97ec59d3add4035a0417403563af7b3e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
97ec59d3add4035a0417403563af7b3e_JaffaCakes118
Size 927KB
Sample240605-mxtnnaec98
SHA256 115c959e43bf478551d3612f247731d1ef4dc66f305f8466d33c4e7968852ae1
MD5 97ec59d3add4035a0417403563af7b3e
SHA1 f237d7d988b73cd0dfeadae544c5d01f8747124b
SHA512 cb7c7f5e608698abe16a5959fede42b6a15a126d0f078961ad8e0e5e28dc32cf6f132a62e1c8052c7beecb51ab7605e90ef8137cbb3a0a4ff49679e8e01edb55
SSDEEP 24576:zUCXnX9Ho09perrOUj6k7ZqC30s9CiX/z1s:z5Owk7ZxC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97ec59d3add4035a0417403563af7b3e_JaffaCakes118

File Explorer

97ec59d3add4035a0417403563af7b3e_JaffaCakes118

.exe 927KB

97ec59d3add4035a0417403563af7b3e_JaffaCakes118

IMPHASH 8ce37ba0e13119b304d1b77b2c762edd
SHA256 115c959e43bf478551d3612f247731d1ef4dc66f305f8466d33c4e7968852ae1
MD5 97ec59d3add4035a0417403563af7b3e
SHA1 f237d7d988b73cd0dfeadae544c5d01f8747124b
SHA512 cb7c7f5e608698abe16a5959fede42b6a15a126d0f078961ad8e0e5e28dc32cf6f132a62e1c8052c7beecb51ab7605e90ef8137cbb3a0a4ff49679e8e01edb55
SSDEEP 24576:zUCXnX9Ho09perrOUj6k7ZqC30s9CiX/z1s:z5Owk7ZxC
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

OpenProcessToken GetTokenInformation RegSetValueExA EqualSid RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA AllocateAndInitializeSid FreeSid AdjustTokenPrivileges RegCloseKey

kernel32

GetPrivateProfileIntA GetFileAttributesA IsDBCSLeadByte GetSystemDirectoryA GlobalUnlock GetShortPathNameA CreateDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA SetFileAttributesA GlobalFree FindClose GetPrivateProfileStringA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA FindNextFileA CompareStringA _lopen CloseHandle LocalFree DeleteFileA ExitProcess DosDateTimeToFileTime CreateFileA FindResourceA GlobalAlloc FreeResource LoadResource WaitForSingleObject SetEvent GetModuleHandleW FormatMessageA ExpandEnvironmentStringsA WriteFile GetDriveTypeA GetVolumeInformationA TerminateThread SizeofResource CreateEventA GetExitCodeProcess CreateProcessA ReadFile SetCurrentDirectoryA GetTempFileNameA ResetEvent LockResource GetSystemInfo LoadLibraryExA CreateMutexA GetCurrentDirectoryA GetVersionExA GetVersion GetTempPathA CreateThread LocalFileTimeToFileTime _llseek GetWindowsDirectoryA GetDiskFreeSpaceA MulDiv EnumResourceLanguagesA GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleA TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoA Sleep _lclose GlobalLock GetCurrentProcess SetFileTime FreeLibrary lstrcmpA SetFilePointer

gdi32

GetDeviceCaps

user32

MessageBoxA SetWindowLongA GetDC SendMessageA SetForegroundWindow MsgWaitForMultipleObjects SendDlgItemMessageA GetWindowRect SetDlgItemTextA GetDesktopWindow EndDialog CharPrevA ExitWindowsEx CharNextA CharUpperA MessageBeep LoadStringA GetDlgItemTextA DialogBoxIndirectParamA CallWindowProcA EnableWindow SetWindowTextA DispatchMessageA ShowWindow SetWindowPos GetDlgItem ReleaseDC PeekMessageA GetSystemMetrics GetWindowLongA

msvcrt

?terminate@@YAXXZ _acmdln _controlfp _except_handler4_common _initterm __setusermatherr _ismbblead __p__fmode _cexit _exit exit __set_app_type __getmainargs _amsg_exit __p__commode _XcptFilter memcpy_s _vsnprintf memcpy memset

comctl32

ord17

cabinet

ord21 ord22 ord20 ord23

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

Sharing

General

Malware Config

Signatures

File Explorer

97ec59d3add4035a0417403563af7b3e_JaffaCakes118

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic