01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118

General

Target
01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118
Size 2.3MB
Sample240427-acrmcaeg74
SHA256 51d35d521169eaef5e7d4f0770d604306e53cff50eb52b7c9efb4b3b19e36c6c
MD5 01f6baa5167877bcaa01bf1de89c130e
SHA1 37a4d1e940a7ad72a4aefd496f787e484ab248c4
SHA512 f1b2b965b6beb5a3df648040d9c4b722b24c9022961fb034fdfdf0cc6e657c0c0b6bf1b2d817ec885df920002df238732e5e2e7b7da1d3e52fbbb47401535bb2
SSDEEP 49152:xWsuGHdqpCYWFkhmiQodN1kl/dnqUdSyYUh:FHIpCYWFkhdQodN6lgUd7Y
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118

File Explorer

01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118

.exe 2.3MB

01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118

IMPHASH f2320970ce6384a1fb40b0631b30343a
SHA256 51d35d521169eaef5e7d4f0770d604306e53cff50eb52b7c9efb4b3b19e36c6c
MD5 01f6baa5167877bcaa01bf1de89c130e
SHA1 37a4d1e940a7ad72a4aefd496f787e484ab248c4
SHA512 f1b2b965b6beb5a3df648040d9c4b722b24c9022961fb034fdfdf0cc6e657c0c0b6bf1b2d817ec885df920002df238732e5e2e7b7da1d3e52fbbb47401535bb2
SSDEEP 49152:xWsuGHdqpCYWFkhmiQodN1kl/dnqUdSyYUh:FHIpCYWFkhdQodN6lgUd7Y
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

127726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

GetModuleHandleA GetVersionExA CreateMutexA CloseHandle LoadLibraryA ExitProcess GetModuleHandleExW InterlockedCompareExchange GetTickCount Sleep GetProcessHeap SetLastError GetProcAddress VirtualProtect GetTempPathA WideCharToMultiByte GetFileAttributesA MultiByteToWideChar RemoveDirectoryA HeapFree GetCurrentProcess GetLastError HeapAlloc InterlockedIncrement InterlockedDecrement EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlUnwind RaiseException GetSystemTimeAsFileTime GetCommandLineA InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent HeapSize GetStdHandle WriteFile GetModuleFileNameW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW GetCurrentThreadId IsDebuggerPresent GetConsoleMode SetFilePointerEx GetFileType GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW HeapReAlloc OutputDebugStringW LoadLibraryW LCMapStringW GetConsoleCP SetStdHandle FlushFileBuffers WriteConsoleW CreateFileW VirtualQuery

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118

kernel32

advapi32

generic