fbd0706637cdf875d9b0960a4291f687_JaffaCakes118

General

Target
fbd0706637cdf875d9b0960a4291f687_JaffaCakes118
Size 582KB
Sample240420-dwtgtsfa64
SHA256 a9017566e9e66f032d8112dedb7a41398f0b56f607372d7df9096b555cc4c344
MD5 fbd0706637cdf875d9b0960a4291f687
SHA1 1505dc4b7b08ff080303d103c5ebbffabc9f49bf
SHA512 f7ebcb0936575bc621544e61161b04341e2f8804d60acc0cc96673fce5d24dceda943225fba954c82306a36ac5bd566f85c94c805eef2ae5eab3ca4f41ac699e
SSDEEP 12288:WhPR/7INdG4FToXOuMrU9m+EeAAcjZatOrlkgsJpAzSsvIdpH:WhJI1NIMrU9xEeArZegsJpwIdpH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbd0706637cdf875d9b0960a4291f687_JaffaCakes118

File Explorer

fbd0706637cdf875d9b0960a4291f687_JaffaCakes118

.exe 582KB

fbd0706637cdf875d9b0960a4291f687_JaffaCakes118

IMPHASH 33155a730e036f2480434cae8e547169
SHA256 a9017566e9e66f032d8112dedb7a41398f0b56f607372d7df9096b555cc4c344
MD5 fbd0706637cdf875d9b0960a4291f687
SHA1 1505dc4b7b08ff080303d103c5ebbffabc9f49bf
SHA512 f7ebcb0936575bc621544e61161b04341e2f8804d60acc0cc96673fce5d24dceda943225fba954c82306a36ac5bd566f85c94c805eef2ae5eab3ca4f41ac699e
SSDEEP 12288:WhPR/7INdG4FToXOuMrU9m+EeAAcjZatOrlkgsJpAzSsvIdpH:WhJI1NIMrU9xEeArZegsJpwIdpH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

412928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tolalihumo\zefedufijuwi_womu82\focorepotof91.pdb

kernel32

SearchPathW InterlockedDecrement GetProcessPriorityBoost GetModuleHandleW GetTickCount IsBadReadPtr GetConsoleAliasesLengthA SetFileShortNameW CopyFileW GetSystemTimeAdjustment GetVersionExW GetModuleFileNameW GetEnvironmentVariableA ExitThread lstrlenW GetStartupInfoW GetConsoleOutputCP SetCurrentDirectoryA FindFirstFileExA SetLastError GetProcAddress GetLongPathNameA WriteProfileSectionA CreateMemoryResourceNotification GlobalGetAtomNameA _hwrite LoadLibraryA ProcessIdToSessionId OpenWaitableTimerW LocalAlloc MoveFileA GetProcessShutdownParameters FreeEnvironmentStringsW GetCurrentDirectoryA CompareStringA GetFileTime OutputDebugStringA GetWindowsDirectoryW DeleteTimerQueueTimer DeleteFileW AddConsoleAliasA CloseHandle CreateFileW WideCharToMultiByte InterlockedIncrement MultiByteToWideChar InterlockedExchange EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapValidate GetCommandLineW HeapSetInformation GetCPInfo RtlUnwind RaiseException LCMapStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount HeapAlloc GetModuleFileNameA GetLastError HeapReAlloc HeapSize HeapQueryInformation HeapFree HeapCreate GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId TlsFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime ExitProcess GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType WriteFile GetStringTypeW GetLocaleInfoW WriteConsoleW OutputDebugStringW LoadLibraryW GetLocaleInfoA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers

user32

GetAncestor

Sharing

General

Malware Config

Signatures

File Explorer

fbd0706637cdf875d9b0960a4291f687_JaffaCakes118

kernel32

user32

generic