7efdce6925f9d0a47262bf6909dee878_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
7efdce6925f9d0a47262bf6909dee878_JaffaCakes118
Size 847KB
Sample240529-a82gesbe5z
SHA256 0a38204354bdd03ca06520f5482cc057a926eef96944a2a179c370b9f64f4842
MD5 7efdce6925f9d0a47262bf6909dee878
SHA1 c2675a34536fbb0e637b3b63ca5671f93a7f9484
SHA512 7f5ac9a34891642b056cd37c0f54c3cc86caab581df6a4d62d1279efe38449b0bc63bbd305eecaf382fadba7022c6791293711ec9855920dbf82a0a07347a80d
SSDEEP 24576:WbTUojyk1O/sDcxLx+gGBWDvKe0VR7Ev3b7YpQKZ445fm:gy7Gs78V9Ev3fYpvf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7efdce6925f9d0a47262bf6909dee878_JaffaCakes118

File Explorer

7efdce6925f9d0a47262bf6909dee878_JaffaCakes118

.exe 847KB

7efdce6925f9d0a47262bf6909dee878_JaffaCakes118

IMPHASH eababc79239824d59a72f04d1276c2c9
SHA256 0a38204354bdd03ca06520f5482cc057a926eef96944a2a179c370b9f64f4842
MD5 7efdce6925f9d0a47262bf6909dee878
SHA1 c2675a34536fbb0e637b3b63ca5671f93a7f9484
SHA512 7f5ac9a34891642b056cd37c0f54c3cc86caab581df6a4d62d1279efe38449b0bc63bbd305eecaf382fadba7022c6791293711ec9855920dbf82a0a07347a80d
SSDEEP 24576:WbTUojyk1O/sDcxLx+gGBWDvKe0VR7Ev3b7YpQKZ445fm:gy7Gs78V9Ev3fYpvf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

185840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey CryptVerifySignatureW CryptDecrypt CryptImportKey CryptDeriveKey CryptDestroyKey CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextA

user32

CharNextW LoadStringW MessageBoxW LoadStringW GetSystemMetrics CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess SwitchToThread GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue LocalFree LocalAlloc GetModuleHandleW FreeLibrary WriteFile WideCharToMultiByte WaitForSingleObject VirtualQuery VerSetConditionMask VerifyVersionInfoW SizeofResource SetEvent ResetEvent LockResource LocalFree LoadResource LoadLibraryW IsValidLocale GetVersionExW GetThreadLocale GetSystemDirectoryW GetStdHandle GetShortPathNameW GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetDiskFreeSpaceW GetDateFormatW GetCurrentProcessId GetCPInfo FreeResource FreeLibrary FreeConsole FormatMessageW FindResourceW FindFirstFileW EnumSystemLocalesW EnumCalendarInfoW DeleteFileW CreateProcessW CreateFileW CreateEventW CompareStringW CloseHandle

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

netapi32

NetApiBufferFree NetWkstaGetInfo

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

22KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

113B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

637KB

Virtual Size

637KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7efdce6925f9d0a47262bf6909dee878_JaffaCakes118

oleaut32

advapi32

user32

kernel32

version

netapi32

generic