895b93515b3798e4567e50fda270ae04_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
895b93515b3798e4567e50fda270ae04_JaffaCakes118
Size 1.5MB
Sample240601-e14zssad58
SHA256 524233df22b5be7d949d962ee13011113d24978ff6ca5ca6dcc05cfa2fa8f75c
MD5 895b93515b3798e4567e50fda270ae04
SHA1 28b0472a6581c9a9a9c3ab0e9f58fa715fd8c88c
SHA512 b47ebcad9ac4b13935fb7b0d4bea0f88533e9dce74d3ea3e6acb8b97c312b18cbbc5be54fc3fdd85ef113ec4e71ca90c09f0e2dace5b63b05e5da7a4b27f20d7
SSDEEP 24576:c5f6MGJ5uwKRRDa9DJoYHztD91O5tUNOWS0WrDQUl/EZNCRKvvgU1BCTrrTTTNZy:mDO9DLfIDLZQu8ZNLYU1BUTTJ340IL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

895b93515b3798e4567e50fda270ae04_JaffaCakes118

.exe 1.5MB

895b93515b3798e4567e50fda270ae04_JaffaCakes118

IMPHASH c3ae6472f9c8ce3dd3e82ca73b547ae5
SHA256 524233df22b5be7d949d962ee13011113d24978ff6ca5ca6dcc05cfa2fa8f75c
MD5 895b93515b3798e4567e50fda270ae04
SHA1 28b0472a6581c9a9a9c3ab0e9f58fa715fd8c88c
SHA512 b47ebcad9ac4b13935fb7b0d4bea0f88533e9dce74d3ea3e6acb8b97c312b18cbbc5be54fc3fdd85ef113ec4e71ca90c09f0e2dace5b63b05e5da7a4b27f20d7
SSDEEP 24576:c5f6MGJ5uwKRRDa9DJoYHztD91O5tUNOWS0WrDQUl/EZNCRKvvgU1BCTrrTTTNZy:mDO9DLfIDLZQu8ZNLYU1BUTTJ340IL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

f2:59:98:95:09:f8:fc:d1:91:d2:6e:f9:2c:16:9d:24:1a:99:33:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=InstallX\, LLC,O=InstallX\, LLC,L=Sartell,ST=Minnesota,C=US

Chains

May 23, 2024

Minor OS version

Major OS version

Entry point

294749

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\tfs.vs2012\admin\windows\main\Installer.QuickStart.Application\ReleaseNoMFC\quickstart.pdb

kernel32

InterlockedDecrement ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind GetStdHandle WriteFile GetModuleFileNameW SetLastError InterlockedIncrement GetCurrentThread GetFileType GetStartupInfoW GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW OutputDebugStringW LoadLibraryW GetDateFormatW GetTimeFormatW CompareStringW GetCommandLineA GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle GetTempPathA FlushFileBuffers CreateFileW CreateToolhelp32Snapshot OpenProcess CreateProcessA VirtualQuery GetLongPathNameA GetFullPathNameA GetCurrentDirectoryA CloseHandle MultiByteToWideChar FileTimeToSystemTime SystemTimeToFileTime GetLocalTime WaitForSingleObject CreateMutexA RtlCaptureStackBackTrace ReleaseMutex WideCharToMultiByte Sleep GetTickCount GetCurrentThreadId SetUnhandledExceptionFilter GetLastError Process32First Process32Next GetExitCodeProcess Module32First Module32Next InitializeCriticalSectionAndSpinCount FindResourceExW FindResourceW LoadResource LockResource DecodePointer EncodePointer GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LCMapStringW RaiseException SetEnvironmentVariableA ReadConsoleW ExitThread CreateThread DeleteFileW GetFileAttributesExW GetDiskFreeSpaceA CreateFileMappingA GetDiskFreeSpaceW LockFileEx GetTempPathW GetFileAttributesW FormatMessageW InitializeCriticalSection UnlockFileEx LockFile UnlockFile InterlockedCompareExchange SetEndOfFile UnmapViewOfFile MapViewOfFile GetFullPathNameW WritePrivateProfileStringA GetPrivateProfileIntA GetPrivateProfileStringA GetTimeZoneInformation SetEvent ResetEvent WaitForSingleObjectEx CreateEventA SetFilePointer ReadFile GetFileSize CreateFileA ExpandEnvironmentStringsA GetSystemDirectoryA GetFileAttributesA GetWindowsDirectoryA GetSystemInfo SizeofResource WriteConsoleW FormatMessageA GetModuleHandleA LocalAlloc lstrlenA LocalFree BeginUpdateResourceA UpdateResourceA EndUpdateResourceA LoadLibraryA EnumResourceNamesA EnumResourceLanguagesA FindResourceA LoadLibraryExA FindResourceExA GetUserDefaultUILanguage FindFirstFileA FindNextFileA FindClose CreateDirectoryA GetSystemTime GetTempFileNameA DeleteFileA RemoveDirectoryA SetFileAttributesA CopyFileA GetVersionExA

