fd20f71fc883bed9e8bc162ba5949bda_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
fd20f71fc883bed9e8bc162ba5949bda_JaffaCakes118
Size 49KB
Sample240420-tf93mscg41
SHA256 d0e367bc0a8a6a26f57182b6ce71eadb28cb888ccdafe6102a749aa19672902b
MD5 fd20f71fc883bed9e8bc162ba5949bda
SHA1 73e83248e55ecc382855530b0dabad11f96d69f2
SHA512 a927de77de8683124eb900143bbae39db97aae021e3e2ad301e1f4c89109db6742c5dfd6532a3916a82a5c67accc0adea3d207f4dc8b084d16161e4536756b45
SSDEEP 768:hCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:hbw/6plBTFBYNNR9Jw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd20f71fc883bed9e8bc162ba5949bda_JaffaCakes118

File Explorer

fd20f71fc883bed9e8bc162ba5949bda_JaffaCakes118

.exe 49KB

fd20f71fc883bed9e8bc162ba5949bda_JaffaCakes118

IMPHASH e0f61286c6396ccf28fed994d6a49819
SHA256 d0e367bc0a8a6a26f57182b6ce71eadb28cb888ccdafe6102a749aa19672902b
MD5 fd20f71fc883bed9e8bc162ba5949bda
SHA1 73e83248e55ecc382855530b0dabad11f96d69f2
SHA512 a927de77de8683124eb900143bbae39db97aae021e3e2ad301e1f4c89109db6742c5dfd6532a3916a82a5c67accc0adea3d207f4dc8b084d16161e4536756b45
SSDEEP 768:hCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:hbw/6plBTFBYNNR9Jw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

GetTickCount FreeConsole TlsAlloc TlsAlloc

user32

CheckDlgButton DestroyMenu GetAncestor SetParent GetCursorInfo GetPropA SetUserObjectInformationW GetDC AppendMenuW SetWindowLongW AppendMenuA ChangeDisplaySettingsA UnionRect DrawTextExA GetUpdateRect CreateDialogIndirectParamW GetWindowLongW ExcludeUpdateRgn CallMsgFilterA GetDlgItem CascadeWindows GetSubMenu GetClassWord GetUserObjectSecurity GetParent DlgDirListW PeekMessageA SetWindowTextW CreateMDIWindowA RemoveMenu LoadKeyboardLayoutW GetLastActivePopup AttachThreadInput LoadKeyboardLayoutA EnumDisplaySettingsExW

ws2_32

accept WSAWaitForMultipleEvents WSACancelBlockingCall inet_ntoa WSAInstallServiceClassA setsockopt WSAEnumProtocolsW WSAHtons WSASendTo WSAEnumProtocolsA WSAEnumNameSpaceProvidersW WSAEnumNameSpaceProvidersA WSARecvDisconnect getprotobyname getprotobynumber getservbyname WSAGetServiceClassNameByClassIdA gethostbyaddr gethostbyname WSAGetQOSByName gethostname WSAGetServiceClassInfoA WSASocketW WSAUnhookBlockingHook getpeername WSAHtonl WSAEventSelect WSAGetLastError WSASetServiceW

rtm

RtmUpdateAndUnlockRoute RtmRegisterForChangeNotification RtmCreateDestEnum RtmGetNextHopInfo RtmLockRoute RtmCreateRouteList RtmReleaseChangedDests RtmGetChangedDests RtmGetExactMatchDestination RtmReleaseEntities RtmGetEntityInfo RtmReleaseNextHopInfo RtmReleaseRoutes RtmGetRouteInfo RtmIgnoreChangedDests RtmReleaseRouteInfo RtmGetRoutePointer RtmCreateNextHopEnum RtmLockDestination RtmGetEnumRoutes RtmGetEntityMethods RtmFindNextHop RtmInvokeMethod RtmDeleteEnumHandle RtmIsBestRoute

secur32

EnumerateSecurityPackagesW AcquireCredentialsHandleW FreeCredentialsHandle EnumerateSecurityPackagesA RevertSecurityContext ApplyControlToken ImpersonateSecurityContext

Name

.text

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

512B

Virtual Size

429B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fd20f71fc883bed9e8bc162ba5949bda_JaffaCakes118

kernel32

user32

ws2_32

rtm

secur32

generic