703c7d7e16350d80bfb12dc1c13937b4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
703c7d7e16350d80bfb12dc1c13937b4_JaffaCakes118
Size 807KB
Sample240525-aeafvafg41
SHA256 97c46d11bbcc9c173b7ffe9b218c80c4e33d3edab8b47ef34606a8e4c290c95e
MD5 703c7d7e16350d80bfb12dc1c13937b4
SHA1 baaf2bb1f395e9691986482b1c137a44eadc396e
SHA512 643634107232de0a086bc0a54e911f5ab64263097b2c2288e9a438bac58d982ded7151bcbbdd417b63ac55533540e5d4cae063f2c24e910cc8316b90fa8c54f2
SSDEEP 12288:XB0z4tN/qGDb+DLUFJYkp6d1BtOkodxduog/TXJa/x82IErOJsLV/QtOM:LCA+OJJuog/TXJmxOgI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
703c7d7e16350d80bfb12dc1c13937b4_JaffaCakes118

File Explorer

703c7d7e16350d80bfb12dc1c13937b4_JaffaCakes118

.exe 807KB

703c7d7e16350d80bfb12dc1c13937b4_JaffaCakes118

IMPHASH d248e7506bbb57c42ab299a2d816544c
SHA256 97c46d11bbcc9c173b7ffe9b218c80c4e33d3edab8b47ef34606a8e4c290c95e
MD5 703c7d7e16350d80bfb12dc1c13937b4
SHA1 baaf2bb1f395e9691986482b1c137a44eadc396e
SHA512 643634107232de0a086bc0a54e911f5ab64263097b2c2288e9a438bac58d982ded7151bcbbdd417b63ac55533540e5d4cae063f2c24e910cc8316b90fa8c54f2
SSDEEP 12288:XB0z4tN/qGDb+DLUFJYkp6d1BtOkodxduog/TXJa/x82IErOJsLV/QtOM:LCA+OJJuog/TXJmxOgI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

112320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\r\ws\St_Make\code\build\win\results\FlashPlayerApp\Release\Win32\FlashPlayerApp.pdb

uxtheme

GetCurrentThemeName

kernel32

GetFileSizeEx CloseHandle CreateDirectoryW GetLastError WideCharToMultiByte GetSystemWow64DirectoryW GetSystemDirectoryW VerSetConditionMask VerifyVersionInfoW GetModuleHandleW GetProcAddress GetCommandLineW SetLastError GetModuleHandleA LoadLibraryA LoadLibraryW GetModuleFileNameW OutputDebugStringA DeleteCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection RaiseException GetCurrentThreadId DecodePointer CreateProcessW WaitForSingleObject GetExitCodeProcess GetUserDefaultUILanguage GetVersionExW CreateFileW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetConsoleCP ReadConsoleW GetConsoleMode GetFileType SetFilePointerEx ReadFile LCMapStringW HeapReAlloc HeapSize GetStringTypeW GetFileAttributesW FindClose DeleteFileW FindNextFileW FindFirstFileW SystemTimeToFileTime GetSystemTime RemoveDirectoryW MultiByteToWideChar WriteConsoleW FlushFileBuffers SetEndOfFile GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess RtlUnwind LoadLibraryExW FreeLibrary TlsFree IsDebuggerPresent OutputDebugStringW EncodePointer HeapAlloc HeapFree GetProcessHeap InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TlsAlloc TlsGetValue TlsSetValue

user32

GetDesktopWindow SendMessageW SetWindowPos CreateWindowExW MapWindowPoints ClientToScreen ReleaseDC GetDC GetNextDlgTabItem GetFocus EndDialog GetWindowTextW GetWindowTextLengthW SetFocus DestroyWindow CallWindowProcW DefWindowProcW MoveWindow GetWindowRect GetClientRect DialogBoxParamW GetActiveWindow MessageBoxW SetWindowLongW GetParent GetWindowLongW GetWindow EnableWindow ShowWindow GetDlgItem SetWindowTextW UnregisterClassW

gdi32

SelectObject GetTextExtentPoint32W

advapi32

CheckTokenMembership AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA FreeSid

shell32

SHGetFolderPathW ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW SHFileOperationW

ole32

CoTaskMemFree

Name

.text

Size

187KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

499KB

Virtual Size

499KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

703c7d7e16350d80bfb12dc1c13937b4_JaffaCakes118

uxtheme

kernel32

user32

gdi32

advapi32

shell32

ole32

generic