f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118

General

Target
f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118
Size 12.9MB
Sample240417-bysxzaaa47
SHA256 683fa1172ed26a953994f43177ceff28ee665a14736e73fc6f91f9fe330545a0
MD5 f4c26a587ceedc4e1f881db4635d2e46
SHA1 222207a71d9e9e3eb534b4fdbd644e848f1c24e0
SHA512 722be7f412946c0b4a29b611afea11f0d5ca8b4d3263904299a2102a7a58dd1cb5a115f56a298820ade78b89c229e372189648db33de1cd2c13a8b09cc2a2463
SSDEEP 196608:vV8YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY/:
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118

File Explorer

f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118

.exe 12.9MB

f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118

IMPHASH ed103d03110ecdb36297492051b4e917
SHA256 683fa1172ed26a953994f43177ceff28ee665a14736e73fc6f91f9fe330545a0
MD5 f4c26a587ceedc4e1f881db4635d2e46
SHA1 222207a71d9e9e3eb534b4fdbd644e848f1c24e0
SHA512 722be7f412946c0b4a29b611afea11f0d5ca8b4d3263904299a2102a7a58dd1cb5a115f56a298820ade78b89c229e372189648db33de1cd2c13a8b09cc2a2463
SSDEEP 196608:vV8YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY/:
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mehesaveromoke\zeh.pdb

kernel32

GetFileSize WriteConsoleInputW SetLocalTime GetDriveTypeW SetEndOfFile GetNumberOfConsoleInputEvents FindResourceExW MapUserPhysicalPages InterlockedIncrement GetQueuedCompletionStatus GetCommState InterlockedDecrement ScrollConsoleScreenBufferW SetComputerNameW CallNamedPipeW GetModuleHandleW GetSystemWow64DirectoryA WriteFileGather CreateDirectoryExW TlsSetValue GlobalAlloc GetVolumeInformationA Sleep GetSystemTimeAdjustment GlobalFlags Beep VerifyVersionInfoA IsDBCSLeadByte ReadFile CreateFileW GetBinaryTypeW CompareStringW GetACP lstrlenW GetConsoleOutputCP VerifyVersionInfoW CreateDirectoryA FindFirstFileA OpenMutexW GetProcAddress GlobalFix WriteProfileSectionA ReadFileEx SetStdHandle CreateMemoryResourceNotification SearchPathA GetPrivateProfileStringA SetFileApisToOEM GetAtomNameA Process32FirstW OpenWaitableTimerW IsSystemResumeAutomatic GetCommMask AddAtomA GetSystemInfo SetSystemTime EnumResourceTypesW SetConsoleCursorInfo SetConsoleTitleW GetModuleHandleA FreeEnvironmentStringsW EnumResourceNamesA GetConsoleTitleW BuildCommDCBA GetCurrentDirectoryA CompareStringA SetCalendarInfoA GetVersionExA GetWindowsDirectoryW GetCurrentProcessId InterlockedPushEntrySList GetProfileSectionW SuspendThread LCMapStringW CopyFileExA DeleteFileA SetVolumeLabelW GetCommandLineW GetStartupInfoW HeapValidate IsBadReadPtr RaiseException LeaveCriticalSection EnterCriticalSection GetLastError GetFileType WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime ExitProcess GetEnvironmentStringsW SetHandleCount GetStdHandle GetStartupInfoA TlsGetValue TlsAlloc TlsFree SetLastError HeapDestroy HeapCreate HeapFree VirtualFree GetModuleFileNameA HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetOEMCP GetCPInfo IsValidCodePage InitializeCriticalSectionAndSpinCount WriteConsoleA WriteConsoleW MultiByteToWideChar SetFilePointer RtlUnwind DebugBreak OutputDebugStringA OutputDebugStringW LoadLibraryW LoadLibraryA LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA CloseHandle FlushFileBuffers

user32

GetMenuInfo GetComboBoxInfo GetMenuBarInfo

advapi32

InitiateSystemShutdownW

Sharing

General

Malware Config

Signatures

File Explorer

f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118

kernel32

user32

advapi32

generic