fe1a54e652e0aabbeef12672ab7cd8b6_JaffaCakes118

General

Target
fe1a54e652e0aabbeef12672ab7cd8b6_JaffaCakes118
Size 12.5MB
Sample240421-bspclaff7t
SHA256 4862a24b71b2b82a87363c6e8f76784c96fca5a5285611387c8c012928206445
MD5 fe1a54e652e0aabbeef12672ab7cd8b6
SHA1 ade9b1b9a4cffb7273e0d4658c46e4b96da074cb
SHA512 fc5f7260a03670a45105b77e4eab17cd784f43fc689e8c7314848f08cabbefcd833cef6e42736585dcd8af54d0642db4249e70ffd6b7b6153dcbe09bf97f41e0
SSDEEP 49152:oM+SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSz:o
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe1a54e652e0aabbeef12672ab7cd8b6_JaffaCakes118

File Explorer

fe1a54e652e0aabbeef12672ab7cd8b6_JaffaCakes118

.exe 12.5MB

fe1a54e652e0aabbeef12672ab7cd8b6_JaffaCakes118

IMPHASH e1fc1afae96e4e305bb23169d72f14fc
SHA256 4862a24b71b2b82a87363c6e8f76784c96fca5a5285611387c8c012928206445
MD5 fe1a54e652e0aabbeef12672ab7cd8b6
SHA1 ade9b1b9a4cffb7273e0d4658c46e4b96da074cb
SHA512 fc5f7260a03670a45105b77e4eab17cd784f43fc689e8c7314848f08cabbefcd833cef6e42736585dcd8af54d0642db4249e70ffd6b7b6153dcbe09bf97f41e0
SSDEEP 49152:oM+SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSz:o
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SystemTimeToTzSpecificLocalTime InterlockedIncrement SetMailslotInfo ScrollConsoleScreenBufferW InitializeSListHead HeapFree CancelWaitableTimer GetTimeFormatA LockFile ConnectNamedPipe FreeEnvironmentStringsA FindNextVolumeMountPointA TzSpecificLocalTimeToSystemTime GetSystemTimeAdjustment HeapDestroy GetFileAttributesA GetConsoleAliasW TerminateProcess GetAtomNameW IsDBCSLeadByte GetModuleFileNameW GlobalUnlock FreeLibrary CreateDirectoryA GetLastError GetProcAddress GetProcessHeaps SetFileAttributesA PrepareTape LoadLibraryA UnhandledExceptionFilter LocalAlloc AddVectoredExceptionHandler SetConsoleOutputCP VirtualLock FindAtomA GetTapeParameters GetModuleHandleA GetCurrentDirectoryA SetProcessShutdownParameters FileTimeToLocalFileTime CompareStringW CompareStringA WriteConsoleW SetEndOfFile SetLocalTime GetLocaleInfoA EnumDateFormatsExW WriteConsoleOutputCharacterW LCMapStringA HeapCompact GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RaiseException RtlUnwind HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread EnterCriticalSection LeaveCriticalSection Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle CreateFileA InitializeCriticalSectionAndSpinCount HeapSize SetConsoleCtrlHandler InterlockedExchange GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer SetStdHandle GetProcessHeap ReadFile GetLocaleInfoW GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP SetEnvironmentVariableA

user32

GetProcessDefaultLayout GetDesktopWindow

advapi32

AbortSystemShutdownA AddAccessDeniedAce EqualSid CopySid OpenEventLogW BackupEventLogW

Name

.text

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kic

Size

512B

Virtual Size

377B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12.1MB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fe1a54e652e0aabbeef12672ab7cd8b6_JaffaCakes118

kernel32

user32

advapi32

generic