a472a612c96f5338be197d2b7feb9bff_JaffaCakes118

General

Target
a472a612c96f5338be197d2b7feb9bff_JaffaCakes118
Size 851KB
Sample240613-jecqmstcmp
SHA256 eeda17f2bef26945b795e15d3e957ce6b2d031cc6a748cc68e0d54ecf9cd0c45
MD5 a472a612c96f5338be197d2b7feb9bff
SHA1 c5a14006356ccb2758471b0bb7b2538d50bad210
SHA512 adbb5135cd421db95b41dc0c961b5c06c9ecbd50401c1520a095069cb28f8aa2892a60ab0aff09609b70ee044558637754c70a846641ffeebd9790461060a85a
SSDEEP 24576:vFtBGI0OyKsJKU0qAS6tTMZgj5HkOSBfXxUBejzsRB8JB3Rqp4Rn:vBG9KirBSqgj5EDTU9MJ9Rqp2n
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a472a612c96f5338be197d2b7feb9bff_JaffaCakes118

File Explorer

a472a612c96f5338be197d2b7feb9bff_JaffaCakes118

.exe 851KB

a472a612c96f5338be197d2b7feb9bff_JaffaCakes118

IMPHASH 5ef3f469ebee7f95918bdda5a6c392ab
SHA256 eeda17f2bef26945b795e15d3e957ce6b2d031cc6a748cc68e0d54ecf9cd0c45
MD5 a472a612c96f5338be197d2b7feb9bff
SHA1 c5a14006356ccb2758471b0bb7b2538d50bad210
SHA512 adbb5135cd421db95b41dc0c961b5c06c9ecbd50401c1520a095069cb28f8aa2892a60ab0aff09609b70ee044558637754c70a846641ffeebd9790461060a85a
SSDEEP 24576:vFtBGI0OyKsJKU0qAS6tTMZgj5HkOSBfXxUBejzsRB8JB3Rqp4Rn:vBG9KirBSqgj5EDTU9MJ9Rqp2n
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

98498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetTempPathW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId WaitForSingleObject CloseHandle FreeLibrary DeleteCriticalSection VirtualProtect GetProcAddress GetModuleFileNameW GetCommandLineW GetTickCount SetEvent Sleep CreateEventA GetCurrentProcess CreateEventW GetFullPathNameW GetLastError DeleteFileW CopyFileW GetCurrentProcessId LoadLibraryA VirtualFree SizeofResource LoadResource GetModuleHandleA VirtualAlloc FindResourceW HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

AreAllAccessesGranted CryptDeriveKey BuildTrusteeWithNameA

comctl32

_TrackMouseEvent ImageList_Draw ImageList_BeginDrag

Sharing

General

Malware Config

Signatures

File Explorer

a472a612c96f5338be197d2b7feb9bff_JaffaCakes118

kernel32

advapi32

comctl32

generic