f9498f5fe8f412424a85ef0fcae54cf7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
f9498f5fe8f412424a85ef0fcae54cf7_JaffaCakes118
Size 420KB
Sample240419-crdedafb4y
SHA256 05467163dda83b19071362d1925ec5eb40daa44590cbfe538803e40af91efdc0
MD5 f9498f5fe8f412424a85ef0fcae54cf7
SHA1 b7217a6255bf87b5a6b6462b5fd4b34fb33f6090
SHA512 e4f3685affd4a5172e06eb48f59b0e1b8c7505734150d6c1585edc5ae4ca16c536e73545cc2c8069563a0d762ee8f80c303c794f77b00272ccfc5e55db0b3bc0
SSDEEP 12288:tiWzzgNU9MdX2q4vx8d9OdLMZeJik0O+rtvBLbxOLTuT6nhJXbf:tdzzgNU2dX2nx8dELM1kmATuunhRb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9498f5fe8f412424a85ef0fcae54cf7_JaffaCakes118

File Explorer

f9498f5fe8f412424a85ef0fcae54cf7_JaffaCakes118

.exe 420KB

f9498f5fe8f412424a85ef0fcae54cf7_JaffaCakes118

IMPHASH 8d5844fd312e4b4de80e5a985c8df3ac
SHA256 05467163dda83b19071362d1925ec5eb40daa44590cbfe538803e40af91efdc0
MD5 f9498f5fe8f412424a85ef0fcae54cf7
SHA1 b7217a6255bf87b5a6b6462b5fd4b34fb33f6090
SHA512 e4f3685affd4a5172e06eb48f59b0e1b8c7505734150d6c1585edc5ae4ca16c536e73545cc2c8069563a0d762ee8f80c303c794f77b00272ccfc5e55db0b3bc0
SSDEEP 12288:tiWzzgNU9MdX2q4vx8d9OdLMZeJik0O+rtvBLbxOLTuT6nhJXbf:tdzzgNU2dX2nx8dELM1kmATuunhRb
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

PerfHost.pdb

msvcrt

_initterm __setusermatherr __p__fmode _cexit _exit exit _amsg_exit __set_app_type free _vsnwprintf __wgetmainargs __p__commode __CxxFrameHandler3 malloc _callnewh memcpy _except_handler4_common _controlfp _XcptFilter ?terminate@@YAXXZ memset

ntdll

NtClose NtQueryInformationToken RtlNtStatusToDosError NtOpenThreadToken EtwEventWrite RtlExpandEnvironmentStrings EtwEventRegister RtlReleaseSRWLockShared RtlAcquireSRWLockShared RtlReleaseSRWLockExclusive RtlAcquireSRWLockExclusive EtwEventUnregister

rpcrt4

RpcEpRegisterW RpcRevertToSelf RpcServerInqBindings RpcServerRegisterIfEx RpcServerUseProtseqW RpcServerUnregisterIf RpcBindingVectorFree RpcEpUnregister RpcStringFreeW RpcStringBindingParseW RpcBindingToStringBindingW RpcBindingInqAuthClientW RpcImpersonateClient NdrServerCall2

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetProcAddress FreeLibrary LoadLibraryExW

api-ms-win-core-registry-l1-1-0

RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegCloseKey

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess TerminateProcess GetCurrentProcessId GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-synch-l1-1-0

InitializeSRWLock

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork CreateThreadpoolWork SubmitThreadpoolWork

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus

Sharing

General

Malware Config

Signatures

File Explorer

f9498f5fe8f412424a85ef0fcae54cf7_JaffaCakes118

msvcrt

ntdll

rpcrt4

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-service-core-l1-1-0

generic