26bd4cd169b2c48cc0902d1433600c6c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
26bd4cd169b2c48cc0902d1433600c6c_JaffaCakes118
Size 2.5MB
Sample240508-zxtpwaaa56
SHA256 a5f2a1ab97a9d6886cae2f4d57424321bff4f57fd31e421841aa082716d8311e
MD5 26bd4cd169b2c48cc0902d1433600c6c
SHA1 beb255e16ddfc57fc8cc694a88b63240b9f08e19
SHA512 99d0c82097f2f37979b4877427e348ac4323370d0fa66bd8c230359325f11c56b72d9122a2ebe1bfd9a452f05a3a731f88f0f3e726bbed84950aa00bb4656e29
SSDEEP 49152:1iLPCG5Icnq7JVQpVIoXY7/IMu2bxb4pUzCynZP4F3OfaSz1qBal:1itoVQpM/IubB9nZPSO/5qY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26bd4cd169b2c48cc0902d1433600c6c_JaffaCakes118

File Explorer

26bd4cd169b2c48cc0902d1433600c6c_JaffaCakes118

.exe 2.5MB

26bd4cd169b2c48cc0902d1433600c6c_JaffaCakes118

IMPHASH a34f3e5a0be05d11e89c4e81047d506a
SHA256 a5f2a1ab97a9d6886cae2f4d57424321bff4f57fd31e421841aa082716d8311e
MD5 26bd4cd169b2c48cc0902d1433600c6c
SHA1 beb255e16ddfc57fc8cc694a88b63240b9f08e19
SHA512 99d0c82097f2f37979b4877427e348ac4323370d0fa66bd8c230359325f11c56b72d9122a2ebe1bfd9a452f05a3a731f88f0f3e726bbed84950aa00bb4656e29
SSDEEP 49152:1iLPCG5Icnq7JVQpVIoXY7/IMu2bxb4pUzCynZP4F3OfaSz1qBal:1itoVQpM/IubB9nZPSO/5qY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

508113

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Devops\agent\workspace\p-111758179e0043a5b011650a32a71ea0\src\TGBDownloader\Output\TGBDownloader\Release\TGBDownloader.pdb

ws2_32

htonl ntohl htons

dbghelp

MiniDumpWriteDump

kernel32

GetExitCodeProcess IsDBCSLeadByte WideCharToMultiByte GetFullPathNameW SetEndOfFile GetFileAttributesExW SetFilePointerEx MoveFileW CopyFileW CreateFileA SwitchToThread GetFileSize CreateDirectoryA GetPrivateProfileIntA GetPrivateProfileStringA GetVersionExW GetSystemDirectoryW InterlockedExchange InterlockedCompareExchange InterlockedDecrement InitializeCriticalSection GetSystemDefaultLangID Sleep GetSystemInfo InterlockedIncrement LoadLibraryA MulDiv GetACP lstrlenW GlobalLock GlobalUnlock ExitProcess VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime SystemTimeToFileTime GlobalAlloc FormatMessageW LocalFree GetLocalTime lstrcpyW lstrcmpiW GetOEMCP IsValidCodePage SetStdHandle ReadConsoleW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FlushFileBuffers GetConsoleMode GetConsoleCP GetStdHandle GetModuleHandleExW ExitThread WaitForSingleObject RemoveDirectoryW SetEnvironmentVariableA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter ResetEvent SetEvent OutputDebugStringW IsDebuggerPresent LCMapStringW CompareStringW GetCPInfo EncodePointer GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW SetLastError QueryPerformanceCounter GetNativeSystemInfo GetExitCodeThread GetCurrentThread WaitForSingleObjectEx DuplicateHandle TryEnterCriticalSection GetStringTypeW FindFirstFileExW FindClose FindNextFileW MoveFileExW FindFirstFileW GetTickCount DeviceIoControl GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDrives SetFilePointer WriteFile CreateMutexW OpenMutexW ProcessIdToSessionId SetUnhandledExceptionFilter GetCurrentProcess GetCurrentProcessId CreateDirectoryW DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetLocaleInfoW GetUserDefaultUILanguage FreeResource TerminateThread ReadFile GetFileSizeEx GetModuleFileNameW GetFileAttributesW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetTempFileNameW GetTempPathW SetCurrentDirectoryW GetCurrentDirectoryW GetModuleHandleW GlobalFree MultiByteToWideChar GetLastError EnterCriticalSection LeaveCriticalSection LoadLibraryW GetProcAddress FreeLibrary CloseHandle CreateFileW GetFileTime DeleteFileW GetCurrentThreadId GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

