736a0425d1c451e4a1dbba7150303528_JaffaCakes118

General

Target
736a0425d1c451e4a1dbba7150303528_JaffaCakes118
Size 845KB
Sample240525-141bnsch43
SHA256 46f165d40a21fa438bf1424a4a62a30aef5c486db9daaf8efa2a47c6d3242235
MD5 736a0425d1c451e4a1dbba7150303528
SHA1 a123f1fd15d929ea88ad711ad54a7e22eb4f45b2
SHA512 a40ebdde703dd5eca09367357c6a23166c39d1aa4986b20957a4e597bab2a440cc2ebf2600303304d8ace2071b652c7fe4c99dc99ceb7f742de3296aba2d2994
SSDEEP 12288:+ZYS0rWC0oauiqFenLhYfimHrYn9G9pMGA5W44abg8wsNbJVXFGVV5Ug2OaCJvy/:AYS0rZeL+fimo9d5u0ZJVXFGuODnd/y
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
736a0425d1c451e4a1dbba7150303528_JaffaCakes118

File Explorer

736a0425d1c451e4a1dbba7150303528_JaffaCakes118

.exe 845KB

736a0425d1c451e4a1dbba7150303528_JaffaCakes118

IMPHASH 40aecdfe9fbee87c007f78b43159455e
SHA256 46f165d40a21fa438bf1424a4a62a30aef5c486db9daaf8efa2a47c6d3242235
MD5 736a0425d1c451e4a1dbba7150303528
SHA1 a123f1fd15d929ea88ad711ad54a7e22eb4f45b2
SHA512 a40ebdde703dd5eca09367357c6a23166c39d1aa4986b20957a4e597bab2a440cc2ebf2600303304d8ace2071b652c7fe4c99dc99ceb7f742de3296aba2d2994
SSDEEP 12288:+ZYS0rWC0oauiqFenLhYfimHrYn9G9pMGA5W44abg8wsNbJVXFGVV5Ug2OaCJvy/:AYS0rZeL+fimo9d5u0ZJVXFGuODnd/y
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

92727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RemoveDirectoryA GetTempPathA CloseHandle WriteFile CreateFileA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect LoadLibraryA GetProcAddress VirtualAlloc GetCurrentThreadId CreateDirectoryA FreeLibrary DeleteCriticalSection GetCommandLineW GetTickCount CreateEventA SetEvent Sleep GetCurrentProcessId GetCurrentProcess CopyFileW DeleteFileW GetFullPathNameW GetTempPathW SetCurrentDirectoryA GetModuleFileNameW VirtualFree SizeofResource LoadResource GetModuleHandleA WaitForSingleObject FindResourceW GetLastError HeapFree ReadFile GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW GetSystemTimeAsFileTime HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo GetFileAttributesExW SetStdHandle FlushFileBuffers GetConsoleCP CreateFileW HeapReAlloc OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW WriteConsoleW SetEndOfFile HeapSize

advapi32

CryptContextAddRef CryptExportKey CryptDuplicateHash

comctl32

ImageList_Write ImageList_Destroy ImageList_DragMove

Sharing

General

Malware Config

Signatures

File Explorer

736a0425d1c451e4a1dbba7150303528_JaffaCakes118

kernel32

advapi32

comctl32

generic