f794482e6fcdac22d8a86e4cfe1c5fd1_JaffaCakes118

General

Target
f794482e6fcdac22d8a86e4cfe1c5fd1_JaffaCakes118
Size 503KB
Sample240418-jvpedafd89
SHA256 67e20fb330a04ed5016a2386014c472ddcdd7fff3d6d739ebe175e7f88861549
MD5 f794482e6fcdac22d8a86e4cfe1c5fd1
SHA1 709a945870e7dc02eb35d27907f277cb8ff46b55
SHA512 bae999b582683457e192f9f1bd607a4e8ebe61c0c97d8c3b2454506c6566047f7cea80d5b82e19b4a8f7ebe2fe3ee6fc536ae75aeb4e3c9e30b27f313a028046
SSDEEP 12288:I1dGAWfGXtAwbu8bfv0SiQ/DF/BYdRvipT0/I:I+kXvuyf8475BOKV0/I
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f794482e6fcdac22d8a86e4cfe1c5fd1_JaffaCakes118

File Explorer

f794482e6fcdac22d8a86e4cfe1c5fd1_JaffaCakes118

.exe 503KB

f794482e6fcdac22d8a86e4cfe1c5fd1_JaffaCakes118

IMPHASH 4b405a935ba1896da801696a6c1a4ade
SHA256 67e20fb330a04ed5016a2386014c472ddcdd7fff3d6d739ebe175e7f88861549
MD5 f794482e6fcdac22d8a86e4cfe1c5fd1
SHA1 709a945870e7dc02eb35d27907f277cb8ff46b55
SHA512 bae999b582683457e192f9f1bd607a4e8ebe61c0c97d8c3b2454506c6566047f7cea80d5b82e19b4a8f7ebe2fe3ee6fc536ae75aeb4e3c9e30b27f313a028046
SSDEEP 12288:I1dGAWfGXtAwbu8bfv0SiQ/DF/BYdRvipT0/I:I+kXvuyf8475BOKV0/I
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\difajehesagi\sobudixobuda.pdb

kernel32

GetComputerNameA lstrlenA LocalCompact MoveFileExW InterlockedDecrement WritePrivateProfileSectionA ReadConsoleOutputAttribute GetProfileStringW GetUserDefaultLCID SetEvent IsBadReadPtr GetConsoleAliasesLengthA ReadConsoleOutputA InitializeCriticalSection GetVolumePathNameW GetConsoleCP GetSystemWindowsDirectoryA InterlockedPopEntrySList LeaveCriticalSection lstrcpynW GetConsoleAliasW SetConsoleCursorPosition GetFileAttributesW WriteConsoleW ReadFile CreateFileW CreateActCtxA GetACP VerifyVersionInfoW GetLastError GetProcAddress PeekConsoleInputW EnumDateFormatsExA GetConsoleDisplayMode GetProcessId LocalAlloc DeleteTimerQueue DnsHostnameToComputerNameA CreateTapePartition GlobalGetAtomNameW WaitForMultipleObjects SetSystemTime SetEnvironmentVariableA SetConsoleTitleW GetModuleHandleA lstrcatW UpdateResourceW CancelTimerQueueTimer GetConsoleTitleW BuildCommDCBA VirtualProtect SetCalendarInfoA FindFirstVolumeA EndUpdateResourceA GetVersionExA AreFileApisANSI UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount VirtualAlloc HeapReAlloc HeapSize GetCPInfo GetOEMCP IsValidCodePage GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

RealGetWindowClassA

Sharing

General

Malware Config

Signatures

File Explorer

f794482e6fcdac22d8a86e4cfe1c5fd1_JaffaCakes118

kernel32

user32

generic