f6b5db9a551a3d0b5324f1c13b111e5f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
f6b5db9a551a3d0b5324f1c13b111e5f_JaffaCakes118
Size 415KB
Sample240417-2ebsfsgc23
SHA256 c65ef76afe470ee6374c040d3f071d3300e44bef5e0482aad151fe112a94ed02
MD5 f6b5db9a551a3d0b5324f1c13b111e5f
SHA1 cfcd537a75ddb73deaf213b4d0b7a49df2ce83af
SHA512 d51b0c9deba0c972f46d059ad75d040eafaee22f418c8efb38b5a60a16cbaa174d2518e20257e2048867b8541d32433ad6016fa901fb0df30d6b2ae82e677302
SSDEEP 12288:Mr0yKsiwOby+2ksy6cNccOerid8Z198x:Mr0yKsiwQe2ccOerWK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6b5db9a551a3d0b5324f1c13b111e5f_JaffaCakes118

File Explorer

f6b5db9a551a3d0b5324f1c13b111e5f_JaffaCakes118

.exe 415KB

f6b5db9a551a3d0b5324f1c13b111e5f_JaffaCakes118

IMPHASH 58e185299ecca757fe68ba83a6495fde
SHA256 c65ef76afe470ee6374c040d3f071d3300e44bef5e0482aad151fe112a94ed02
MD5 f6b5db9a551a3d0b5324f1c13b111e5f
SHA1 cfcd537a75ddb73deaf213b4d0b7a49df2ce83af
SHA512 d51b0c9deba0c972f46d059ad75d040eafaee22f418c8efb38b5a60a16cbaa174d2518e20257e2048867b8541d32433ad6016fa901fb0df30d6b2ae82e677302
SSDEEP 12288:Mr0yKsiwOby+2ksy6cNccOerid8Z198x:Mr0yKsiwQe2ccOerWK
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

msvcrt

__wgetmainargs _exit _XcptFilter exit _initterm _amsg_exit __setusermatherr memcpy _controlfp _except_handler4_common ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode _cexit

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetCurrentProcess OpenProcessToken GetCurrentProcessId GetCurrentThreadId

kernel32

LocalAlloc CloseHandle DelayLoadFailureHook GetProcAddress GetLastError FreeLibrary InterlockedCompareExchange LoadLibraryExA InterlockedExchange Sleep SetUnhandledExceptionFilter GetModuleHandleA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime UnhandledExceptionFilter DeactivateActCtx LoadLibraryExW ActivateActCtx LeaveCriticalSection lstrcmpW EnterCriticalSection RegCloseKey RegOpenKeyExW HeapSetInformation lstrcmpiW lstrlenW LCMapStringW RegQueryValueExW ReleaseActCtx CreateActCtxW ExpandEnvironmentStringsW GetCommandLineW ExitProcess SetProcessAffinityUpdateMode RegDisablePredefinedCacheEx InitializeCriticalSection GetProcessHeap SetErrorMode RegisterWaitForSingleObjectEx LocalFree HeapFree WideCharToMultiByte HeapAlloc

ntdll

RtlAllocateHeap RtlLengthRequiredSid RtlSubAuthoritySid RtlInitializeSid RtlCopySid RtlSubAuthorityCountSid RtlInitializeCriticalSection RtlSetProcessIsCritical RtlImageNtHeader RtlUnhandledExceptionFilter EtwEventWrite EtwEventEnabled EtwEventRegister RtlFreeHeap

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl AddAccessAllowedAce SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetTokenInformation InitializeSecurityDescriptor GetLengthSid InitializeAcl

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

rpcrt4

RpcMgmtSetServerStackSize I_RpcMapWin32Status RpcServerUnregisterIf RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcServerUnregisterIfEx RpcServerRegisterIf RpcServerUseProtseqEpW RpcServerListen

Sharing

General

Malware Config

Signatures

File Explorer

f6b5db9a551a3d0b5324f1c13b111e5f_JaffaCakes118

msvcrt

api-ms-win-core-processthreads-l1-1-0

kernel32

ntdll

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

rpcrt4

generic