user32

SendMessageW GetWindowRect ScreenToClient GetKeyState LoadCursorW SetCursor PtInRect DestroyWindow ReleaseDC GetDC GetClientRect SetWindowPos GetWindowLongW SetWindowLongW IsIconic GetActiveWindow GetWindow SetFocus BeginPaint EndPaint GetUpdateRect IsWindowVisible MapWindowPoints GetMonitorInfoW MonitorFromWindow CreateWindowExW GetCursorPos ReleaseCapture GetSysColor InvalidateRect IntersectRect TranslateMessage UnionRect IsZoomed PostMessageW GetFocus SetTimer KillTimer SetCapture GetParent LoadImageW SetWindowRgn MessageBoxW GetKeyNameTextW GetKeyboardLayout MapVirtualKeyExW DefWindowProcW ShowWindow EnableWindow PostQuitMessage RegisterClassW GetClassInfoExW RegisterClassExW CallWindowProcW SetPropW GetPropW FillRect DrawTextW SetRect InflateRect OffsetRect DispatchMessageW CharNextW CharPrevW MoveWindow UpdateLayeredWindow GetWindowRgn IsRectEmpty IsWindow GetMessageW SetForegroundWindow GetGUIThreadInfo CreateAcceleratorTableW InvalidateRgn GetWindowTextW GetWindowTextLengthW SetWindowTextW EqualRect IsWindowEnabled DestroyMenu TrackPopupMenu EnableMenuItem AppendMenuW CreatePopupMenu GetCaretBlinkTime ClientToScreen SetCaretPos GetCaretPos HideCaret ShowCaret CreateCaret

gdi32

SetBitmapBits GetBitmapBits CreatePatternBrush PtInRegion CreateRectRgn GdiFlush TextOutW GetTextExtentPoint32W GetCharABCWidthsW SetBkColor SetTextColor SetBkMode GetObjectA RoundRect LineTo MoveToEx CreatePenIndirect CreateSolidBrush SetStretchBltMode StretchBlt CreateDIBSection CombineRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox SelectClipRgn CreateRoundRectRgn CreateCompatibleBitmap GetDeviceCaps GetEnhMetaFileHeader CreateDIBitmap AddFontMemResourceEx GetTextMetricsW CloseEnhMetaFile CreateEnhMetaFileW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC SelectObject CreateCompatibleDC DeleteDC RemoveFontMemResourceEx DeleteObject CreatePen CreateFontIndirectW GetStockObject GetObjectW PlayEnhMetaFile

advapi32

RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegOpenKeyExA RegQueryValueExA RegCloseKey RegEnumKeyExW RegQueryValueExW RegOpenKeyExW

shell32

ord165 DragQueryFileW SHGetFolderPathA ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHGetSpecialFolderPathW

ole32

DoDragDrop OleDuplicateData CoCreateGuid CoInitialize CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemFree CreateStreamOnHGlobal ReleaseStgMedium OleLockRunning CLSIDFromString CLSIDFromProgID RegisterDragDrop

comctl32

_TrackMouseEvent ord17

gdiplus

GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipSetInterpolationMode GdipSetSmoothingMode GdipSetTextRenderingHint GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawString GdipSetPenMode GdipDeletePen GdipCreatePen1 GdipSetStringFormatLineAlign GdipDeleteBrush GdipCreateSolidFill GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImage GdipCloneImage GdipAlloc GdipFree GdipLoadImageFromStream GdiplusShutdown GdiplusStartup GdipDrawImageRectI GdipRotateWorldTransform GdipTranslateWorldTransform GdipFillRectangleI GdipMeasureString GdipDrawRectangleI

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

winhttp

WinHttpOpen WinHttpSetTimeouts WinHttpCrackUrl WinHttpConnect WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpSendRequest WinHttpSetOption WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpCloseHandle

shlwapi

PathIsDirectoryW PathFileExistsW PathAddBackslashW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

netapi32

Netbios

Name

.text

Size

800KB

Virtual Size

799KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

198KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.QMGuid

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

26bd4cd169b2c48cc0902d1433600c6c_JaffaCakes118

ws2_32

dbghelp

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

gdiplus

imm32

winhttp

shlwapi

version

netapi32

generic