a1199c4a21484aaad51ce244986e5470_JaffaCakes118

General

Target
a1199c4a21484aaad51ce244986e5470_JaffaCakes118
Size 791KB
Sample240612-sh4g7stbpp
SHA256 06874f9d65ec5d5bfacb4da48ec88ddfb433822df1de75b82314f74aa617c4d8
MD5 a1199c4a21484aaad51ce244986e5470
SHA1 736381e95f17c4c2291a8010ea1b6506173a7e72
SHA512 0713ae268b439cdf32d4c2b321d604eebc4413225d51afa66e47d2c2bab4263945b324f2918c021145f89430de5310d1fe20ba5c48891fe2ba7b7d0ad8e2b0c8
SSDEEP 12288:v1SMw8UYGWRuy6rKHsDaZFdGQxgU0iFCiYW5B9zKYBJjMK3wFBEgO3aT8n+8:v18vYGWwy6mYYFn0iSWf9zKgJRwOn+8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1199c4a21484aaad51ce244986e5470_JaffaCakes118

File Explorer

a1199c4a21484aaad51ce244986e5470_JaffaCakes118

.exe 791KB

a1199c4a21484aaad51ce244986e5470_JaffaCakes118

IMPHASH 10e41c87004566de26b701058d855166
SHA256 06874f9d65ec5d5bfacb4da48ec88ddfb433822df1de75b82314f74aa617c4d8
MD5 a1199c4a21484aaad51ce244986e5470
SHA1 736381e95f17c4c2291a8010ea1b6506173a7e72
SHA512 0713ae268b439cdf32d4c2b321d604eebc4413225d51afa66e47d2c2bab4263945b324f2918c021145f89430de5310d1fe20ba5c48891fe2ba7b7d0ad8e2b0c8
SSDEEP 12288:v1SMw8UYGWRuy6rKHsDaZFdGQxgU0iFCiYW5B9zKYBJjMK3wFBEgO3aT8n+8:v18vYGWwy6mYYFn0iSWf9zKgJRwOn+8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

75970

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect GetProcAddress VirtualAlloc GetCurrentThreadId CloseHandle WaitForSingleObject FreeLibrary DeleteCriticalSection GetModuleFileNameW GetTickCount CreateEventA Sleep SetEvent GetCurrentProcess CreateEventW DeleteFileW GetFullPathNameW GetLastError CopyFileW GetCurrentProcessId LoadLibraryA VirtualFree SizeofResource LoadResource GetModuleHandleA GetCommandLineW FindResourceW HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

AreAllAccessesGranted CryptExportKey CryptDeriveKey

comctl32

ImageList_Destroy ImageList_AddMasked ImageList_Copy

Sharing

General

Malware Config

Signatures

File Explorer

a1199c4a21484aaad51ce244986e5470_JaffaCakes118

kernel32

advapi32

comctl32

generic