13a04853c2648b1ece978e68098ed66e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
13a04853c2648b1ece978e68098ed66e_JaffaCakes118
Size 92KB
Sample240504-vb8vfsbf5y
SHA256 764a6ddd5abaad9ae5ed10f6697ceb3bede20e7829083a94fc752bda13505daf
MD5 13a04853c2648b1ece978e68098ed66e
SHA1 9177fe437cbaa9d04e9e66d478b3052081ba2bb7
SHA512 06fbcad991780df583182e7c82031152108da05f17925557d76578463ef63a193969eae1aa70810e77f377fbc54f867678993d615b15e2168192c0ed6a67ae2a
SSDEEP 1536:EkYJHuUIeW3KeN7t+PEBcXqvEQ4wabrtBSzA18F/bzJIg58+lZRrFd8:PYTIeW3K0+P56vEoMb9+RzN5t
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13a04853c2648b1ece978e68098ed66e_JaffaCakes118

File Explorer

13a04853c2648b1ece978e68098ed66e_JaffaCakes118

.dll 92KB

13a04853c2648b1ece978e68098ed66e_JaffaCakes118

IMPHASH deb2857872cbcf6d306cb063791f14a7
SHA256 764a6ddd5abaad9ae5ed10f6697ceb3bede20e7829083a94fc752bda13505daf
MD5 13a04853c2648b1ece978e68098ed66e
SHA1 9177fe437cbaa9d04e9e66d478b3052081ba2bb7
SHA512 06fbcad991780df583182e7c82031152108da05f17925557d76578463ef63a193969eae1aa70810e77f377fbc54f867678993d615b15e2168192c0ed6a67ae2a
SSDEEP 1536:EkYJHuUIeW3KeN7t+PEBcXqvEQ4wabrtBSzA18F/bzJIg58+lZRrFd8:PYTIeW3K0+P56vEoMb9+RzN5t
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord4079 ord4698 ord5307 ord5289 ord5714 ord3953 ord2982 ord3147 ord3259 ord4465 ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord825 ord815 ord823 ord6375 ord4486 ord2554 ord2725 ord269 ord826 ord600 ord1578 ord6467 ord1255 ord4274 ord1253 ord1570 ord1197 ord1243 ord342 ord5302 ord5300 ord3346 ord2396 ord1182 ord5199 ord1089 ord3922 ord5731 ord2512 ord1577 ord1116 ord1176 ord1575 ord1168

msvcrt

_strnicmp _itoa ??1type_info@@UAE@XZ _adjust_fdiv malloc _initterm _onexit __dllonexit __CxxFrameHandler _i64toa sprintf _ftol strstr free _stricmp atoi

kernel32

LocalAlloc LocalFree GetCurrentThreadId QueryPerformanceCounter LoadLibraryA GetProcAddress FreeLibrary Sleep QueryPerformanceFrequency

user32

SetKeyboardState GetKeyboardState PostMessageA SetForegroundWindow ShowWindow IsIconic FindWindowA GetAsyncKeyState GetKeyState keybd_event GetWindowThreadProcessId AttachThreadInput MapVirtualKeyA GetKeyboardLayoutNameA VkKeyScanA GetCursorPos GetWindowRect ClientToScreen mouse_event IsWindow EnumWindows GetDesktopWindow EnumChildWindows IsWindowVisible GetWindowTextA SendMessageA SendMessageTimeoutA GetForegroundWindow SetWindowPos GetDC ReleaseDC

gdi32

GetPixel

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

Name

.text

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

848B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

13a04853c2648b1ece978e68098ed66e_JaffaCakes118

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

generic