79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118
Size 2.1MB
Sample240527-vlf77aca89
SHA256 0c8e71c4f82e18be73464bfdddd58080c94ba5481946d735e34bd48ad4decfbf
MD5 79d7f5a22196dec5179c7763e70a8bbb
SHA1 f493729da7722f1135604cb4b31d2d82d8f95654
SHA512 31e943b6c78ef19b7452203fe2353a432c67a3eb72787d287111c250289d6e3a66b4c5bc4f740513f3c31efced104cb5d9f148c3467b3f83c0fcd241eb356e31
SSDEEP 49152:yiqXjFPE6KQaqz5HgrqhPLKqXZj8CTbDyhsotbgJSg79g3Ze7:yzzFM7q1Hg2hP2oZo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118

File Explorer

79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118

.exe 2.1MB

79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118

IMPHASH d5602a2b864416165625b3e6624a2e8c
SHA256 0c8e71c4f82e18be73464bfdddd58080c94ba5481946d735e34bd48ad4decfbf
MD5 79d7f5a22196dec5179c7763e70a8bbb
SHA1 f493729da7722f1135604cb4b31d2d82d8f95654
SHA512 31e943b6c78ef19b7452203fe2353a432c67a3eb72787d287111c250289d6e3a66b4c5bc4f740513f3c31efced104cb5d9f148c3467b3f83c0fcd241eb356e31
SSDEEP 49152:yiqXjFPE6KQaqz5HgrqhPLKqXZj8CTbDyhsotbgJSg79g3Ze7:yzzFM7q1Hg2hP2oZo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

618192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpiW LoadLibraryW UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList VirtualFree lstrlenA GetProcessId GetCurrentProcess GetCommandLineW FreeLibrary GetModuleFileNameA GetComputerNameA CreateThread OpenSemaphoreA LocalAlloc WaitForSingleObject CreateMutexA WideCharToMultiByte MultiByteToWideChar CreateEventA SetEvent GetCurrentProcessId GetProcAddress LoadLibraryA CreateDirectoryA FindClose FindNextFileA FindFirstFileA GetLastError CopyFileA LoadResource CloseHandle Process32Next DeleteFileA LockResource GetFileAttributesA Sleep CreateToolhelp32Snapshot GetModuleHandleA FindResourceA ExitProcess VirtualProtect VirtualAlloc GetVersionExW GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo LCMapStringA WTSGetActiveConsoleSessionId GetStringTypeExA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead GetStdHandle GetFileType WriteFile GlobalMemoryStatus FlushConsoleInputBuffer ReleaseSemaphore InitializeCriticalSection CreateSemaphoreW RtlUnwind RaiseException InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW CreateFileW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleHandleExW GetModuleFileNameW SetConsoleCtrlHandler ReadFile GetConsoleCP ExitThread FreeLibraryAndExitThread GetCurrentThread HeapAlloc FlushFileBuffers GetConsoleMode HeapFree GetCurrentDirectoryW GetFullPathNameW IsValidLocale EnumSystemLocalesW SetStdHandle ReadConsoleW SetFilePointerEx DeleteFileW HeapReAlloc GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetConsoleMode ReadConsoleInputW MoveFileExW HeapSize WriteConsoleW SetEndOfFile GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetVersionExA CreateFileA GetTempPathA GetCommandLineA GetUserDefaultLCID lstrcatA Process32First SwitchToThread SizeofResource TryEnterCriticalSection DuplicateHandle GetExitCodeThread CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority

user32

LoadStringA SetTimer GetMessageA TranslateMessage GetProcessWindowStation GetUserObjectInformationW MessageBoxA DispatchMessageA

advapi32

ReportEventA DeregisterEventSource RegisterEventSourceA AdjustTokenPrivileges CreateProcessAsUserA RegCloseKey StartServiceCtrlDispatcherA SetTokenInformation LookupPrivilegeValueA GetUserNameA OpenProcessToken DuplicateTokenEx GetTokenInformation CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA OpenServiceA SetSecurityDescriptorDacl ConvertSidToStringSidA LookupAccountNameA InitializeSecurityDescriptor CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegGetValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA

shell32

ShellExecuteExA CommandLineToArgvW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118

kernel32

user32

advapi32

shell32

wtsapi32

userenv

generic