6ac35042d936917d2656d07e64f59a67_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
6ac35042d936917d2656d07e64f59a67_JaffaCakes118
Size 6.9MB
Sample240523-ndqckaeb76
SHA256 aca082adca66942dc75280547192560d16804c4248933eba68e2c4455afedf08
MD5 6ac35042d936917d2656d07e64f59a67
SHA1 67f0828b9f1c60840cba3f882f946d82e7a09eb8
SHA512 bef25473ae345bc36c09f45fb1eb5f8c83f7b1efaa44c2e80dd739fd4fd85101bb0ad381b896c2490a2f7acfd3dc46e15f2af7db97b0e5c225b4bfbf4eb1d8ef
SSDEEP 49152:QzEwTT/uoLoQTPLZMAIOyAsfd9rIr3eEvfAlLjjvi:QYwTT/usTjBfAY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

6ac35042d936917d2656d07e64f59a67_JaffaCakes118

.exe 6.9MB

6ac35042d936917d2656d07e64f59a67_JaffaCakes118

IMPHASH 267962dcb688834b5dd6fd9f808af1f3
SHA256 aca082adca66942dc75280547192560d16804c4248933eba68e2c4455afedf08
MD5 6ac35042d936917d2656d07e64f59a67
SHA1 67f0828b9f1c60840cba3f882f946d82e7a09eb8
SHA512 bef25473ae345bc36c09f45fb1eb5f8c83f7b1efaa44c2e80dd739fd4fd85101bb0ad381b896c2490a2f7acfd3dc46e15f2af7db97b0e5c225b4bfbf4eb1d8ef
SSDEEP 49152:QzEwTT/uoLoQTPLZMAIOyAsfd9rIr3eEvfAlLjjvi:QYwTT/usTjBfAY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

b1:8d:46:43:f9:fa:9a:a2:b1:a1:23:8d:a9:cf:1e:cc:e7:33:e8:ec

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 20, 2014

Minor OS version

Major OS version

Entry point

180020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\src\Disk2vhd\release\disk2vhd.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

vssapi

?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z

comctl32

ord17

cabinet

ord20 ord23 ord22

rpcrt4

UuidCreate

kernel32

FindNextFileW GetDiskFreeSpaceExW GetFullPathNameW GetCommandLineW CopyFileExW GetDriveTypeW FindResourceW LoadResource InterlockedIncrement MoveFileExW GetCurrentProcess GetComputerNameW OutputDebugStringW LoadLibraryW CopyFileW SizeofResource FormatMessageW GetVersionExW GetExitCodeProcess GetFileAttributesW GetStdHandle GetCurrentDirectoryW MoveFileW LockResource GetSystemInfo GetVolumeNameForVolumeMountPointW DeleteFileW LocalFree SetFileAttributesW GetVolumeInformationW ExpandEnvironmentStringsW LocalAlloc SleepEx WaitForSingleObjectEx GetTickCount InitializeCriticalSection LeaveCriticalSection ReleaseSemaphore ReadFileEx EnterCriticalSection GetLocalTime CreateSemaphoreW DeleteCriticalSection WriteFileEx GetVolumePathNameW ExpandEnvironmentStringsA GetStringTypeW GetStringTypeA DeviceIoControl CloseHandle SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW MultiByteToWideChar LCMapStringA HeapSize RtlUnwind RaiseException IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount TlsFree TlsSetValue TlsAlloc TlsGetValue FlushFileBuffers GetConsoleMode GetConsoleCP GetFileType SetHandleCount GetModuleFileNameA HeapCreate VirtualAlloc VirtualFree GetStartupInfoA GetCommandLineA GetSystemTimeAsFileTime HeapReAlloc CreateThread GetCurrentThreadId ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess HeapFree ExitProcess CreateEventW FindClose GetDiskFreeSpaceW GetProcAddress SetLastError GetLastError GetOverlappedResult CreateFileW GetModuleHandleW WaitForSingleObject InterlockedDecrement GetLocaleInfoA FindFirstFileW GetFileTime ReadFile WideCharToMultiByte WriteFile SetFilePointer CreateFileA GetModuleFileNameW lstrlenA LoadLibraryA GetModuleHandleA Sleep HeapAlloc GetProcessHeap SetEndOfFile

user32

ScreenToClient GetWindowRect GetMessageW PostQuitMessage PostMessageW IsZoomed GetParent LoadCursorW IsWindowEnabled GetClientRect SetPropW GetDC TranslateMessage LoadAcceleratorsW ChildWindowFromPoint IsDialogMessageW LoadIconW OffsetRect InflateRect InvalidateRect GetWindowLongW GetClassNameW ReleaseDC GetDlgItem SetWindowLongW TranslateAcceleratorW GetSysColor CheckDlgButton EnumChildWindows ShowWindow GetSysColorBrush IsDlgButtonChecked CreateDialogParamW GetActiveWindow DeferWindowPos MessageBoxW BeginDeferWindowPos RegisterClassW GetSystemMetrics GetDlgItemTextW SetDlgItemTextW SendMessageW EnableWindow SetWindowTextW EndDeferWindowPos DrawFrameControl GetPropW CallWindowProcW DefWindowProcW DispatchMessageW DialogBoxIndirectParamW EndDialog SetCursor UnionRect PtInRect

gdi32

StartPage GetDeviceCaps SetMapMode StartDocW EndDoc SetTextColor CreateFontIndirectW SetBkMode SelectObject GetObjectW GetStockObject EndPage

comdlg32

PrintDlgW GetSaveFileNameW

advapi32

RegQueryValueExA RegCreateKeyW RegSetValueExW AdjustTokenPrivileges RegFlushKey RegDeleteValueW LookupPrivilegeValueW RegCreateKeyExW OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW RegOpenKeyExA

shell32

ShellExecuteExW CommandLineToArgvW

ole32

CoCreateInstance CoInitialize CoCreateGuid CoUninitialize CLSIDFromString

oleaut32

SysAllocString SysFreeString SysStringLen SysAllocStringByteLen VariantClear VariantInit SystemTimeToVariantTime VariantChangeType

shlwapi

PathFindExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

6ac35042d936917d2656d07e64f59a67_JaffaCakes118

PE Signature issue

version

vssapi

comctl32

cabinet

rpcrt4

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

generic