106616b4d3c012a99a747f9d0e951596_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
106616b4d3c012a99a747f9d0e951596_JaffaCakes118
Size 1.2MB
Sample240503-nht7badc7t
SHA256 089a19bb3d0bec505d505cb6870fb9b97f14a1bec81d00307e21cfb968d87947
MD5 106616b4d3c012a99a747f9d0e951596
SHA1 a78f314463068a3d3438aff44a1ac85eed0ab282
SHA512 3bea54a84d57d1e53b631d241f09730f0c07db7477885b521ef40120afc226e6766f0347bc52d8d082e2971c7f3edc783df3fe6152affea172617d6712ad1725
SSDEEP 24576:kVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:kV8hf6STw1ZlQauvzSq01ICe6zvm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
106616b4d3c012a99a747f9d0e951596_JaffaCakes118

File Explorer

106616b4d3c012a99a747f9d0e951596_JaffaCakes118

.dll 1.2MB

106616b4d3c012a99a747f9d0e951596_JaffaCakes118

IMPHASH a23d507241571c69f1f380438b3a251c
SHA256 089a19bb3d0bec505d505cb6870fb9b97f14a1bec81d00307e21cfb968d87947
MD5 106616b4d3c012a99a747f9d0e951596
SHA1 a78f314463068a3d3438aff44a1ac85eed0ab282
SHA512 3bea54a84d57d1e53b631d241f09730f0c07db7477885b521ef40120afc226e6766f0347bc52d8d082e2971c7f3edc783df3fe6152affea172617d6712ad1725
SSDEEP 24576:kVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:kV8hf6STw1ZlQauvzSq01ICe6zvm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

936224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

dpamnlrd.pdb

Name

.text

Size

912KB

Virtual Size

911KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

324B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

276KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

318B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

503B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=241, id=145, productName=VS2008 SP1 build 30729, version=30729,

count=416, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=380, id=223, productName=VS2013 UPD2 build 30501, version=30501,

count=267, id=221, productName=VS2013 UPD3 build 30723, version=30723,

id=256, productName=VS2015 UPD2 build 23918, version=23918,

count=364, id=131, productName=VS2008 build 21022, version=21022,

count=419, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=123, id=257, productName=VS2015 UPD1 build 23506, version=23506,

count=260, id=203, productName=VS2012 build 50727, version=50727,

count=158, id=123, productName=VS2005 build 50727, version=50727,

count=452, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=201, id=223, productName=VS2013 UPD2 build 30501, version=30501,

count=433, id=202, productName=VS2012 UPD3 build 60610, version=60610,

count=136, id=202, productName=VS2012 UPD3 build 60610, version=60610,

count=121, id=202, productName=VS2012 UPD4 build 61030, version=61030,

106616b4d3c012a99a747f9d0e951596_JaffaCakes118

comdlg32

advapi32

user32

kernel32

gdi32

generic