f31d9eae28788bd1626e87d3ee74bc16_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
f31d9eae28788bd1626e87d3ee74bc16_JaffaCakes118
Size 472KB
Sample240416-kme2eafe2y
SHA256 b754fe835c863c379a36fdd42ee84564f7b8a5ba3a7d286d1fa80a9e0f2d2161
MD5 f31d9eae28788bd1626e87d3ee74bc16
SHA1 a7b95c7ada679be87260c7f1be11f99350e6d6bf
SHA512 c3f95923bb7f862c0ca021819970cbb702483a9699fab1ec21e9e0b7657278cadf6166eacc597dcef27aaec01c530e26384f73b94e32097ac90f31d3536f3c05
SSDEEP 12288:WIx3n4BiTNvjL81yCelVmFxQwMDrEOgyuzafIAbeLUH24z17o8:WIx3JNLLaelhrDBMafIAbXj1c
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f31d9eae28788bd1626e87d3ee74bc16_JaffaCakes118

File Explorer

f31d9eae28788bd1626e87d3ee74bc16_JaffaCakes118

.dll 472KB

f31d9eae28788bd1626e87d3ee74bc16_JaffaCakes118

IMPHASH edd428181b8f1f04c0578b723d9a5ef0
SHA256 b754fe835c863c379a36fdd42ee84564f7b8a5ba3a7d286d1fa80a9e0f2d2161
MD5 f31d9eae28788bd1626e87d3ee74bc16
SHA1 a7b95c7ada679be87260c7f1be11f99350e6d6bf
SHA512 c3f95923bb7f862c0ca021819970cbb702483a9699fab1ec21e9e0b7657278cadf6166eacc597dcef27aaec01c530e26384f73b94e32097ac90f31d3536f3c05
SSDEEP 12288:WIx3n4BiTNvjL81yCelVmFxQwMDrEOgyuzafIAbeLUH24z17o8:WIx3JNLLaelhrDBMafIAbXj1c
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

63989

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetFileAttributesA InterlockedIncrement GetLastError CreateDirectoryA GetFileAttributesA SetFileTime MoveFileA WriteFile GetFileSize GetTickCount CreateFileA SetFilePointer FlushFileBuffers EnterCriticalSection LeaveCriticalSection Sleep LockResource LoadResource SizeofResource FindResourceA GetCurrentThreadId lstrlenW GetModuleHandleA GetModuleFileNameA WideCharToMultiByte FreeLibrary LoadLibraryExA lstrcmpiA lstrcpynA IsDBCSLeadByte GetCommandLineA FindClose FindFirstFileA GetVolumeInformationA CopyFileA lstrcmpA FindNextFileA lstrcatA lstrcpyA GetProcAddress LoadLibraryA OpenMutexA OpenProcess Process32Next Process32First CreateToolhelp32Snapshot DeviceIoControl SetEndOfFile GetLocaleInfoW SetStdHandle MoveFileExA DeleteFileA GetWindowsDirectoryA GetSystemDirectoryA GetShortPathNameA WinExec CreateEventA GetFullPathNameA CreateProcessA WaitForSingleObject CloseHandle MultiByteToWideChar InterlockedDecrement lstrlenA DeleteCriticalSection InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange IsBadCodePtr IsBadReadPtr IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA UnhandledExceptionFilter CreateFileMappingA GetEnvironmentVariableA ExitProcess RtlUnwind HeapFree HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc LCMapStringA LCMapStringW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue SetUnhandledExceptionFilter HeapDestroy HeapCreate VirtualFree IsBadWritePtr TerminateProcess GetCurrentProcess HeapSize GetOEMCP ReadFile SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW

user32

LoadStringA DestroyWindow CharNextA DefWindowProcA

advapi32

InitializeSecurityDescriptor RegCloseKey OpenProcessToken RegEnumKeyExA RegDeleteValueA RegCreateKeyExA RegDeleteKeyA OpenSCManagerA OpenServiceA ChangeServiceConfigA StartServiceA QueryServiceStatus CloseServiceHandle GetUserNameA CreateProcessAsUserA SetSecurityDescriptorDacl RegOpenKeyA RegQueryValueExA RegSetValueExA RegOpenKeyExA RegQueryInfoKeyA

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoUninitialize CoCreateInstance CoTaskMemFree

oleaut32

VarUI4FromStr

setupapi

SetupIterateCabinetA

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

f31d9eae28788bd1626e87d3ee74bc16_JaffaCakes118

kernel32

user32

advapi32

ole32

oleaut32

setupapi

comctl32

generic