fa290add0c564f10cdbecdb76ed28ca4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
fa290add0c564f10cdbecdb76ed28ca4_JaffaCakes118
Size 432KB
Sample240419-m552naaa39
SHA256 d35ec32e6c20c3ecf858d2222305c27f78b04a21d9c8373616ae81e91659019d
MD5 fa290add0c564f10cdbecdb76ed28ca4
SHA1 4e68082ab090295cbec54aa860fec6d163e4ca25
SHA512 405b236197ae59da4c09822927e6630e126fec17f110670347193ac0b8e78ad4d8845a898584aafb5ae4641feda29a6e1a77b391a7ab8b2df0139e13dfbdc8ff
SSDEEP 12288:CUCmZiCyhIgM56N1urRfKj7Igk7TKU5nnqm:oCk53ur5KAHTKsnn9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa290add0c564f10cdbecdb76ed28ca4_JaffaCakes118

File Explorer

fa290add0c564f10cdbecdb76ed28ca4_JaffaCakes118

.exe 432KB

fa290add0c564f10cdbecdb76ed28ca4_JaffaCakes118

IMPHASH 41721e0f933696d50ab32d544d64dcd3
SHA256 d35ec32e6c20c3ecf858d2222305c27f78b04a21d9c8373616ae81e91659019d
MD5 fa290add0c564f10cdbecdb76ed28ca4
SHA1 4e68082ab090295cbec54aa860fec6d163e4ca25
SHA512 405b236197ae59da4c09822927e6630e126fec17f110670347193ac0b8e78ad4d8845a898584aafb5ae4641feda29a6e1a77b391a7ab8b2df0139e13dfbdc8ff
SSDEEP 12288:CUCmZiCyhIgM56N1urRfKj7Igk7TKU5nnqm:oCk53ur5KAHTKsnn9
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

api-ms-win-core-crt-l2-1-0

_initterm _initterm_e __wgetmainargs

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken SetProcessAffinityUpdateMode ExitProcess GetCurrentThreadId GetCurrentProcess GetCurrentProcessId TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount64 GetTickCount

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter SetErrorMode UnhandledExceptionFilter

api-ms-win-service-private-l1-1-3

I_RegisterSvchostNotificationCallback

api-ms-win-core-crt-l1-1-0

qsort_s memset memcpy _wcsicmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetProcAddress LoadLibraryExW

api-ms-win-core-heap-l1-1-0

HeapSetInformation HeapFree GetProcessHeap HeapAlloc

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive AcquireSRWLockShared InitializeSRWLock EnterCriticalSection LeaveCriticalSection ReleaseSRWLockShared

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-core-string-l1-1-0

CompareStringOrdinal MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenKeyExW RegEnumKeyExW RegDisablePredefinedCacheEx RegQueryValueExW RegGetValueW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy

api-ms-win-core-processthreads-l1-1-2

SetProtectedPolicy

rpcrt4

RpcServerUnregisterIfEx I_RpcMapWin32Status RpcServerUseProtseqEpW RpcMgmtSetServerStackSize RpcServerUnregisterIf RpcServerRegisterIf RpcMgmtStopServerListening RpcServerListen RpcMgmtWaitServerListen I_RpcServerDisableExceptionFilter

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl GetLengthSid AddAccessAllowedAce InitializeAcl GetTokenInformation InitializeSecurityDescriptor

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventRegister EventWriteTransfer

api-ms-win-crt-utility-l1-1-0

bsearch_s

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx CreateActCtxW DeactivateActCtx ActivateActCtx

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

ntdll

RtlQueryHeapInformation RtlImageNtHeader _vsnwprintf TpSetTimer TpReleaseTimer TpWaitForTimer TpSetTimerEx EtwEventWrite RtlRunOnceExecuteOnce RtlNtStatusToDosError EtwEventEnabled TpReleaseWait RtlNtStatusToDosErrorNoTeb TpSetWait TpAllocWait EtwEventRegister RtlUnhandledExceptionFilter NtSetInformationProcess RtlSetProcessIsCritical RtlInitializeCriticalSection RtlInitializeSid RtlAllocateHeap RtlSubAuthoritySid RtlGetDeviceFamilyInfoEnum RtlReleaseSRWLockExclusive RtlSubAuthorityCountSid RtlAcquireSRWLockExclusive RtlLengthRequiredSid RtlDeriveCapabilitySidsFromName RtlCopySid RtlFreeHeap TpAllocTimer NtQuerySystemInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

400KB

Virtual Size

992KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fa290add0c564f10cdbecdb76ed28ca4_JaffaCakes118

api-ms-win-core-crt-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-service-private-l1-1-3

api-ms-win-core-crt-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processthreads-l1-1-2

rpcrt4

api-ms-win-core-localization-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic