905203cdbc6af9c7628c7bb6afca7e1b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
905203cdbc6af9c7628c7bb6afca7e1b_JaffaCakes118
Size 897KB
Sample240603-de6e3aab62
SHA256 23554fff6ada4a8bc82627a9a9cf0348941048aa304eff0f74f325eab93bff5e
MD5 905203cdbc6af9c7628c7bb6afca7e1b
SHA1 c6f7b6d01a03ad87112b163e09fb3d837eb58854
SHA512 0d8399f71022fdd8138d2d108a7c6392b09526f317c18b01def87c2886a0711774dfa45cc2e0905b316792cf463d87bfb8cd0c3ce9932867c0b282de919021c8
SSDEEP 24576:7gkPnXqTXd/juSyG0uHWm91TE8LgciAo5xmRwzc/X:7VOd9yG0u2c1Ngc4Lmj/X
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
905203cdbc6af9c7628c7bb6afca7e1b_JaffaCakes118

File Explorer

905203cdbc6af9c7628c7bb6afca7e1b_JaffaCakes118

.exe 897KB

905203cdbc6af9c7628c7bb6afca7e1b_JaffaCakes118

IMPHASH f606d4de61806b5bb24a45078ee7b42b
SHA256 23554fff6ada4a8bc82627a9a9cf0348941048aa304eff0f74f325eab93bff5e
MD5 905203cdbc6af9c7628c7bb6afca7e1b
SHA1 c6f7b6d01a03ad87112b163e09fb3d837eb58854
SHA512 0d8399f71022fdd8138d2d108a7c6392b09526f317c18b01def87c2886a0711774dfa45cc2e0905b316792cf463d87bfb8cd0c3ce9932867c0b282de919021c8
SSDEEP 24576:7gkPnXqTXd/juSyG0uHWm91TE8LgciAo5xmRwzc/X:7VOd9yG0u2c1Ngc4Lmj/X
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

242287

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

M:\TWRK\406bed20d9978749\src\MicrogamingInstall\Release\MicrogamingInstall.pdb

kernel32

GetModuleFileNameW lstrlenW CreateDirectoryA FindFirstFileA FindClose GetModuleFileNameA FindNextFileA lstrcpyA MapViewOfFile UnmapViewOfFile CreateFileMappingA WideCharToMultiByte CreateProcessW OpenProcess Sleep CreateProcessA lstrcmpiA RemoveDirectoryA CopyFileA GetTempFileNameA GetCurrentProcessId GetTempPathA DeleteFileA GetComputerNameA FormatMessageA GetVolumePathNameW CopyFileW FormatMessageW RemoveDirectoryW GetModuleHandleA ReleaseMutex GetDiskFreeSpaceExA GetVersionExA DeleteFileW SetFileAttributesW GetPrivateProfileStringW LoadLibraryA CreateMutexA GetDriveTypeA GetVolumeInformationA DeviceIoControl ResetEvent InterlockedDecrement MoveFileExA Process32First TerminateProcess GetSystemDirectoryA GetLocalTime Process32Next CreateToolhelp32Snapshot InterlockedIncrement GetPrivateProfileIntA InterlockedExchange GetExitCodeThread WaitForMultipleObjects GetCurrentThreadId CreateSemaphoreA ReleaseSemaphore GetLogicalDriveStringsA GlobalMemoryStatusEx GetSystemInfo GetEnvironmentVariableA GetFileAttributesW GetCurrentThread GetThreadTimes ResumeThread InterlockedCompareExchange QueueUserWorkItem OpenFileMappingA lstrcatA InitializeCriticalSection CompareStringW GetProcessHeap SetEndOfFile SetStdHandle IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW FlushFileBuffers GetConsoleMode GetConsoleCP GetCurrentDirectoryW PeekNamedPipe GetFileInformationByHandle GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW SetHandleCount GetTimeZoneInformation LCMapStringW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLocaleInfoW IsValidCodePage GetOEMCP GetACP GetCPInfo GetCurrentProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc HeapSize HeapCreate IsProcessorFeaturePresent GetStdHandle GetFileType WriteConsoleW MoveFileA RaiseException RtlUnwind GetFullPathNameA GetDriveTypeW SetCurrentDirectoryA GetCurrentDirectoryA SetEnvironmentVariableA FindFirstFileExA FileTimeToLocalFileTime FileTimeToSystemTime lstrcpynW GetFileAttributesA lstrcpynA lstrlenA GetFileSize LocalFree GetProcAddress CreateFileW MultiByteToWideChar LoadLibraryW CreateDirectoryW FreeLibrary InterlockedPushEntrySList WaitForSingleObject InterlockedFlushSList InterlockedPopEntrySList InitializeSListHead CloseHandle ReadFile WriteFile SetFilePointer CreateFileA CreateThread OutputDebugStringA GetLastError CreateEventA SetEvent SetThreadPriority GetStartupInfoW HeapSetInformation GetCommandLineA LeaveCriticalSection EnterCriticalSection HeapReAlloc ExitThread GetSystemTimeAsFileTime ExitProcess GetModuleHandleW HeapAlloc DecodePointer EncodePointer HeapFree SetFileAttributesA

