a64d9d091de27b52ce57579d917c586d_JaffaCakes118

General

Target
a64d9d091de27b52ce57579d917c586d_JaffaCakes118
Size 852KB
Sample240613-s31xtavcrc
SHA256 a0ffe142a937fe1c0b12d1fd306da7b7e5df6dff6612a2533d0a5e6dc77c775b
MD5 a64d9d091de27b52ce57579d917c586d
SHA1 7e2ca3279b478d357346456f8ec9577ad28048f7
SHA512 ba3d57e799010a11e11ceb6cd336359fe04effdd1b875e100447eae76851292904dd40e8558eb2fe8bc8f19261585ba0791f27e78ad489608c1340e26e2e75d3
SSDEEP 12288:pJ3AiL0ta7QGeosEyP92SNs5b1/vtUua79xPK+12gpmz53QDjw/uMhMeg/+iB/1B:pJVL0/jEy2j5bcfhxi+ziqDjeha/7mcr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a64d9d091de27b52ce57579d917c586d_JaffaCakes118

File Explorer

a64d9d091de27b52ce57579d917c586d_JaffaCakes118

.exe 852KB

a64d9d091de27b52ce57579d917c586d_JaffaCakes118

IMPHASH ce26e8331433c2b62b13b80da17bdc3e
SHA256 a0ffe142a937fe1c0b12d1fd306da7b7e5df6dff6612a2533d0a5e6dc77c775b
MD5 a64d9d091de27b52ce57579d917c586d
SHA1 7e2ca3279b478d357346456f8ec9577ad28048f7
SHA512 ba3d57e799010a11e11ceb6cd336359fe04effdd1b875e100447eae76851292904dd40e8558eb2fe8bc8f19261585ba0791f27e78ad489608c1340e26e2e75d3
SSDEEP 12288:pJ3AiL0ta7QGeosEyP92SNs5b1/vtUua79xPK+12gpmz53QDjw/uMhMeg/+iB/1B:pJVL0/jEy2j5bcfhxi+ziqDjeha/7mcr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

99392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA RemoveDirectoryA SetCurrentDirectoryA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect GetProcAddress LoadLibraryA VirtualAlloc GetCurrentThreadId WaitForSingleObject GetTempPathW DeleteCriticalSection FreeLibrary GetCommandLineW GetTickCount SetEvent Sleep CreateEventA GetCurrentProcessId GetCurrentProcess GetFullPathNameW DeleteFileW CopyFileW GetTempPathA GetModuleFileNameW VirtualFree SizeofResource LoadResource GetModuleHandleA CloseHandle FindResourceW GetLastError HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

BuildSecurityDescriptorA CryptEncrypt AccessCheckByType

comctl32

ImageList_GetIcon DestroyPropertySheetPage PropertySheetW

Sharing

General

Malware Config

Signatures

File Explorer

a64d9d091de27b52ce57579d917c586d_JaffaCakes118

kernel32

advapi32

comctl32

generic