ff71c96860f7570bf49cfc4eaf8c8981_JaffaCakes118

General

Target
ff71c96860f7570bf49cfc4eaf8c8981_JaffaCakes118
Size 419KB
Sample240421-rdgbfadc8y
SHA256 993324955100beb9c2426b5b82293c60bc63fc1b054fc47ca6ede4a11cf564bf
MD5 ff71c96860f7570bf49cfc4eaf8c8981
SHA1 3285e7622508cf2dc1248b7e3a3ca85b06dc1890
SHA512 80ac5f477abaaf2ac5a8d87635b88e9acdb271e86f878fb2bfc4d56a9bd882b83fe3c2ab4bfd03ebc8387fa777b28cf875ae9313d38b95ce023b1f4dd51b3909
SSDEEP 6144:bUcIvKaiG+KX8PBmeRBlno7f6Hv5fGois6hqGBvs73sI5/:bfIvKC+28PBty7f6RpisUVq78c
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff71c96860f7570bf49cfc4eaf8c8981_JaffaCakes118

File Explorer

ff71c96860f7570bf49cfc4eaf8c8981_JaffaCakes118

.exe 419KB

ff71c96860f7570bf49cfc4eaf8c8981_JaffaCakes118

IMPHASH aa21a6d00a5d2896042e00aa2e960393
SHA256 993324955100beb9c2426b5b82293c60bc63fc1b054fc47ca6ede4a11cf564bf
MD5 ff71c96860f7570bf49cfc4eaf8c8981
SHA1 3285e7622508cf2dc1248b7e3a3ca85b06dc1890
SHA512 80ac5f477abaaf2ac5a8d87635b88e9acdb271e86f878fb2bfc4d56a9bd882b83fe3c2ab4bfd03ebc8387fa777b28cf875ae9313d38b95ce023b1f4dd51b3909
SSDEEP 6144:bUcIvKaiG+KX8PBmeRBlno7f6Hv5fGois6hqGBvs73sI5/:bfIvKC+28PBty7f6RpisUVq78c
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cijunih.pdb

kernel32

lstrlenA GetCPInfo GetDefaultCommConfigW HeapAlloc _lwrite InterlockedDecrement GetCurrentProcess GetSystemWindowsDirectoryW GetUserDefaultLCID SetVolumeMountPointW GetCommandLineA GetEnvironmentStrings GlobalAlloc ReadConsoleInputA WriteConsoleOutputA GetVersionExW GetComputerNameExA lstrcpynW LocalReAlloc HeapQueryInformation ReadFile VerifyVersionInfoW GetCPInfoExW ChangeTimerQueueTimer GetProcAddress AttachConsole PeekConsoleInputW VerLanguageNameA FreeUserPhysicalPages GetLocalTime LoadLibraryA BeginUpdateResourceA GetCurrentConsoleFont SetEnvironmentVariableA GetConsoleTitleW BuildCommDCBA VirtualProtect FindFirstVolumeA ReleaseMutex GetVersion AddConsoleAliasA EnumCalendarInfoExA LCMapStringW CreateThread CreateFileA SetStdHandle CreateTimerQueue GetModuleFileNameW GetSystemDefaultLangID WriteConsoleW GetConsoleOutputCP WideCharToMultiByte InterlockedIncrement InterlockedExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree TerminateProcess IsDebuggerPresent GetModuleHandleW ExitProcess GetStartupInfoA RtlUnwind RaiseException LCMapStringA GetStringTypeW WriteFile GetStdHandle GetModuleFileNameA HeapCreate VirtualFree VirtualAlloc HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA HeapSize GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA

user32

RealGetWindowClassA GetCaretPos

Sharing

General

Malware Config

Signatures

File Explorer

ff71c96860f7570bf49cfc4eaf8c8981_JaffaCakes118

kernel32

user32

generic