847226e2e2e32ea259db05af00a1f503_JaffaCakes118

General

Target
847226e2e2e32ea259db05af00a1f503_JaffaCakes118
Size 325KB
Sample240530-rmv6ysbd41
SHA256 605612bd629130c0b19a25bbd228ad7ffad8c75c9f2e6df322dedde0268b350a
MD5 847226e2e2e32ea259db05af00a1f503
SHA1 a5b7bde448941e099d9c8db17d1c6779945b7dc5
SHA512 55e945e82fc110f575def6f8c670212ec9c6dcb84f311ac1123f9c3d56356ad549bb052b30b7ab65b7ab63d340151d485b84fdb538534e60c095eb41bbd9a7de
SSDEEP 6144:6rl8sf608N/cz9GD0mOh3Jhh9Ha243YVh:Cl8sC08N89StOh4Wh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
847226e2e2e32ea259db05af00a1f503_JaffaCakes118

File Explorer

847226e2e2e32ea259db05af00a1f503_JaffaCakes118

.exe 325KB

847226e2e2e32ea259db05af00a1f503_JaffaCakes118

IMPHASH 481382385e1524126ef81ca6ef3dc8a0
SHA256 605612bd629130c0b19a25bbd228ad7ffad8c75c9f2e6df322dedde0268b350a
MD5 847226e2e2e32ea259db05af00a1f503
SHA1 a5b7bde448941e099d9c8db17d1c6779945b7dc5
SHA512 55e945e82fc110f575def6f8c670212ec9c6dcb84f311ac1123f9c3d56356ad549bb052b30b7ab65b7ab63d340151d485b84fdb538534e60c095eb41bbd9a7de
SSDEEP 6144:6rl8sf608N/cz9GD0mOh3Jhh9Ha243YVh:Cl8sC08N89StOh4Wh
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Tuguu\CStub\OUTPUT\CppHostCLR.pdb

kernel32

SizeofResource CloseHandle MapViewOfFile UnmapViewOfFile CreateFileMappingW LoadResource GetTempPathW GetTempFileNameW CreateFileW GetModuleHandleW FindResourceW LockResource SetFilePointerEx SetStdHandle GetCommandLineW EnterCriticalSection LeaveCriticalSection IsDebuggerPresent EncodePointer DecodePointer IsProcessorFeaturePresent GetLastError SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar GetStdHandle WriteFile GetModuleFileNameW GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree HeapFree Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo RtlUnwind LoadLibraryExW OutputDebugStringW LoadLibraryW FlushFileBuffers WideCharToMultiByte GetConsoleCP GetConsoleMode HeapAlloc HeapReAlloc ReadFile ReadConsoleW GetStringTypeW HeapSize LCMapStringW WriteConsoleW

advapi32

RegOpenKeyExW

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

847226e2e2e32ea259db05af00a1f503_JaffaCakes118

kernel32

advapi32

mscoree

generic