9dd9acfe1e454b1ec3a705ab9243cc0f_JaffaCakes118

General

Target
9dd9acfe1e454b1ec3a705ab9243cc0f_JaffaCakes118
Size 867KB
Sample240611-menppatfnj
SHA256 2ec589989c88e00f9ce39ab7e59940c1096572d3aa778cd1c8ec529521d7a08e
MD5 9dd9acfe1e454b1ec3a705ab9243cc0f
SHA1 8add68dac54ba32ed72e8d39386b02b076c5d3db
SHA512 7efabb8f42f0750c855be9213639c2448ec4257c3243d57b38789a111ca0dc65ffa02b68b5079721ed5d8fa83708377e6079f9c6dd4c903913a673cb31af33a2
SSDEEP 12288:7rSlFh8MtpFRnOMpdgb9sDNEoU/3LJsnb/+dy780zarYq3l8vnk22uDaoK7IRSS:Klb5pdgmBUflsnbWd10O89nGCFKUSS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9dd9acfe1e454b1ec3a705ab9243cc0f_JaffaCakes118

File Explorer

9dd9acfe1e454b1ec3a705ab9243cc0f_JaffaCakes118

.exe 867KB

9dd9acfe1e454b1ec3a705ab9243cc0f_JaffaCakes118

IMPHASH 2a2dac18d6e843e911b6599371b0b0e9
SHA256 2ec589989c88e00f9ce39ab7e59940c1096572d3aa778cd1c8ec529521d7a08e
MD5 9dd9acfe1e454b1ec3a705ab9243cc0f
SHA1 8add68dac54ba32ed72e8d39386b02b076c5d3db
SHA512 7efabb8f42f0750c855be9213639c2448ec4257c3243d57b38789a111ca0dc65ffa02b68b5079721ed5d8fa83708377e6079f9c6dd4c903913a673cb31af33a2
SSDEEP 12288:7rSlFh8MtpFRnOMpdgb9sDNEoU/3LJsnb/+dy780zarYq3l8vnk22uDaoK7IRSS:Klb5pdgmBUflsnbWd10O89nGCFKUSS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

246870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA VirtualFree GetModuleHandleA GetCurrentProcessId GetModuleFileNameW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId WaitForSingleObject CloseHandle DeleteCriticalSection FreeLibrary IsWow64Process GetProcAddress VirtualAlloc GetCommandLineW GetTickCount CreateEventA Sleep SetEvent CreateEventW GetLastError GetFullPathNameW CopyFileW DeleteFileW GetCurrentProcess FreeResource SizeofResource LockResource LoadResource FindResourceExW VirtualProtect FindResourceW HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc IsProcessorFeaturePresent GetProcessHeap IsDebuggerPresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

CryptContextAddRef BuildSecurityDescriptorA CryptGenKey

comctl32

ImageList_Replace ImageList_DragShowNolock CreatePropertySheetPageW

Sharing

General

Malware Config

Signatures

File Explorer

9dd9acfe1e454b1ec3a705ab9243cc0f_JaffaCakes118

kernel32

advapi32

comctl32

generic