a5017649be5636baf60408163c11100b_JaffaCakes118

General

Target
a5017649be5636baf60408163c11100b_JaffaCakes118
Size 1.5MB
Sample240613-l58bcayapp
SHA256 21914e0e745bf2246f62345d04e986edefcebe5a8842f661a4386d3fc9974f95
MD5 a5017649be5636baf60408163c11100b
SHA1 97efc58a71ae11ca863f084ce29d682f1395c61d
SHA512 e736857468ef6565810de79f8e7ecf948fda3173f73c94f833889d3ba8f4c68209c76d2905347832177a34db23993f787cdccd42863e225c59fb20776dbc11fc
SSDEEP 24576:EaqcZ/hViYzFZIsd+Lf2tSiWWxdnKnTSYi2KZwjKoNsQXOIA2kSl2z:nZZ3TxdRtNWGnQyXHoGQe5bGO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5017649be5636baf60408163c11100b_JaffaCakes118

File Explorer

a5017649be5636baf60408163c11100b_JaffaCakes118

.exe 1.5MB

a5017649be5636baf60408163c11100b_JaffaCakes118

IMPHASH 60022966177146b270b169f3b9f37060
SHA256 21914e0e745bf2246f62345d04e986edefcebe5a8842f661a4386d3fc9974f95
MD5 a5017649be5636baf60408163c11100b
SHA1 97efc58a71ae11ca863f084ce29d682f1395c61d
SHA512 e736857468ef6565810de79f8e7ecf948fda3173f73c94f833889d3ba8f4c68209c76d2905347832177a34db23993f787cdccd42863e225c59fb20776dbc11fc
SSDEEP 24576:EaqcZ/hViYzFZIsd+Lf2tSiWWxdnKnTSYi2KZwjKoNsQXOIA2kSl2z:nZZ3TxdRtNWGnQyXHoGQe5bGO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

68091

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA OpenMutexA GetModuleHandleA CreateMutexA ReleaseMutex CloseHandle GetTempPathA GetThreadContext InterlockedDecrement GetModuleHandleExW WaitForSingleObject InterlockedCompareExchange GetCurrentThread IsBadReadPtr Sleep VirtualProtect LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetLastError CreateEventA GetFileSize UnmapViewOfFile WriteFile SetLastError DeleteFileA ExitProcess HeapReAlloc MoveFileExA CreateProcessW SetUnhandledExceptionFilter SystemTimeToFileTime GetCurrentProcess GetTickCount OpenProcess TerminateProcess GetProcAddress GetTempFileNameA GetLocalTime GetProcessId AddVectoredExceptionHandler DuplicateHandle WideCharToMultiByte GetFileAttributesA MultiByteToWideChar CreateDirectoryA RemoveDirectoryA FindClose GetCurrentDirectoryA GetCurrentProcessId GetProcessHeap SetEvent HeapFree InterlockedIncrement HeapAlloc CreateFileW WriteConsoleW FlushFileBuffers SetStdHandle EncodePointer DecodePointer GetCurrentThreadId LoadLibraryExW GetCommandLineA RaiseException RtlUnwind InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent IsDebuggerPresent HeapSize GetStdHandle GetModuleFileNameW IsValidCodePage GetACP GetOEMCP GetCPInfo GetConsoleMode SetFilePointerEx GetFileType GetModuleFileNameA QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleCP OutputDebugStringW LoadLibraryW LCMapStringW GetStringTypeW VirtualQuery

advapi32

LookupPrivilegeValueA RegCloseKey RegOpenKeyExA RegQueryValueExA AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW

oleaut32

SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

a5017649be5636baf60408163c11100b_JaffaCakes118

kernel32

advapi32

shell32

oleaut32

generic