5004b4476b444d2c4844d2212c5846b8_JaffaCakes118

General

Target
5004b4476b444d2c4844d2212c5846b8_JaffaCakes118
Size 3.7MB
Sample240517-rye9wacc38
SHA256 f5eadcf63b4c9c6b3bf4cf6b852e40eb87486a407909a0ca12b1367ce7d11dbb
MD5 5004b4476b444d2c4844d2212c5846b8
SHA1 ef16ea49568cdd9625df3683ebabc06378fc23fb
SHA512 c71eff6d9cdfefbfe9326a7d5e200ed84219b76b27459509c214b577a2e7084d67d446c61fd9ce39b568fc814a77e36703b5cf2e5a8e70cc0bee81376a479d1f
SSDEEP 98304:/elwVfg+xRnkkfusDPj8+WKGC+w0E48W:mlwzPkGPjVGC+DE48W
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5004b4476b444d2c4844d2212c5846b8_JaffaCakes118

File Explorer

5004b4476b444d2c4844d2212c5846b8_JaffaCakes118

.exe 3.7MB

5004b4476b444d2c4844d2212c5846b8_JaffaCakes118

IMPHASH 79a1e51475910db8ccaf17a8f3958e04
SHA256 f5eadcf63b4c9c6b3bf4cf6b852e40eb87486a407909a0ca12b1367ce7d11dbb
MD5 5004b4476b444d2c4844d2212c5846b8
SHA1 ef16ea49568cdd9625df3683ebabc06378fc23fb
SHA512 c71eff6d9cdfefbfe9326a7d5e200ed84219b76b27459509c214b577a2e7084d67d446c61fd9ce39b568fc814a77e36703b5cf2e5a8e70cc0bee81376a479d1f
SSDEEP 98304:/elwVfg+xRnkkfusDPj8+WKGC+w0E48W:mlwzPkGPjVGC+DE48W
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\befarem.pdb

kernel32

SetEvent GetNumaAvailableMemoryNode GetModuleHandleW GetTickCount GlobalAlloc SizeofResource SetConsoleMode TerminateProcess GetACP GetStringTypeExA GetProcAddress InterlockedCompareExchange GetProcessWorkingSetSize CreateEventW FindFirstChangeNotificationA GetCommTimeouts lstrcatW GetCurrentThreadId FindActCtxSectionStringW DeleteFileA GetUserDefaultLCID _lwrite UpdateResourceA SetEndOfFile EnumDateFormatsExW GetNumaNodeProcessorMask GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent DecodePointer EncodePointer EnterCriticalSection LeaveCriticalSection GetStdHandle InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetLastError HeapFree CloseHandle SetFilePointer WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo InterlockedIncrement InterlockedDecrement GetOEMCP IsValidCodePage TlsGetValue TlsSetValue SetLastError Sleep ExitProcess RtlUnwind SetStdHandle FlushFileBuffers WriteConsoleW MultiByteToWideChar LCMapStringW GetStringTypeW HeapAlloc LoadLibraryW GetModuleFileNameW CreateFileW

user32

GetCaretPos

advapi32

GetPrivateObjectSecurity AddAuditAccessAce DestroyPrivateObjectSecurity

winhttp

WinHttpCreateUrl

msimg32

TransparentBlt

Sharing

General

Malware Config

Signatures

File Explorer

5004b4476b444d2c4844d2212c5846b8_JaffaCakes118

kernel32

user32

advapi32

winhttp

msimg32

generic