6d807a28556c844e807fee5bec250f79_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
6d807a28556c844e807fee5bec250f79_JaffaCakes118
Size 3.4MB
Sample240524-ger48afd76
SHA256 c8c53f25f6118bb1645a12b198fe1cb8b99ceb417df5a1d0a210ac720fba33de
MD5 6d807a28556c844e807fee5bec250f79
SHA1 5778c79d584cbd9d9f70c639d44f263bb748aa5a
SHA512 98d03cbd5e9a2019f60295aa4524f5dfcea1b26c0dadd5c8d5513c109cb217e97ddf459926788d21bfe2fd5c37685a54637477f4d5adb3797085069f72f200c4
SSDEEP 49152:NC6dQ5F8MmZDIqO8KoBpk54bUuvwFKkiYQVMEByjjT7cHLNsKyc/owR34f1E+s:1av8Mm0kG54ou0KNFVMGy/oLWc/oiOWV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mssecsvc.bin

File Explorer

6d807a28556c844e807fee5bec250f79_JaffaCakes118

.zip 3.4MB
mssecsvc.bin

.exe 3.6MB

6d807a28556c844e807fee5bec250f79_JaffaCakes118

SHA256 c8c53f25f6118bb1645a12b198fe1cb8b99ceb417df5a1d0a210ac720fba33de
MD5 6d807a28556c844e807fee5bec250f79
SHA1 5778c79d584cbd9d9f70c639d44f263bb748aa5a
SHA512 98d03cbd5e9a2019f60295aa4524f5dfcea1b26c0dadd5c8d5513c109cb217e97ddf459926788d21bfe2fd5c37685a54637477f4d5adb3797085069f72f200c4
SSDEEP 49152:NC6dQ5F8MmZDIqO8KoBpk54bUuvwFKkiYQVMEByjjT7cHLNsKyc/owR34f1E+s:1av8Mm0kG54ou0KNFVMGy/oLWc/oiOWV
MD5 SHA1 SHA512 SSDEEP

Password

infected

mssecsvc.bin

IMPHASH 9ecee117164e0b870a53dd187cdd7174
SHA256 95ab184ecc89b9a593c024963650f54fe0a597c3f75d75ff3bf4f33f648c6d13
MD5 41b5ba4bf74e65845fa8c9861ca34508
SHA1 427934d7fa2467bab1abfa5959c8cf6d0ae00ea7
SHA512 ef55010669b1098df68c511d6863082abcc2ed4af78d933a1fb8dad347893eebc44ade3e41b3fe296a11dd3cf026bdb0d8359dd759569df5d7b37f9294921a48
SSDEEP 98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HJ:yDqPe1Cxcxk3ZAEUadzR8yc4HJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject InterlockedIncrement GetCurrentThreadId GetCurrentThread ReadFile GetFileSize CreateFileA MoveFileExA SizeofResource TerminateThread LoadResource FindResourceA GetProcAddress GetModuleHandleW ExitProcess GetModuleFileNameA LocalFree LocalAlloc CloseHandle InterlockedDecrement EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GlobalAlloc GlobalFree QueryPerformanceFrequency QueryPerformanceCounter GetTickCount LockResource Sleep GetStartupInfoA GetModuleHandleA

advapi32

StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA ChangeServiceConfig2A SetServiceStatus OpenSCManagerA CreateServiceA CloseServiceHandle StartServiceA CryptGenRandom CryptAcquireContextA OpenServiceA

ws2_32

closesocket recv send htonl ntohl WSAStartup inet_ntoa ioctlsocket select htons socket connect inet_addr

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

iphlpapi

GetAdaptersInfo GetPerAdapterInfo

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle

msvcrt

__set_app_type _stricmp __p__fmode __p__commode _except_handler3 __setusermatherr _initterm __getmainargs _acmdln _adjust_fdiv _controlfp exit _XcptFilter _exit _onexit __dllonexit free ??2@YAPAXI@Z _ftol sprintf _endthreadex strncpy rand _beginthreadex __CxxFrameHandler srand time __p___argc

Sharing

General

Malware Config

Signatures

File Explorer

6d807a28556c844e807fee5bec250f79_JaffaCakes118

mssecsvc.bin

kernel32

advapi32

ws2_32

msvcp60

iphlpapi

wininet

msvcrt

generic