user32

SetFocus MessageBoxA SetWindowTextA PostMessageA RegisterClassA ShowWindow DefWindowProcA CreateWindowExA FlashWindowEx MoveWindow CopyRect GetDlgCtrlID LoadCursorA AdjustWindowRect EnableWindow UpdateWindow MapWindowPoints LoadImageA IsWindowVisible GetSystemMetrics RegisterClassW MessageBoxW DispatchMessageA wsprintfW InvalidateRect GetMessageA PostThreadMessageA wsprintfA DefWindowProcW CreateWindowExW CreatePopupMenu SetLayeredWindowAttributes GetCursorPos SetWindowPos SetWindowLongW ReleaseDC AppendMenuW GetWindowLongW SetWindowLongA OffsetRect ChildWindowFromPoint TranslateMessage IsDialogMessageA SendMessageA GetClientRect IsWindowEnabled LoadIconA SetForegroundWindow GetWindowDC TrackPopupMenu PeekMessageA GetActiveWindow wvsprintfA SendMessageTimeoutA DestroyWindow GetWindowRect

gdi32

DeleteDC CreateDIBSection GetDIBits DeleteObject SelectObject CreateCompatibleDC GetStockObject BitBlt

advapi32

RegCreateKeyExA RegEnumKeyW OpenSCManagerA CloseServiceHandle OpenServiceA RegSetValueExW RegOpenKeyExW RegQueryValueExW RegSetValueW RegSetValueA RegQueryValueW RegCloseKey GetUserNameA RegOpenKeyExA RegQueryValueExA RegSetValueExA FreeSid SetEntriesInAclW

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA SHGetPathFromIDListW SHGetFolderPathW SHGetMalloc SHChangeNotify SHGetSpecialFolderLocation

ole32

CoCreateInstance OleUninitialize OleInitialize CLSIDFromProgID CoTaskMemFree StringFromIID CoCreateGuid CoTaskMemAlloc CoSetProxyBlanket CoUninitialize CoInitialize OleSetContainedObject OleCreate

oleaut32

VariantTimeToSystemTime VariantCopy VariantChangeType SysStringLen SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString VariantClear SafeArrayCreateVector SafeArrayAccessData VariantInit

wsock32

closesocket inet_addr htonl socket WSAGetLastError ntohs getservbyport getservbyname send WSAStartup WSACleanup WSASetLastError gethostbyaddr connect ioctlsocket htons gethostbyname

ws2_32

WSAAddressToStringA

wininet

InternetCrackUrlA InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetGetLastResponseInfoA InternetCloseHandle HttpQueryInfoA InternetOpenUrlA InternetCreateUrlA InternetOpenW InternetOpenUrlW InternetConnectA InternetQueryOptionA InternetOpenA InternetCrackUrlW

shlwapi

PathAppendA SHDeleteKeyA PathCanonicalizeW PathAppendW StrStrA PathCanonicalizeA

psapi

GetModuleFileNameExA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

urlmon

CoInternetGetSession

Sharing

General

Malware Config

Signatures

File Explorer

905203cdbc6af9c7628c7bb6afca7e1b_JaffaCakes118

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wsock32

ws2_32

wininet

shlwapi

psapi

version

urlmon

generic