3c7f43fa6a1313c123dae64181f361b2_JaffaCakes118

General

Target
3c7f43fa6a1313c123dae64181f361b2_JaffaCakes118
Size 822KB
Sample240513-zh16eadf59
SHA256 7f0a7b8aed74194f01e4d79d4ff96d56ce5ad517ac91d92c4ad587e3e000dcb9
MD5 3c7f43fa6a1313c123dae64181f361b2
SHA1 460fe57ef522658f3fc4b196bbaaad0610c24f21
SHA512 1366c02101fb74bc25395c845dc4f5c5ee5c4cf4ad7dc56cf6b628438d15b84ff97ff77907db739a5f739611c9d130190c275734e54688f60244f4e64e4b0e4e
SSDEEP 24576:3LYXfg7pV1Hc1vUUMt+XW0NwVP+MChnfMWLubRdhJiWn:3UX2318RUU66VOVP+rhfMWCzVn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c7f43fa6a1313c123dae64181f361b2_JaffaCakes118

File Explorer

3c7f43fa6a1313c123dae64181f361b2_JaffaCakes118

.exe 822KB

3c7f43fa6a1313c123dae64181f361b2_JaffaCakes118

IMPHASH bef24509fb27f03e50434e3f1cbf2435
SHA256 7f0a7b8aed74194f01e4d79d4ff96d56ce5ad517ac91d92c4ad587e3e000dcb9
MD5 3c7f43fa6a1313c123dae64181f361b2
SHA1 460fe57ef522658f3fc4b196bbaaad0610c24f21
SHA512 1366c02101fb74bc25395c845dc4f5c5ee5c4cf4ad7dc56cf6b628438d15b84ff97ff77907db739a5f739611c9d130190c275734e54688f60244f4e64e4b0e4e
SSDEEP 24576:3LYXfg7pV1Hc1vUUMt+XW0NwVP+MChnfMWLubRdhJiWn:3UX2318RUU66VOVP+rhfMWCzVn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

99347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA SetCurrentDirectoryA RemoveDirectoryA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect GetProcAddress LoadLibraryA VirtualAlloc GetCurrentThreadId WaitForSingleObject GetTempPathW DeleteCriticalSection FreeLibrary GetTickCount GetCommandLineW CreateEventA Sleep SetEvent GetCurrentProcessId GetCurrentProcess DeleteFileW CopyFileW GetFullPathNameW GetTempPathA GetModuleFileNameW VirtualFree SizeofResource LoadResource GetModuleHandleA CloseHandle FindResourceW GetLastError HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

CryptExportKey AbortSystemShutdownW AddAuditAccessAce

comctl32

ImageList_SetDragCursorImage ImageList_DragMove DestroyPropertySheetPage

Sharing

General

Malware Config

Signatures

File Explorer

3c7f43fa6a1313c123dae64181f361b2_JaffaCakes118

kernel32

advapi32

comctl32

generic