0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118

General

Target
0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118
Size 317KB
Sample240502-ke9k2sfd24
SHA256 dce53cefafaabb7c4d50e19d8c352bdaca304f6ec07a2eb87cf77cf29e42fba7
MD5 0e0091bc67dfa8e6a6ba3e78766d1fc6
SHA1 2b024ad22b0fda674e9b38e0f90c5bf2cf0defc0
SHA512 0713b4b76207c4592f8b0b03bffc60e8487ab3b662639fa223425afaaa5a4da50ad010b8b78f8e6f4bdf8c6beabda9186c24af88f1b140d97a0478c9586fdce8
SSDEEP 6144:+0YjywDhq1doBLbii5bkgVuN+xSKV7Wkrsf7LsOSfXVB8KC9bwd:+0AywDhwdiXikbkgaISKVJXv8z9q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118

File Explorer

0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118

.exe 317KB

0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118

IMPHASH 859807fca8481e505b88016d3873b0c2
SHA256 dce53cefafaabb7c4d50e19d8c352bdaca304f6ec07a2eb87cf77cf29e42fba7
MD5 0e0091bc67dfa8e6a6ba3e78766d1fc6
SHA1 2b024ad22b0fda674e9b38e0f90c5bf2cf0defc0
SHA512 0713b4b76207c4592f8b0b03bffc60e8487ab3b662639fa223425afaaa5a4da50ad010b8b78f8e6f4bdf8c6beabda9186c24af88f1b140d97a0478c9586fdce8
SSDEEP 6144:+0YjywDhq1doBLbii5bkgVuN+xSKV7Wkrsf7LsOSfXVB8KC9bwd:+0AywDhwdiXikbkgaISKVJXv8z9q
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11849

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileA LoadLibraryA GetProcAddress FreeLibrary CreateDirectoryA FindResourceA LoadResource LockResource SizeofResource GetEnvironmentVariableA WaitForSingleObject OpenProcess GetExitCodeProcess TerminateProcess GetProcessId CloseHandle GetModuleFileNameA ReadFile SetEndOfFile GetStringTypeW CreateFileW OutputDebugStringW EncodePointer DecodePointer GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent GetLastError HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar HeapSize SetLastError GetCurrentThreadId GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetFilePointerEx SetStdHandle WriteConsoleW FlushFileBuffers LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapReAlloc LCMapStringW ReadConsoleW

shell32

ord680 ShellExecuteExA SHFileOperationA

rpcrt4

RpcStringFreeA UuidToStringA UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer

0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118

kernel32

shell32

rpcrt4

generic