1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118
Size 499KB
Sample240505-tfgfbshe49
SHA256 f12851c350ac9d71760465bfe01bc7e17f3dd2575412d99865cde1bbdf16d353
MD5 1861f5f5c1bf4c6eabe0b6fc8d792019
SHA1 a73a74301727189491556bac5146976fb26638ba
SHA512 7d3ce18298009393683532b4f04ebc80ef8e0010a3cff6478e47b580cd97b2f9d5bf4cd2f73feb5b3719a9c1ff5b907a1d998a67a13aeee3fdbadfb4fbfbc6b1
SSDEEP 6144:4kJ3VPwv21cNZSa/mZzxPTZSV0h6UOdmPvjqlyQkbs1jqLBcdFuhJVm3Cf1SlyIk:4kJ3twv8cmqmZJTZVvjKyQD1WL2dFuL1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118

File Explorer

1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118

.exe 499KB

1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118

IMPHASH c6e9a543b0611c033118b880816cea19
SHA256 f12851c350ac9d71760465bfe01bc7e17f3dd2575412d99865cde1bbdf16d353
MD5 1861f5f5c1bf4c6eabe0b6fc8d792019
SHA1 a73a74301727189491556bac5146976fb26638ba
SHA512 7d3ce18298009393683532b4f04ebc80ef8e0010a3cff6478e47b580cd97b2f9d5bf4cd2f73feb5b3719a9c1ff5b907a1d998a67a13aeee3fdbadfb4fbfbc6b1
SSDEEP 6144:4kJ3VPwv21cNZSa/mZzxPTZSV0h6UOdmPvjqlyQkbs1jqLBcdFuhJVm3Cf1SlyIk:4kJ3twv8cmqmZJTZVvjKyQD1WL2dFuL1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_WDM_DRIVER IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

PDB paths

kernel32

CreateFileW SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer RaiseException HeapQueryInformation HeapSize HeapReAlloc GetStringTypeW RtlUnwind LoadLibraryW OutputDebugStringW WriteConsoleW LeaveCriticalSection EnterCriticalSection WriteFile DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA ExitProcess GetSystemTimeAsFileTime GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA GetCurrentThreadId GetStdHandle GetConsoleScreenBufferInfo FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleCursorPosition GetCurrentProcess CloseHandle HeapCreate GetProcessHeap HeapAlloc HeapFree GetTickCount QueryPerformanceCounter IsProcessorFeaturePresent IsBadReadPtr HeapValidate LCMapStringW MultiByteToWideChar GetLastError OutputDebugStringA WideCharToMultiByte SetLastError GetModuleHandleW GetCommandLineA HeapSetInformation GetStartupInfoW EncodePointer DecodePointer TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW InterlockedIncrement InterlockedDecrement GetACP GetOEMCP GetCPInfo IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress FlushFileBuffers

user32

GetDlgItem SetWindowTextA GetDC DispatchMessageA TranslateMessage DdeCreateStringHandleA EnableMenuItem BeginPaint SendMessageA DrawTextW EndPaint InvalidateRect DefWindowProcA EndDialog SetDlgItemTextA GetDlgItemTextA MessageBoxA DestroyWindow GetClientRect GetWindow IsWindowVisible GetWindowTextA PostMessageA SetWindowLongA SendDlgItemMessageA SetFocus GetWindowLongA LoadAcceleratorsA GetSystemMetrics LoadIconA LoadCursorA RegisterClassExA CreateWindowExA ShowWindow SetForegroundWindow GetMessageA GetDesktopWindow

gdi32

SelectObject EnumFontFamiliesA CreateFontW SetTextColor

comdlg32

GetFileTitleW

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken FreeSid AllocateAndInitializeSid SetTokenInformation

ole32

CLSIDFromString

ws2_32

WSAGetLastError WSACreateEvent inet_addr

iphlpapi

NotifyRouteChange SendARP IcmpCreateFile IcmpCloseHandle

shlwapi

PathFileExistsW

powrprof

ReadGlobalPwrPolicy

Name

.text

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fla

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.directo

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118

kernel32

user32

gdi32

comdlg32

advapi32

ole32

ws2_32

iphlpapi

shlwapi

powrprof

generic