892c9a8cd29f46178718e00fe3ba9cfc_JaffaCakes118

General

Target
892c9a8cd29f46178718e00fe3ba9cfc_JaffaCakes118
Size 799KB
Sample240601-dbp9nsga72
SHA256 f7dd559a0b8ce762af92f31577a91c4bbdf47082a5429e7a8c33e4dd429cf7de
MD5 892c9a8cd29f46178718e00fe3ba9cfc
SHA1 f09b663c2c5e64d20fda50cc71c9d75cec3c5354
SHA512 fa0466d693c5bdf03a5e419d803696e9b2160d12a9ab47c43889f44d91dcd84412dcd43c4f9be28832b0ddddd2909645c746934462144c1b9baa5bac63e53db2
SSDEEP 12288:6gyn44a1GdTyz7PEL6xIP5Hw3XK+CJsgZi7KyxWp1R9++cTsmo3H1pw6Ll8Hogj:j00GFyzjqLZi7jxWHR9++mYTLl8Igj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
892c9a8cd29f46178718e00fe3ba9cfc_JaffaCakes118

File Explorer

892c9a8cd29f46178718e00fe3ba9cfc_JaffaCakes118

.exe 799KB

892c9a8cd29f46178718e00fe3ba9cfc_JaffaCakes118

IMPHASH 5bf0215d5e53e0e6acff069bb82f1016
SHA256 f7dd559a0b8ce762af92f31577a91c4bbdf47082a5429e7a8c33e4dd429cf7de
MD5 892c9a8cd29f46178718e00fe3ba9cfc
SHA1 f09b663c2c5e64d20fda50cc71c9d75cec3c5354
SHA512 fa0466d693c5bdf03a5e419d803696e9b2160d12a9ab47c43889f44d91dcd84412dcd43c4f9be28832b0ddddd2909645c746934462144c1b9baa5bac63e53db2
SSDEEP 12288:6gyn44a1GdTyz7PEL6xIP5Hw3XK+CJsgZi7KyxWp1R9++cTsmo3H1pw6Ll8Hogj:j00GFyzjqLZi7jxWHR9++mYTLl8Igj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

85074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId CloseHandle WaitForSingleObject DeleteCriticalSection FreeLibrary VirtualProtect GetProcAddress VirtualAlloc GetModuleFileNameW GetTickCount CreateEventA Sleep SetEvent GetCurrentProcess CreateEventW DeleteFileW GetLastError GetFullPathNameW CopyFileW GetCurrentProcessId LoadLibraryA VirtualFree SizeofResource LoadResource GetModuleHandleA GetCommandLineW FindResourceW HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

CryptEncrypt CryptCreateHash ClearEventLogW

comctl32

CreatePropertySheetPageW ImageList_SetBkColor ImageList_Add

Sharing

General

Malware Config

Signatures

File Explorer

892c9a8cd29f46178718e00fe3ba9cfc_JaffaCakes118

kernel32

advapi32

comctl32

generic