89705cd0753d66c6029c09df011c6a49_JaffaCakes118

General

Target
89705cd0753d66c6029c09df011c6a49_JaffaCakes118
Size 833KB
Sample240601-fr5emsbe65
SHA256 7a3b08f1ece08b85fcfa44b5e1c04abcfb9cfeeed48b899597ad072d70990718
MD5 89705cd0753d66c6029c09df011c6a49
SHA1 a305f7d3fff864605f73bb4815c44169aa2794bb
SHA512 e1cdef5955458771df6042b6efad8077d7f8f6f09914d7edfe90bd08feed4b062171d6c5c00e2117a2ba17d984694097676e8a52418318fa9cded49b48cdd5c4
SSDEEP 24576:snjAtT2NnWLo0mcS2NggBMSgYLFgBJC3GfI:sn4vmcbNgs7Zgu3EI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89705cd0753d66c6029c09df011c6a49_JaffaCakes118

File Explorer

89705cd0753d66c6029c09df011c6a49_JaffaCakes118

.exe 833KB

89705cd0753d66c6029c09df011c6a49_JaffaCakes118

IMPHASH 566fd03342f4b89ebc080dc57bf226f1
SHA256 7a3b08f1ece08b85fcfa44b5e1c04abcfb9cfeeed48b899597ad072d70990718
MD5 89705cd0753d66c6029c09df011c6a49
SHA1 a305f7d3fff864605f73bb4815c44169aa2794bb
SHA512 e1cdef5955458771df6042b6efad8077d7f8f6f09914d7edfe90bd08feed4b062171d6c5c00e2117a2ba17d984694097676e8a52418318fa9cded49b48cdd5c4
SSDEEP 24576:snjAtT2NnWLo0mcS2NggBMSgYLFgBJC3GfI:sn4vmcbNgs7Zgu3EI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

100624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA SetCurrentDirectoryA RemoveDirectoryA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect GetProcAddress LoadLibraryA VirtualAlloc GetCurrentThreadId WaitForSingleObject GetTempPathW FreeLibrary DeleteCriticalSection GetCommandLineW GetTickCount CreateEventA SetEvent Sleep GetCurrentProcessId GetCurrentProcess DeleteFileW GetFullPathNameW CopyFileW GetTempPathA GetModuleFileNameW VirtualFree SizeofResource LoadResource FindResourceW CloseHandle GetModuleHandleA GetLastError HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

AddAccessAllowedObjectAce AreAllAccessesGranted CryptEncrypt

comctl32

ImageList_Add PropertySheetW _TrackMouseEvent

Sharing

General

Malware Config

Signatures

File Explorer

89705cd0753d66c6029c09df011c6a49_JaffaCakes118

kernel32

advapi32

comctl32

generic