844c5b9e6a2d74d807a700ae0f46932a_JaffaCakes118

General

Target
844c5b9e6a2d74d807a700ae0f46932a_JaffaCakes118
Size 812KB
Sample240530-qm4yesbb48
SHA256 58b6a59078398f01fb8aee0244754489732ce410846b01d921821022c761a4a2
MD5 844c5b9e6a2d74d807a700ae0f46932a
SHA1 d5259500583aaf811d94fa1a240d57f0eecf33fb
SHA512 f71e952c929c0813c6665b6382833a573a1e301e126404e4218ab51b9cb661d26b7d23f42a21524176d881ef70f880081c6eafdb1a716c5eb28a16c1881eb7ba
SSDEEP 12288:8P13IoTZCjb2wOzxdYYqxUe/rAS2hC7p/S4xkHL/uuSkxdZ:OgO7qxhU2/S46HL/uLkxdZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
844c5b9e6a2d74d807a700ae0f46932a_JaffaCakes118

File Explorer

844c5b9e6a2d74d807a700ae0f46932a_JaffaCakes118

.exe 812KB

844c5b9e6a2d74d807a700ae0f46932a_JaffaCakes118

IMPHASH cd337f86085fb9a19d2d4da8ebba5dbb
SHA256 58b6a59078398f01fb8aee0244754489732ce410846b01d921821022c761a4a2
MD5 844c5b9e6a2d74d807a700ae0f46932a
SHA1 d5259500583aaf811d94fa1a240d57f0eecf33fb
SHA512 f71e952c929c0813c6665b6382833a573a1e301e126404e4218ab51b9cb661d26b7d23f42a21524176d881ef70f880081c6eafdb1a716c5eb28a16c1881eb7ba
SSDEEP 12288:8P13IoTZCjb2wOzxdYYqxUe/rAS2hC7p/S4xkHL/uuSkxdZ:OgO7qxhU2/S46HL/uLkxdZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

91703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA RemoveDirectoryA CreateFileA CloseHandle WriteFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId WaitForSingleObject DeleteCriticalSection FreeLibrary VirtualProtect SetCurrentDirectoryA LoadLibraryA VirtualAlloc GetCommandLineW GetTickCount CreateEventA SetEvent Sleep GetCurrentProcessId GetCurrentProcess GetFullPathNameW GetTempPathW CopyFileW DeleteFileW GetTempPathA GetModuleFileNameW VirtualFree SizeofResource LoadResource FindResourceW GetProcAddress GetModuleHandleA GetLastError HeapFree ReadFile GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW GetSystemTimeAsFileTime HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo GetFileAttributesExW SetStdHandle FlushFileBuffers GetConsoleCP CreateFileW HeapReAlloc OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW WriteConsoleW SetEndOfFile HeapSize

advapi32

BuildTrusteeWithNameW AddAuditAccessAce AddAccessAllowedAce

comctl32

ImageList_DrawIndirect CreateStatusWindowW ImageList_BeginDrag

Sharing

General

Malware Config

Signatures

File Explorer

844c5b9e6a2d74d807a700ae0f46932a_JaffaCakes118

kernel32

advapi32

comctl32

generic