a3df1fa7719a753b3f3b2b5e5ca3b903_JaffaCakes118

General

Target
a3df1fa7719a753b3f3b2b5e5ca3b903_JaffaCakes118
Size 833KB
Sample240613-ffslpsyckl
SHA256 767115a18fcd4deae2f5ae98820b21c69e3ed2f3e06d88685cd2c7a9efdd51d3
MD5 a3df1fa7719a753b3f3b2b5e5ca3b903
SHA1 9240e634ed1eefce49d1d785349f60215473c658
SHA512 9d65ab380001d2a89104bda324e3af2d2c72d1dcb477340b882ab2f4e0488bae33b9f0d9ce06569a04e673d7b1ab3858e65fcbeb8c650cf36e537eee92b13373
SSDEEP 12288:Fn1FrSR/3yS8IZ0Rkz8k2lyjsGWwKkchSXA3/vE2H8YpFlD92m0GeBa9JltF+sUm:FnjrST2KsjnNSXAvDXDAa9TzxtO5YR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3df1fa7719a753b3f3b2b5e5ca3b903_JaffaCakes118

File Explorer

a3df1fa7719a753b3f3b2b5e5ca3b903_JaffaCakes118

.exe 833KB

a3df1fa7719a753b3f3b2b5e5ca3b903_JaffaCakes118

IMPHASH 62b48c59b5cc7b99074459936423f560
SHA256 767115a18fcd4deae2f5ae98820b21c69e3ed2f3e06d88685cd2c7a9efdd51d3
MD5 a3df1fa7719a753b3f3b2b5e5ca3b903
SHA1 9240e634ed1eefce49d1d785349f60215473c658
SHA512 9d65ab380001d2a89104bda324e3af2d2c72d1dcb477340b882ab2f4e0488bae33b9f0d9ce06569a04e673d7b1ab3858e65fcbeb8c650cf36e537eee92b13373
SSDEEP 12288:Fn1FrSR/3yS8IZ0Rkz8k2lyjsGWwKkchSXA3/vE2H8YpFlD92m0GeBa9JltF+sUm:FnjrST2KsjnNSXAvDXDAa9TzxtO5YR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

100624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA SetCurrentDirectoryA RemoveDirectoryA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect GetProcAddress LoadLibraryA VirtualAlloc GetCurrentThreadId WaitForSingleObject GetTempPathW FreeLibrary DeleteCriticalSection GetCommandLineW GetTickCount CreateEventA SetEvent Sleep GetCurrentProcessId GetCurrentProcess DeleteFileW GetFullPathNameW CopyFileW GetTempPathA GetModuleFileNameW VirtualFree SizeofResource LoadResource FindResourceW CloseHandle GetModuleHandleA GetLastError HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

CryptCreateHash AccessCheckByType CryptAcquireContextW

comctl32

InitCommonControlsEx ImageList_GetImageInfo ImageList_DragMove

Sharing

General

Malware Config

Signatures

File Explorer

a3df1fa7719a753b3f3b2b5e5ca3b903_JaffaCakes118

kernel32

advapi32

comctl32

generic