9ef1b0cbdc9382541e83f48fd9b9880f_JaffaCakes118

General

Target
9ef1b0cbdc9382541e83f48fd9b9880f_JaffaCakes118
Size 465KB
Sample240611-vsvn6avard
SHA256 a77ab8771a4f9d56d3c536aeb36fda71f2e71454bf2c7f600829e945f416915e
MD5 9ef1b0cbdc9382541e83f48fd9b9880f
SHA1 8d57905f90fb8874859fd1b95071651f80350055
SHA512 f2c2e5c92bfd4f66db4aff7f829aeb84c2396fb55b064e70c06d3adb76e0824872efb30d589a1176a160897d10595c5a7da92ca26119828b315e901c7176ce9c
SSDEEP 12288:wUuV+IAUeSqni9qx5eqXuRBHdzgscY3KNG:wXCBUqx5W3qcJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

9ef1b0cbdc9382541e83f48fd9b9880f_JaffaCakes118

.exe 465KB

9ef1b0cbdc9382541e83f48fd9b9880f_JaffaCakes118

IMPHASH 089cca205aa73463a4692c6bdf9071e2
SHA256 a77ab8771a4f9d56d3c536aeb36fda71f2e71454bf2c7f600829e945f416915e
MD5 9ef1b0cbdc9382541e83f48fd9b9880f
SHA1 8d57905f90fb8874859fd1b95071651f80350055
SHA512 f2c2e5c92bfd4f66db4aff7f829aeb84c2396fb55b064e70c06d3adb76e0824872efb30d589a1176a160897d10595c5a7da92ca26119828b315e901c7176ce9c
SSDEEP 12288:wUuV+IAUeSqni9qx5eqXuRBHdzgscY3KNG:wXCBUqx5W3qcJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

9e:03:17:46:73:57:f6:a5:88:47:91:ef:16:b6:58:51:17:26:f6:a7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=AiTi Shag,O=AiTi Shag,POSTALCODE=121059,STREET=ul. Kievskaya\, d. 7,L=Moscow,ST=Moscow,C=RU

Chains

Aug 28, 2017

CN=AiTi Shag,O=AiTi Shag,POSTALCODE=121059,STREET=ul. Kievskaya\, d. 7,L=Moscow,ST=Moscow,C=RU

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Minor OS version

0

Major OS version

4

Entry point

28639

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetDC DestroyWindow AllowSetForegroundWindow LoadIconW SendMessageW CreateWindowExW MessageBoxW

kernel32

LoadResource VirtualAllocEx OpenProcess GetCurrentProcessId HeapSetInformation GetCommandLineW DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection RaiseException GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapCreate GetTickCount GetProcAddress WaitNamedPipeW LoadLibraryW CreateFileW ReadFile DisconnectNamedPipe CloseHandle WriteFile GetModuleHandleW SizeofResource LockResource FindResourceW FindResourceExW GetCurrentProcess RtlUnwind GetCPInfo GetACP GetOEMCP LCMapStringW IsProcessorFeaturePresent GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers WriteConsoleW WaitForSingleObject LocalFree GetLastError MultiByteToWideChar GetModuleFileNameW GetVersionExW GetSystemTimeAsFileTime QueryPerformanceCounter Sleep IsValidCodePage WideCharToMultiByte GetCommandLineA GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings InterlockedIncrement InterlockedDecrement VirtualFree LoadLibraryA VirtualAlloc GetLocaleInfoA LCMapStringA GetStringTypeA

Sharing

General

Malware Config

Signatures

File Explorer

9ef1b0cbdc9382541e83f48fd9b9880f_JaffaCakes118

user32

kernel32

generic