90a0faceef812b9c36e57c2fa3d68ab7_JaffaCakes118

General

Target
90a0faceef812b9c36e57c2fa3d68ab7_JaffaCakes118
Size 823KB
Sample240603-fsf4face5s
SHA256 89fe1ada61092176b5ef4c065fbe4a7c91044351b0d30be67afaab1f3b1a3f24
MD5 90a0faceef812b9c36e57c2fa3d68ab7
SHA1 d4f46f17f68b60a56e3ded0e9270180b5777a7d7
SHA512 16112d0a5ed586db3f50eb96568fc83156d09e290608f9c507844bd762b30836ec96c004fd1a059813883bab972bbbdac80902f5558079e0caf5794b0dc8ca21
SSDEEP 12288:fhdyM0bw7fzuRoOIpujJyqS2YFOcw3UjaWY+n0Bckn3RgXgX5d/MVRQ3pg0S3dCE:fhdynjI+SzO/WnnqCR8ENCE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
90a0faceef812b9c36e57c2fa3d68ab7_JaffaCakes118

File Explorer

90a0faceef812b9c36e57c2fa3d68ab7_JaffaCakes118

.exe 823KB

90a0faceef812b9c36e57c2fa3d68ab7_JaffaCakes118

IMPHASH 5364440f1c6f28f2925010dc7379abaf
SHA256 89fe1ada61092176b5ef4c065fbe4a7c91044351b0d30be67afaab1f3b1a3f24
MD5 90a0faceef812b9c36e57c2fa3d68ab7
SHA1 d4f46f17f68b60a56e3ded0e9270180b5777a7d7
SHA512 16112d0a5ed586db3f50eb96568fc83156d09e290608f9c507844bd762b30836ec96c004fd1a059813883bab972bbbdac80902f5558079e0caf5794b0dc8ca21
SSDEEP 12288:fhdyM0bw7fzuRoOIpujJyqS2YFOcw3UjaWY+n0Bckn3RgXgX5d/MVRQ3pg0S3dCE:fhdynjI+SzO/WnnqCR8ENCE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

102050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetTempPathW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId CloseHandle WaitForSingleObject FreeLibrary DeleteCriticalSection VirtualProtect GetProcAddress GetModuleFileNameW GetCommandLineW GetTickCount Sleep SetEvent CreateEventA GetCurrentProcess DeleteFileW GetFullPathNameW CreateEventW GetLastError CopyFileW GetCurrentProcessId LoadLibraryA VirtualFree SizeofResource LoadResource FindResourceW VirtualAlloc GetModuleHandleA HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

CryptDuplicateHash CryptDeriveKey AreAllAccessesGranted

comctl32

ImageList_SetImageCount ImageList_Draw ImageList_SetOverlayImage

Sharing

General

Malware Config

Signatures

File Explorer

90a0faceef812b9c36e57c2fa3d68ab7_JaffaCakes118

kernel32

advapi32

comctl32

generic