user32

GetWindowTextA GetWindowTextLengthA SetWindowLongA GetWindowLongA PostMessageA SendMessageA ScreenToClient ClientToScreen SetWindowPos MessageBoxA SetTimer KillTimer GetParent SetParent GetWindowRect GetClientRect MoveWindow ShowWindow InvalidateRect InvalidateRgn IsWindowVisible SetFocus UpdateWindow DestroyWindow LoadStringA IsWindow IsWindowEnabled EnableWindow FindWindowExA GetClassNameA EnumChildWindows GetSystemMetrics GetShellWindow FindWindowA GetDesktopWindow LoadCursorA CreateWindowExA GetClassInfoExA RegisterClassExA GetMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA CallWindowProcA DefWindowProcA LoadBitmapA LoadImageA SetCursor ReleaseCapture GetKeyboardState CreatePopupMenu DestroyMenu GetFocus TrackPopupMenu DialogBoxParamA CreateDialogParamA EndDialog GetDlgItem SendMessageW CopyRect InflateRect FrameRect BeginPaint EndPaint SetForegroundWindow GetWindowThreadProcessId MessageBoxExA LoadAcceleratorsA EnumWindows AppendMenuA WaitForInputIdle SetDlgItemTextA GetCursorPos OffsetRect SystemParametersInfoA AdjustWindowRectEx GetSystemMenu EnableMenuItem SetClassLongA LoadIconA PostQuitMessage IsIconic SetWindowTextA

oleaut32

SysAllocStringLen SysStringLen VariantInit VariantClear VariantChangeType SysAllocString SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SysFreeString

shlwapi

PathFindExtensionA PathRenameExtensionA PathStripPathA PathRemoveFileSpecA PathIsDirectoryEmptyA SHDeleteEmptyKeyA UrlEscapeA PathCombineA

comctl32

ImageList_Create InitCommonControlsEx ImageList_Add

shell32

ShellExecuteExA Shell_NotifyIconA SHGetSpecialFolderPathA

ole32

CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateGuid CoCreateInstance OleInitialize CoInitializeSecurity OleUninitialize

psapi

GetModuleFileNameExA EnumProcesses

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

userenv

ExpandEnvironmentStringsForUserA

wininet

InternetCrackUrlA InternetCanonicalizeUrlA InternetCombineUrlA InternetGetCookieA InternetSetCookieA FindCloseUrlCache InternetCloseHandle InternetOpenA InternetSetStatusCallback InternetSetOptionA InternetConnectA HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpQueryInfoA InternetErrorDlg InternetReadFileExA

gdiplus

GdipDeleteGraphics GdipSetCompositingMode GdipCreateFromHDC

urlmon

IsValidURL

gdi32

GetStockObject CreateCompatibleDC CreateCompatibleBitmap PatBlt SetWindowOrgEx BitBlt DeleteDC SelectObject GetObjectA DeleteObject

advapi32

RegEnumKeyExA AdjustTokenPrivileges RevertToSelf OpenProcessToken GetTokenInformation IsValidSid GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority RegOpenCurrentUser RegOpenUserClassesRoot RegCloseKey RegCreateKeyExA RegOpenKeyExA GetLengthSid RegQueryValueExA RegSetValueExA RegDeleteValueA RegQueryInfoKeyA SetTokenInformation LookupPrivilegeValueA DuplicateTokenEx ImpersonateLoggedOnUser

Name

.text

Size

412KB

Virtual Size

411KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-qu

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-ti

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

512B

Virtual Size

59B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-qu

Size

512B

Virtual Size

41B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-ti

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

416KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

895b93515b3798e4567e50fda270ae04_JaffaCakes118

PE Signature issue

kernel32

user32

oleaut32

shlwapi

comctl32

shell32

ole32

psapi

version

userenv

wininet

gdiplus

urlmon

gdi32

advapi32

generic