0b6e972e6d5d8bd62cbef9d2b5bfe4ea_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
0b6e972e6d5d8bd62cbef9d2b5bfe4ea_JaffaCakes118
Size 116KB
Sample240501-27e1ksca65
SHA256 cb6156630fbb292a348014fb63af9f9be12d97b4c6b3c027a7d3801d47c6dbfb
MD5 0b6e972e6d5d8bd62cbef9d2b5bfe4ea
SHA1 895f675fa4dc040777ebe042210ba5920dbd2cc8
SHA512 eb736289c1ccb2054400c13c341ba7087c0588f2d1e79f9ebbff54d01ec3d42116dcb91084cd5480f222294afaff67afaf60fbd4653e203e72a400ac1e11c9ce
SSDEEP 1536:LBNNJ5kdqULXP6f4ccRiFHLxnPZyzP4Gt5BQItBWEYfvPyX96ifyMzlRsLN0s:r75qLZidazP4Gt5aItBpCv6oVMx9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b6e972e6d5d8bd62cbef9d2b5bfe4ea_JaffaCakes118

File Explorer

0b6e972e6d5d8bd62cbef9d2b5bfe4ea_JaffaCakes118

.exe 116KB

0b6e972e6d5d8bd62cbef9d2b5bfe4ea_JaffaCakes118

IMPHASH af052dda7da9f14be8522de53541445d
SHA256 cb6156630fbb292a348014fb63af9f9be12d97b4c6b3c027a7d3801d47c6dbfb
MD5 0b6e972e6d5d8bd62cbef9d2b5bfe4ea
SHA1 895f675fa4dc040777ebe042210ba5920dbd2cc8
SHA512 eb736289c1ccb2054400c13c341ba7087c0588f2d1e79f9ebbff54d01ec3d42116dcb91084cd5480f222294afaff67afaf60fbd4653e203e72a400ac1e11c9ce
SSDEEP 1536:LBNNJ5kdqULXP6f4ccRiFHLxnPZyzP4Gt5BQItBWEYfvPyX96ifyMzlRsLN0s:r75qLZidazP4Gt5aItBpCv6oVMx9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetupComm HeapAlloc SetConsoleTextAttribute DisconnectNamedPipe IsBadStringPtrA SetProcessWorkingSetSize SetVolumeLabelA GetPrivateProfileStringW MultiByteToWideChar PurgeComm VirtualProtect EnumDateFormatsExA GetSystemWindowsDirectoryA GetCurrentProcess GlobalAlloc GetFullPathNameA LoadLibraryA SizeofResource ReadConsoleW lstrcpyW GetThreadSelectorEntry SetThreadExecutionState GetDefaultCommConfigW GetAtomNameA GetEnvironmentVariableA BuildCommDCBAndTimeoutsW SetMailslotInfo GetLastError GetTickCount GetPriorityClass FindNextVolumeW ProcessIdToSessionId WTSGetActiveConsoleSessionId lstrlenA lstrlenW IsWow64Process CompareStringA GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection SetFilePointer EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetStdHandle RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapReAlloc WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA ReadFile HeapSize CloseHandle CreateFileA

advapi32

RegQueryMultipleValuesA

winhttp

WinHttpCloseHandle

Name

.text

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sutige

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tuha

Size

512B

Virtual Size

346B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0b6e972e6d5d8bd62cbef9d2b5bfe4ea_JaffaCakes118

kernel32

advapi32

winhttp

generic