fedfc63ae1bd30ead2e439734b1e6ff2_JaffaCakes118

General

Target
fedfc63ae1bd30ead2e439734b1e6ff2_JaffaCakes118
Size 526KB
Sample240421-kf4fesfb23
SHA256 01d7dce654258b590fbbc580522d18a4d3079900c0d936ace386c7d22c759de6
MD5 fedfc63ae1bd30ead2e439734b1e6ff2
SHA1 5349334d8e68bff3bf66799fa9a0a08c22dd4f30
SHA512 664cf433b33d209aeecbac05f909846f8ddcb7c16fc8ede1ca542bdab3813223826a7f8ee9bc30e9c31fd4c84492b9456cc7f5ac315f1ef61880a57793b31f4f
SSDEEP 12288:ytvMluDHDy+JZ9OpwaDzfKNGzYwnKGHV5dpyGKMU1OF6z4tQ8Nca5:RuDHg2afeEYe5lpyNIO4tQfa5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fedfc63ae1bd30ead2e439734b1e6ff2_JaffaCakes118

File Explorer

fedfc63ae1bd30ead2e439734b1e6ff2_JaffaCakes118

.exe 526KB

fedfc63ae1bd30ead2e439734b1e6ff2_JaffaCakes118

IMPHASH ab6a8b01372d51e7fed6c22dcfc42852
SHA256 01d7dce654258b590fbbc580522d18a4d3079900c0d936ace386c7d22c759de6
MD5 fedfc63ae1bd30ead2e439734b1e6ff2
SHA1 5349334d8e68bff3bf66799fa9a0a08c22dd4f30
SHA512 664cf433b33d209aeecbac05f909846f8ddcb7c16fc8ede1ca542bdab3813223826a7f8ee9bc30e9c31fd4c84492b9456cc7f5ac315f1ef61880a57793b31f4f
SSDEEP 12288:ytvMluDHDy+JZ9OpwaDzfKNGzYwnKGHV5dpyGKMU1OF6z4tQ8Nca5:RuDHg2afeEYe5lpyNIO4tQfa5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ziki\vuhoz\sor.pdb

kernel32

GetCommandLineW FileTimeToDosDateTime SetThreadContext GetNativeSystemInfo SetFilePointer lstrlenA CopyFileExW TlsGetValue InterlockedIncrement GetQueuedCompletionStatus GetCommState InterlockedDecrement GetSystemWindowsDirectoryW GlobalLock WaitForSingleObject SetEvent OpenSemaphoreA FreeEnvironmentStringsA GetTickCount CreateNamedPipeW VirtualFree GetConsoleAliasesLengthA GetDriveTypeA GetPriorityClass LoadLibraryW GetConsoleMode TerminateThread GetVersionExW SetConsoleMode SetConsoleCursorPosition ReadFile GetOverlappedResult CompareStringW GetStartupInfoW GetNamedPipeHandleStateW GetPrivateProfileIntW CreateDirectoryA GetFileSizeEx GetLastError IsDBCSLeadByteEx ReadConsoleOutputCharacterA GetProcAddress CopyFileA GetPrivateProfileStringA LoadLibraryA OpenMutexA LocalAlloc IsSystemResumeAutomatic SetCurrentDirectoryW WriteProfileSectionW HeapWalk SetNamedPipeHandleState Process32NextW SetConsoleTitleW FindFirstChangeNotificationA FreeEnvironmentStringsW EnumResourceNamesA FatalAppExitA GetCurrentThreadId GetCPInfoExA FindAtomW GetSystemTime LCMapStringW DeleteFileA UnhandledExceptionFilter SetUnhandledExceptionFilter HeapValidate IsBadReadPtr RaiseException GetModuleHandleW Sleep ExitProcess GetModuleFileNameA WriteFile GetStdHandle TlsAlloc TlsSetValue TlsFree SetLastError TerminateProcess GetCurrentProcess IsDebuggerPresent GetModuleFileNameW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate HeapFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW MultiByteToWideChar LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP FlushFileBuffers CreateFileA CloseHandle GetModuleHandleA

user32

GetTitleBarInfo

winhttp

WinHttpReadData

Sharing

General

Malware Config

Signatures

File Explorer

fedfc63ae1bd30ead2e439734b1e6ff2_JaffaCakes118

kernel32

user32

winhttp

generic