744df373a73eae2758e6a0921fef9d39_JaffaCakes118

General

Target
744df373a73eae2758e6a0921fef9d39_JaffaCakes118
Size 318KB
Sample240526-eyc4asfd79
SHA256 ce05e7df614f5a9c3b12bea62243faaf95d5005f45e66dff9d76f94df1f32cbd
MD5 744df373a73eae2758e6a0921fef9d39
SHA1 24bc331819cc9291af4288843adccab22a89ea29
SHA512 210f06502451117fa128a355dc36539fe9fd32c527f994eaa40d788d54b215ad445d4cfc8b4839087bc228040702d0bce2c38932a85b571edf76c7c67800fb17
SSDEEP 6144:cNQXGRSIltkmQuM/Kom/135fgeKHr+WqwyS/+RM3aPAXJqo3InwHNXwaF:cNQXGYIlJLDoC5fq+6yHMKPAJXpX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
744df373a73eae2758e6a0921fef9d39_JaffaCakes118

File Explorer

744df373a73eae2758e6a0921fef9d39_JaffaCakes118

.exe 318KB

744df373a73eae2758e6a0921fef9d39_JaffaCakes118

IMPHASH 13ce0ce984d4e669edbea9ecc151a467
SHA256 ce05e7df614f5a9c3b12bea62243faaf95d5005f45e66dff9d76f94df1f32cbd
MD5 744df373a73eae2758e6a0921fef9d39
SHA1 24bc331819cc9291af4288843adccab22a89ea29
SHA512 210f06502451117fa128a355dc36539fe9fd32c527f994eaa40d788d54b215ad445d4cfc8b4839087bc228040702d0bce2c38932a85b571edf76c7c67800fb17
SSDEEP 6144:cNQXGRSIltkmQuM/Kom/135fgeKHr+WqwyS/+RM3aPAXJqo3InwHNXwaF:cNQXGYIlJLDoC5fq+6yHMKPAJXpX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegOpenKeyExW RegQueryValueExW LsaEnumerateTrustedDomainsEx ControlService IdentifyCodeAuthzLevelW QueryServiceStatus RegOpenKeyW RegCloseKey GetSidIdentifierAuthority

dbghelp

ImageDirectoryEntryToData ImageNtHeader

oleaut32

CreateTypeLib2 VariantClear

user32

ShowWindowAsync CharNextW PostThreadMessageW GetMessageW CharUpperW DispatchMessageW EnumThreadWindows GetForegroundWindow

kernel32

LeaveCriticalSection GetModuleHandleA InterlockedDecrement SetLastError SetUnhandledExceptionFilter GetEnvironmentVariableW ResetEvent LoadLibraryW CreateEventW Sleep RaiseException WaitForSingleObject VirtualProtect GetCommandLineW ExitProcess CreateMutexW GetCurrentProcess ReleaseSemaphore SetEnvironmentVariableW GetCurrentProcessId CreateSemaphoreW InterlockedIncrement GetCurrentThreadId FreeConsole SetEvent FreeLibrary EnterCriticalSection InitializeCriticalSectionAndSpinCount LoadLibraryA IsDebuggerPresent GetStartupInfoW GetProcAddress CreateThread HeapSetInformation

shell32

SHLoadNonloadedIconOverlayIdentifiers SHCreateProcessAsUserW SHLoadInProc SHFormatDrive SHGetSpecialFolderPathW

ole32

CoCreateInstance CoGetClassObject CoRegisterSurrogate CLSIDFromString CoInitializeSecurity CoRevokeClassObject CoResumeClassObjects CoCreateGuid CoAddRefServerProcess StringFromGUID2 CoInitializeEx CoUninitialize

Name

.text

Size

46KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

251KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

744df373a73eae2758e6a0921fef9d39_JaffaCakes118

advapi32

dbghelp

oleaut32

user32

kernel32

shell32

ole32

generic