9071050b5c75b7a01a2df06e9981e64a_JaffaCakes118

General

Target
9071050b5c75b7a01a2df06e9981e64a_JaffaCakes118
Size 809KB
Sample240603-ec4dcsab8y
SHA256 7b2a9b5a183daffc4eeac2d39de1575ac03fbc38ec46db33dedd8a94cd912e42
MD5 9071050b5c75b7a01a2df06e9981e64a
SHA1 4c06b574ea3ded2ef2685cf8e1b1898c6aa6fa65
SHA512 12c15d06e8e3af049e59dfdcd94b3cbdf30bc6e85dd92552f0db204989797fe429fd32058a02a68d1b3f91302f722bb48544e25f4666c99bdc5564038a49ebd3
SSDEEP 24576:9HZRvB+mb8wex0Yz29hvBjJqJozda8KrqC6ezgK:J5+w8nXwJjUJgFKrqC7gK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9071050b5c75b7a01a2df06e9981e64a_JaffaCakes118

File Explorer

9071050b5c75b7a01a2df06e9981e64a_JaffaCakes118

.exe 809KB

9071050b5c75b7a01a2df06e9981e64a_JaffaCakes118

IMPHASH da9936a46d33137149bc4c9030a2ba20
SHA256 7b2a9b5a183daffc4eeac2d39de1575ac03fbc38ec46db33dedd8a94cd912e42
MD5 9071050b5c75b7a01a2df06e9981e64a
SHA1 4c06b574ea3ded2ef2685cf8e1b1898c6aa6fa65
SHA512 12c15d06e8e3af049e59dfdcd94b3cbdf30bc6e85dd92552f0db204989797fe429fd32058a02a68d1b3f91302f722bb48544e25f4666c99bdc5564038a49ebd3
SSDEEP 24576:9HZRvB+mb8wex0Yz29hvBjJqJozda8KrqC6ezgK:J5+w8nXwJjUJgFKrqC7gK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

96384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA RemoveDirectoryA SetCurrentDirectoryA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId WaitForSingleObject CloseHandle DeleteCriticalSection FreeLibrary VirtualProtect GetTempPathW LoadLibraryA VirtualAlloc GetCommandLineW GetTickCount CreateEventA SetEvent Sleep GetCurrentProcessId GetCurrentProcess DeleteFileW GetFullPathNameW CopyFileW GetTempPathA GetModuleFileNameW VirtualFree SizeofResource LoadResource FindResourceW GetProcAddress GetModuleHandleA GetLastError HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

AbortSystemShutdownW CopySid AccessCheck

comctl32

ImageList_Add ImageList_DragMove ImageList_DragLeave

Sharing

General

Malware Config

Signatures

File Explorer

9071050b5c75b7a01a2df06e9981e64a_JaffaCakes118

kernel32

advapi32

comctl32

generic