920b3d3e533dff8c0c2734a3c5ed8db4_JaffaCakes118

General

Target
920b3d3e533dff8c0c2734a3c5ed8db4_JaffaCakes118
Size 704KB
Sample240603-ra7n8agg91
SHA256 aeb48b1b73d32067d790fc9869f77bdcf01a7f25abd96eaa1bd80498a0d0a729
MD5 920b3d3e533dff8c0c2734a3c5ed8db4
SHA1 a9e5d2eff826ef0c3cc740aee1c337f302ff2a81
SHA512 fa2f55d8eb3487c3ce9911beb3f4647044bcdd2e9e90e778c0fe76eadb396f8c6741668900479cc7c2ccadcfe522321e577853245812ead6c7c655236d69e125
SSDEEP 12288:BIlkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMMMMV:BEkcMMMMMMMMMMMMMMMMMMMMMMMMMMMc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
920b3d3e533dff8c0c2734a3c5ed8db4_JaffaCakes118

File Explorer

920b3d3e533dff8c0c2734a3c5ed8db4_JaffaCakes118

.exe 704KB

920b3d3e533dff8c0c2734a3c5ed8db4_JaffaCakes118

IMPHASH e825205454d6587faa691258aee1077e
SHA256 aeb48b1b73d32067d790fc9869f77bdcf01a7f25abd96eaa1bd80498a0d0a729
MD5 920b3d3e533dff8c0c2734a3c5ed8db4
SHA1 a9e5d2eff826ef0c3cc740aee1c337f302ff2a81
SHA512 fa2f55d8eb3487c3ce9911beb3f4647044bcdd2e9e90e778c0fe76eadb396f8c6741668900479cc7c2ccadcfe522321e577853245812ead6c7c655236d69e125
SSDEEP 12288:BIlkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMMMMV:BEkcMMMMMMMMMMMMMMMMMMMMMMMMMMMc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

36035

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Mr.Anderson\Desktop\2008\27.8.20\Forti\Release\Forti.pdb

kernel32

GetLastError VirtualAlloc ExitProcess GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime

user32

SendMessageA InSendMessage CreateWindowExA ShowWindow

msvcp90

?eof@?$char_traits@D@std@@SAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBEHXZ ?length@?$char_traits@D@std@@SAIPBD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?good@ios_base@std@@QBE_NXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?width@ios_base@std@@QAEHH@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z

msvcr90

strchr ??3@YAXPAX@Z _findclose _findnext64i32 fwrite printf fputc fgetc strftime _localtime64 fread strlen putchar free sscanf __CxxFrameHandler3 strcmp ??2@YAPAXI@Z _wcslwr malloc _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _crt_debugger_hook ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _decode_pointer _except_handler4_common _invoke_watson _controlfp_s strcpy strcat _findfirst64i32 fopen ftell fseek fclose strncpy system

Sharing

General

Malware Config

Signatures

File Explorer

920b3d3e533dff8c0c2734a3c5ed8db4_JaffaCakes118

kernel32

user32

msvcp90

msvcr90

generic