540ea04b889a258e9b838abd27fbb5a9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
540ea04b889a258e9b838abd27fbb5a9_JaffaCakes118
Size 9.4MB
Sample240518-levmkade3v
SHA256 ed0abebc399e10d0efa81e8708d03412c36fbb7d9fd35312136c25174be81b04
MD5 540ea04b889a258e9b838abd27fbb5a9
SHA1 4c4ef953c7689b34a36a4d787c053a8de0ccf28e
SHA512 4363894838acada5fd97ead4414db1bcbe166465d10c84c617802781cb953c02b52c056d7ecb5d57264211fd93ce5985e216d9ffd70a9b97388118fb92edd7a2
SSDEEP 196608:YN1yJMmqc7lsgmCktZ3GRRdxH23Cu7vlW3Eg1g++ytSskW1:aDB7nbtRWNsFlX79ak
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
540ea04b889a258e9b838abd27fbb5a9_JaffaCakes118

File Explorer

540ea04b889a258e9b838abd27fbb5a9_JaffaCakes118

.exe 9.4MB

540ea04b889a258e9b838abd27fbb5a9_JaffaCakes118

IMPHASH be596808bbcef61eb2e7bc858fff616a
SHA256 ed0abebc399e10d0efa81e8708d03412c36fbb7d9fd35312136c25174be81b04
MD5 540ea04b889a258e9b838abd27fbb5a9
SHA1 4c4ef953c7689b34a36a4d787c053a8de0ccf28e
SHA512 4363894838acada5fd97ead4414db1bcbe166465d10c84c617802781cb953c02b52c056d7ecb5d57264211fd93ce5985e216d9ffd70a9b97388118fb92edd7a2
SSDEEP 196608:YN1yJMmqc7lsgmCktZ3GRRdxH23Cu7vlW3Eg1g++ytSskW1:aDB7nbtRWNsFlX79ak
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14171243

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nv_fatb

Size

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nvFatBi

Size

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=28, id=241, version=40116,

count=168, id=243, version=40116,

count=79, id=242, version=40116,

count=6, id=199, version=41118,

count=8, id=259, version=24123,

count=117, id=261, version=24123,

count=41, id=260, version=24123,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=290, id=1, productName=Unmarked objects,

count=13, id=203, version=65501,

count=41, id=264, version=24215,

count=5, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=35, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

540ea04b889a258e9b838abd27fbb5a9_JaffaCakes118

ws2_32

advapi32

iphlpapi

kernel32

user32

generic