObject FindAtomA RemoveDirectoryA WaitForSingleObject HeapAlloc

Sharing

General

Malware Config

Signatures

File Explorer

f21f4614358cdb18bcc75489077f6e50_JaffaCakes118

shell32

comsvcs

cmpbk32

user32

advapi32

shlwapi

msimg32

kernel32

generic