f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118

General

Target
f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118
Size 12.2MB
Sample240416-gp47jacg8v
SHA256 b2eb1eeaf6d84c8e877b366a85c7834453c04e63c0c027b0e014c62e42b69f07
MD5 f2d6bac2f4208d668b547848b5b846a6
SHA1 1dc64444c82eb91d175bd0490eb5147c959a5dca
SHA512 2efb885ca1f37d7789d6545d91ac50102f29179c84fef558e1a8655b50ba8b17eeb6d17019e535b4bed91a9841812c5701f8a6d497a652c2ed00b4506ae9146d
SSDEEP 49152:w7JggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggI:
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118

File Explorer

f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118

.exe 12.2MB

f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118

IMPHASH eb2409931607875e59e6f5b3470fa923
SHA256 b2eb1eeaf6d84c8e877b366a85c7834453c04e63c0c027b0e014c62e42b69f07
MD5 f2d6bac2f4208d668b547848b5b846a6
SHA1 1dc64444c82eb91d175bd0490eb5147c959a5dca
SHA512 2efb885ca1f37d7789d6545d91ac50102f29179c84fef558e1a8655b50ba8b17eeb6d17019e535b4bed91a9841812c5701f8a6d497a652c2ed00b4506ae9146d
SSDEEP 49152:w7JggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggI:
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

145227

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gon11\xahoyivavonayilene3\focesorefat12_sicomoyuje ju.pdb

kernel32

GetCommandLineA GetProcessTimes SetHandleCount TlsSetValue SetFileShortNameW GetFirmwareEnvironmentVariableA GetThreadSelectorEntry GetCalendarInfoW FormatMessageW GetFileAttributesA GetComputerNameExA WritePrivateProfileStructW GetTimeFormatW FindNextVolumeW SetTimeZoneInformation LocalReAlloc IsBadWritePtr GetGeoInfoA CreateActCtxA GetShortPathNameA GetConsoleOutputCP GetFileSizeEx InterlockedFlushSList GetCurrentDirectoryW GetLongPathNameW GetThreadLocale IsBadHugeWritePtr BackupWrite DefineDosDeviceW CreateTimerQueueTimer SetComputerNameA EnterCriticalSection EnumTimeFormatsA PrepareTape GetAtomNameA LoadLibraryA OpenMutexA CreateSemaphoreW LocalAlloc GetExitCodeThread LockResource AddAtomW OpenEventA HeapLock GetCommMask OpenJobObjectW EnumDateFormatsA lstrcmpiW GetModuleHandleA CancelTimerQueueTimer VirtualProtect OpenEventW OutputDebugStringA SetProcessShutdownParameters _lopen CloseHandle GetVolumeNameForVolumeMountPointW lstrcpyA CreateFileW ReadConsoleW ReadFile WriteConsoleW OutputDebugStringW GetCompressedFileSizeW SetFileTime FormatMessageA GetPrivateProfileStringW SetThreadUILanguage FreeEnvironmentStringsA GetSystemDefaultLCID GetFullPathNameW LockFile UpdateResourceA LoadResource FindResourceExW SetEndOfFile GetDriveTypeW GetConsoleAliasExesA CopyFileExW WritePrivateProfileStructA lstrlenA HeapCompact CreateTimerQueue DisableThreadLibraryCalls FlushFileBuffers SetStdHandle SetFilePointerEx GetConsoleMode GetConsoleCP WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer LeaveCriticalSection DeleteCriticalSection IsProcessorFeaturePresent GetLastError HeapFree GetCommandLineW GetCPInfo RaiseException RtlUnwind HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsDebuggerPresent ExitProcess GetModuleHandleExW AreFileApisANSI GetProcessHeap GetStdHandle GetFileType GetCurrentThreadId HeapSize GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetACP GetOEMCP HeapReAlloc LoadLibraryExW

user32

SetClassLongA GetWindowWord GetMonitorInfoA EnumClipboardFormats

advapi32

LookupPrivilegeNameA AccessCheckByTypeResultListAndAuditAlarmW ConvertToAutoInheritPrivateObjectSecurity RegConnectRegistryA GetUserNameA QueryServiceConfigA RegSaveKeyA RegOpenKeyExA GetNumberOfEventLogRecords ObjectDeleteAuditAlarmW RegQueryValueExW EqualSid RegisterServiceCtrlHandlerA EnumServicesStatusA ObjectPrivilegeAuditAlarmA SetThreadToken LookupPrivilegeNameW GetSidIdentifierAuthority InitiateSystemShutdownA CreateServiceW

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpSetStatusCallback WinHttpSetOption

Sharing

General

Malware Config

Signatures

File Explorer

f2d6bac2f4208d668b547848b5b846a6_JaffaCakes118

kernel32

user32

advapi32

winhttp

generic