768a5d8aefd653e0082c82f92bf83718_JaffaCakes118

General

Target
768a5d8aefd653e0082c82f92bf83718_JaffaCakes118
Size 921KB
Sample240526-xymlvagg81
SHA256 ae05733b9f52007565236478afe8fbbbed89c79a3544c2f5daada0b95152fe05
MD5 768a5d8aefd653e0082c82f92bf83718
SHA1 2f8181031af9be04cf4c2cd842e5e29a618337e8
SHA512 56e4ce105d9cda91f8bb503f79280b74ba5fdd02889169b781813d6e889f4c9214dd568eb2dc6059d4c498f82cc08424df66db7a4ef5d2c83fafde712b908b58
SSDEEP 24576:KothEsC01HDVpTb7pqAGz/hY+EPO2qp86Hn:KoTEsC01HPTvAAGFwBqVn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
768a5d8aefd653e0082c82f92bf83718_JaffaCakes118

File Explorer

768a5d8aefd653e0082c82f92bf83718_JaffaCakes118

.exe 921KB

768a5d8aefd653e0082c82f92bf83718_JaffaCakes118

IMPHASH 496932d397fe5797c6bfa38b9728313b
SHA256 ae05733b9f52007565236478afe8fbbbed89c79a3544c2f5daada0b95152fe05
MD5 768a5d8aefd653e0082c82f92bf83718
SHA1 2f8181031af9be04cf4c2cd842e5e29a618337e8
SHA512 56e4ce105d9cda91f8bb503f79280b74ba5fdd02889169b781813d6e889f4c9214dd568eb2dc6059d4c498f82cc08424df66db7a4ef5d2c83fafde712b908b58
SSDEEP 24576:KothEsC01HDVpTb7pqAGz/hY+EPO2qp86Hn:KoTEsC01HPTvAAGFwBqVn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

183641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA VirtualFree GetModuleHandleA GetCurrentProcessId GetModuleFileNameW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId WaitForSingleObject CloseHandle DeleteCriticalSection FreeLibrary IsWow64Process GetProcAddress VirtualAlloc GetCommandLineW GetTickCount CreateEventA Sleep SetEvent CreateEventW GetLastError GetFullPathNameW CopyFileW DeleteFileW GetCurrentProcess FreeResource SizeofResource LockResource LoadResource FindResourceExW VirtualProtect FindResourceW HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc IsProcessorFeaturePresent GetProcessHeap IsDebuggerPresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

AccessCheckByType AddAccessAllowedAceEx ConvertSidToStringSidW

comctl32

ImageList_GetBkColor ImageList_LoadImageA ImageList_Copy

Sharing

General

Malware Config

Signatures

File Explorer

768a5d8aefd653e0082c82f92bf83718_JaffaCakes118

kernel32

advapi32

comctl32

generic