3906bac2d392f85e18ca03c5bf15da72_JaffaCakes118

General

Target
3906bac2d392f85e18ca03c5bf15da72_JaffaCakes118
Size 206KB
Sample240512-jm77hsae79
SHA256 7e5a30abc6deff1ff15e54352966fb9947ebf1b1687f6f26177a4f8967ba97ea
MD5 3906bac2d392f85e18ca03c5bf15da72
SHA1 ae1b26685e19d54e6b77674a2845df487678ed26
SHA512 614a5912350ae94f66f8eba3e59c1fc123947173fc0579a3dbddb575160110df5bf74b9608d6e2bb7fe9bd97d7b80b856d9f92d6e5b1e4c72669e999bb1ef49b
SSDEEP 3072:ZiA2LrToQl++lUKfmgUkueC6yrKry8Uf1KlwOeGk8:0A2L4xSibk5CleryG08
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3906bac2d392f85e18ca03c5bf15da72_JaffaCakes118

File Explorer

3906bac2d392f85e18ca03c5bf15da72_JaffaCakes118

.exe 206KB

3906bac2d392f85e18ca03c5bf15da72_JaffaCakes118

IMPHASH 2c010732ebe5672c39f17b92c057613d
SHA256 7e5a30abc6deff1ff15e54352966fb9947ebf1b1687f6f26177a4f8967ba97ea
MD5 3906bac2d392f85e18ca03c5bf15da72
SHA1 ae1b26685e19d54e6b77674a2845df487678ed26
SHA512 614a5912350ae94f66f8eba3e59c1fc123947173fc0579a3dbddb575160110df5bf74b9608d6e2bb7fe9bd97d7b80b856d9f92d6e5b1e4c72669e999bb1ef49b
SSDEEP 3072:ZiA2LrToQl++lUKfmgUkueC6yrKry8Uf1KlwOeGk8:0A2L4xSibk5CleryG08
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

20768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_SYSTEM

PDB paths

kernel32

SetProcessWorkingSetSize GetCurrentProcess GetThreadTimes ExitThread TerminateThread GetLastError SetStdHandle SetHandleInformation LocalAlloc GetCommTimeouts TransmitCommChar lstrcpyA WriteFileGather GetModuleHandleW AddAtomW SetComputerNameExW SetConsoleCtrlHandler GlobalMemoryStatus GetCommConfig GetProcAddress CloseHandle WriteConsoleW SetFilePointerEx GetConsoleMode EncodePointer DecodePointer RaiseException RtlUnwind GetCommandLineA IsProcessorFeaturePresent HeapAlloc HeapFree ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte HeapSize IsDebuggerPresent SetLastError GetCurrentThreadId GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW EnterCriticalSection LeaveCriticalSection LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapReAlloc OutputDebugStringW GetStringTypeW FlushFileBuffers GetConsoleCP CreateFileW

advapi32

GetSecurityDescriptorControl GetSecurityDescriptorDacl

winhttp

WinHttpWriteData WinHttpConnect WinHttpQueryDataAvailable

Name

.text

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

69KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.version

Size

512B

Virtual Size

1B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.version

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3906bac2d392f85e18ca03c5bf15da72_JaffaCakes118

kernel32

advapi32

winhttp

generic