765352828d0878e784ebc1d2453e3448_JaffaCakes118

General

Target
765352828d0878e784ebc1d2453e3448_JaffaCakes118
Size 823KB
Sample240526-wkf2gaef8v
SHA256 eb384a27e2737c0944085181719208686e334a597e8e2eed509c3146300a7b10
MD5 765352828d0878e784ebc1d2453e3448
SHA1 fd2ab9059c844f0c5c0c9d542a15440de6a37e93
SHA512 6586b31de35e43e0e596868ac913ec4470c19f82cdac2b966624262fc48564d10d148c63358360320ca9a60575cc1f4e17d53af610c6e2d16112635639654fde
SSDEEP 24576:hs59jpTg+Uk89wpx+PEY59w1t3/5soIX6z5tnett:m5LgW89wp8pQtRMw5yt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
765352828d0878e784ebc1d2453e3448_JaffaCakes118

File Explorer

765352828d0878e784ebc1d2453e3448_JaffaCakes118

.exe 823KB

765352828d0878e784ebc1d2453e3448_JaffaCakes118

IMPHASH b562e456ebeb2d1a8272395e027e7b18
SHA256 eb384a27e2737c0944085181719208686e334a597e8e2eed509c3146300a7b10
MD5 765352828d0878e784ebc1d2453e3448
SHA1 fd2ab9059c844f0c5c0c9d542a15440de6a37e93
SHA512 6586b31de35e43e0e596868ac913ec4470c19f82cdac2b966624262fc48564d10d148c63358360320ca9a60575cc1f4e17d53af610c6e2d16112635639654fde
SSDEEP 24576:hs59jpTg+Uk89wpx+PEY59w1t3/5soIX6z5tnett:m5LgW89wp8pQtRMw5yt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

91959

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryA RemoveDirectoryA CreateFileA CloseHandle WriteFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId WaitForSingleObject DeleteCriticalSection FreeLibrary VirtualProtect GetTempPathA LoadLibraryA VirtualAlloc GetCommandLineW GetTickCount CreateEventA Sleep SetEvent GetCurrentProcessId GetCurrentProcess DeleteFileW GetFullPathNameW GetTempPathW CopyFileW CreateDirectoryA GetModuleFileNameW VirtualFree SizeofResource LoadResource GetModuleHandleA GetProcAddress FindResourceW GetLastError HeapFree ReadFile GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW GetSystemTimeAsFileTime HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo GetFileAttributesExW SetStdHandle FlushFileBuffers GetConsoleCP CreateFileW HeapReAlloc OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW WriteConsoleW SetEndOfFile HeapSize

advapi32

CryptGenRandom AbortSystemShutdownW CryptGetDefaultProviderW

comctl32

ImageList_SetOverlayImage GetMUILanguage ImageList_SetDragCursorImage

Sharing

General

Malware Config

Signatures

File Explorer

765352828d0878e784ebc1d2453e3448_JaffaCakes118

kernel32

advapi32

comctl32

generic