febd5a19dcc3c0d9139f209d0b198198_JaffaCakes118

General

Target
febd5a19dcc3c0d9139f209d0b198198_JaffaCakes118
Size 174KB
Sample240421-h4e2madh95
SHA256 297fbe9e67e3b1bcc74cbd344e7f513e59f4b83c3d53fde32002eb592b859d14
MD5 febd5a19dcc3c0d9139f209d0b198198
SHA1 6352ba32e4e4ebd653abad599dfca506f18edefb
SHA512 f20cbe7a89005742407ffa4294932207277438d13dca2ef711d381fd670d82b536c7da3e0b6ff2a014ed41e3b8cc7d588d4bf8e0412396b49ffeb6df2fb38eac
SSDEEP 3072:/1i4pNkE8GPl9smhsrDroKEoS9D98aShyuyv5VM8fb3E:44pNh8GAmhsrxEVx98aC6xfjE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
febd5a19dcc3c0d9139f209d0b198198_JaffaCakes118

File Explorer

febd5a19dcc3c0d9139f209d0b198198_JaffaCakes118

.exe 174KB

febd5a19dcc3c0d9139f209d0b198198_JaffaCakes118

IMPHASH facc417011cd2847066f1f1ec6f97b50
SHA256 297fbe9e67e3b1bcc74cbd344e7f513e59f4b83c3d53fde32002eb592b859d14
MD5 febd5a19dcc3c0d9139f209d0b198198
SHA1 6352ba32e4e4ebd653abad599dfca506f18edefb
SHA512 f20cbe7a89005742407ffa4294932207277438d13dca2ef711d381fd670d82b536c7da3e0b6ff2a014ed41e3b8cc7d588d4bf8e0412396b49ffeb6df2fb38eac
SSDEEP 3072:/1i4pNkE8GPl9smhsrDroKEoS9D98aShyuyv5VM8fb3E:44pNh8GAmhsrxEVx98aC6xfjE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6633

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\caw-jitudexo\hekufak\luzecibivihif\videvaduduz65 giw42-joz.pdb

kernel32

UnmapViewOfFile EndUpdateResourceW ReadConsoleA GetCurrentProcess BackupSeek FindActCtxSectionStringA GetEnvironmentStrings GlobalAlloc Sleep InitAtomTable HeapDestroy FindNextVolumeW GetModuleFileNameW CreateActCtxA GetACP ReleaseSemaphore SetTapePosition SetLastError GetProcAddress BeginUpdateResourceW ResetEvent DebugSetProcessKillOnExit CreateIoCompletionPort GetModuleHandleA GetProcessShutdownParameters VirtualProtect SetProcessShutdownParameters GetCurrentProcessId FindNextVolumeA LCMapStringW lstrcpyA WriteConsoleW HeapReAlloc GetCommandLineW HeapSetInformation GetStartupInfoW HeapAlloc EnterCriticalSection LeaveCriticalSection DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetLastError HeapFree SetFilePointer CloseHandle GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetOEMCP IsValidCodePage WideCharToMultiByte RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW RaiseException MultiByteToWideChar GetStringTypeW IsProcessorFeaturePresent HeapSize CreateFileW

advapi32

RegQueryValueExA

Name

.text

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rev

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xusizi

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

febd5a19dcc3c0d9139f209d0b198198_JaffaCakes118

kernel32

advapi32

generic