580deeed50ebf99ca13672d741ba76eb_JaffaCakes118

General

Target
580deeed50ebf99ca13672d741ba76eb_JaffaCakes118
Size 1.5MB
Sample240519-cm3hpsdd32
SHA256 16faa719cc7c17157e3adc99eef37c478f375c022902d548ed497f05da919a80
MD5 580deeed50ebf99ca13672d741ba76eb
SHA1 3979335642f4c43167d906c917416bd4b9178cc3
SHA512 31fbe588533f3fb52afde66b3d92a160d0bc0da8863a0d23eed8c94ec1ff492edbf14190a522787c62968f00f78b31eb3e472607358d098663dd2d0b7b5ec6dc
SSDEEP 49152:VN2oHiyVAy8kjVjJ5ShsNDWD2KwrvwVP1IFDci6uSZ4w:VN1iq9xjJMhsNCbmIt14o/P
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
580deeed50ebf99ca13672d741ba76eb_JaffaCakes118

File Explorer

580deeed50ebf99ca13672d741ba76eb_JaffaCakes118

.exe 1.5MB

580deeed50ebf99ca13672d741ba76eb_JaffaCakes118

IMPHASH 440d3db4faf888398573094fda651045
SHA256 16faa719cc7c17157e3adc99eef37c478f375c022902d548ed497f05da919a80
MD5 580deeed50ebf99ca13672d741ba76eb
SHA1 3979335642f4c43167d906c917416bd4b9178cc3
SHA512 31fbe588533f3fb52afde66b3d92a160d0bc0da8863a0d23eed8c94ec1ff492edbf14190a522787c62968f00f78b31eb3e472607358d098663dd2d0b7b5ec6dc
SSDEEP 49152:VN2oHiyVAy8kjVjJ5ShsNDWD2KwrvwVP1IFDci6uSZ4w:VN1iq9xjJMhsNCbmIt14o/P
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

74518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA GetModuleHandleA CloseHandle DeleteFileA GetFullPathNameA GetThreadContext GetCurrentThread IsBadReadPtr ExpandEnvironmentStringsA WideCharToMultiByte GetFileAttributesA GetEnvironmentVariableA MultiByteToWideChar CreateDirectoryA FindFirstFileA CreateFileMappingA RemoveDirectoryA FindClose LoadLibraryA GetCurrentDirectoryA GetCurrentProcessId GetTempPathA GetVolumeInformationW MoveFileExA CreateProcessW SystemTimeToFileTime WaitForSingleObject GetExitCodeProcess TerminateProcess GetLastError GetTempFileNameA GetLocalTime SetLastError WriteFile UnmapViewOfFile MapViewOfFile GetFileSize GetProcAddress CreateFileA CreateFileW HeapFree HeapAlloc GetCommandLineA IsProcessorFeaturePresent InterlockedDecrement ExitProcess GetModuleHandleExW HeapSize Sleep GetStdHandle GetModuleFileNameW RaiseException GetProcessHeap IsDebuggerPresent InterlockedIncrement IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind GetConsoleMode SetFilePointerEx GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW HeapReAlloc OutputDebugStringW LoadLibraryW LCMapStringW GetStringTypeW GetConsoleCP SetStdHandle FlushFileBuffers WriteConsoleW VirtualQuery

advapi32

CheckTokenMembership FreeSid AllocateAndInitializeSid RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

580deeed50ebf99ca13672d741ba76eb_JaffaCakes118

kernel32

advapi32

shell32

generic