f5fc0244fac4d1134685531500b89a07_JaffaCakes118

General

Target
f5fc0244fac4d1134685531500b89a07_JaffaCakes118
Size 11.7MB
Sample240417-rtqj2sca36
SHA256 914014bdfa54711f0be7ff00b7438aa023468c87494e7ec207ae9f3e543f3d69
MD5 f5fc0244fac4d1134685531500b89a07
SHA1 5e378f0c50c6680eb17f41939ea0e2859a16cf46
SHA512 f1d3e9924913692e495c3268814202b6d6c6598cdbcde0b21f9b34f058a25ef744f8bc814bb7a2df1c73ea25a659e7a1ed2bd77b9be83742e0870875b334c769
SSDEEP 12288:TRXQK44fy611111111111111111111111111111111111111111111111111111H:TRx2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5fc0244fac4d1134685531500b89a07_JaffaCakes118

File Explorer

f5fc0244fac4d1134685531500b89a07_JaffaCakes118

.exe 11.7MB

f5fc0244fac4d1134685531500b89a07_JaffaCakes118

IMPHASH 7799a59ba272e2d352ce8955d6600f5f
SHA256 914014bdfa54711f0be7ff00b7438aa023468c87494e7ec207ae9f3e543f3d69
MD5 f5fc0244fac4d1134685531500b89a07
SHA1 5e378f0c50c6680eb17f41939ea0e2859a16cf46
SHA512 f1d3e9924913692e495c3268814202b6d6c6598cdbcde0b21f9b34f058a25ef744f8bc814bb7a2df1c73ea25a659e7a1ed2bd77b9be83742e0870875b334c769
SSDEEP 12288:TRXQK44fy611111111111111111111111111111111111111111111111111111H:TRx2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

25156

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

C:\jev-yuxec.pdb

kernel32

ExpandEnvironmentStringsA GetNumaProcessorNode lstrlenA FindClose LocalAlloc ExitThread GetVolumePathNamesForVolumeNameA GetLastError LoadLibraryA lstrcatW GetCommState TerminateProcess GetProcessHeaps CreateThread GetCurrencyFormatW SetThreadIdealProcessor GetWindowsDirectoryW GetProcAddress ExitProcess TlsGetValue _lclose DosDateTimeToFileTime GetTickCount IsDebuggerPresent VirtualQueryEx GetNumberOfConsoleMouseButtons lstrcpyA GetHandleInformation UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW SetLastError RtlUnwind RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc CloseHandle FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer CreateFileW

Name

.text

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

168KB

Virtual Size

47.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11.4MB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f5fc0244fac4d1134685531500b89a07_JaffaCakes118

kernel32

generic