a6390146d6eccc040d6b912f1d2eaf81_JaffaCakes118

General

Target
a6390146d6eccc040d6b912f1d2eaf81_JaffaCakes118
Size 404KB
Sample240613-sqdlrathkd
SHA256 f41ac941ed3ee0763123468ca8c25ada0126fc2ad6ac5678d58f397365d16579
MD5 a6390146d6eccc040d6b912f1d2eaf81
SHA1 904a550fd00e07c1dadb14d577a8d80c112cb0e3
SHA512 7f4d6b36b4ee13cd6ce201a83f2cd8883ceb71ceca759c41dcc2df90d31fa8c0fea5c84b4843c49797cddab755726c7cdfe4ff233318f33c9b81442797834569
SSDEEP 6144:lCEAVVTJtzhTfKNaTE3vpyMNPL1OC18yRGbIHeN/gJqQ8d9d/Oqv0:U3l5E3vpyMNT13LJqZOx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a6390146d6eccc040d6b912f1d2eaf81_JaffaCakes118

File Explorer

a6390146d6eccc040d6b912f1d2eaf81_JaffaCakes118

.exe 404KB

a6390146d6eccc040d6b912f1d2eaf81_JaffaCakes118

IMPHASH 53c2cd8d77288ce438ee292b50668ce0
SHA256 f41ac941ed3ee0763123468ca8c25ada0126fc2ad6ac5678d58f397365d16579
MD5 a6390146d6eccc040d6b912f1d2eaf81
SHA1 904a550fd00e07c1dadb14d577a8d80c112cb0e3
SHA512 7f4d6b36b4ee13cd6ce201a83f2cd8883ceb71ceca759c41dcc2df90d31fa8c0fea5c84b4843c49797cddab755726c7cdfe4ff233318f33c9b81442797834569
SSDEEP 6144:lCEAVVTJtzhTfKNaTE3vpyMNPL1OC18yRGbIHeN/gJqQ8d9d/Oqv0:U3l5E3vpyMNT13LJqZOx
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\constructicon\builds\gfx\three\17.50\drivers\2d\dal\eeu\atieah\build\wNow64a\B_rel\atieah64.pdb

version

VerQueryValueA GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

FlushFileBuffers SetFilePointerEx ExpandEnvironmentStringsA GetFileAttributesA CloseHandle OpenProcess QueryFullProcessImageNameW GetCommandLineA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId CreateFileW InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetSystemTimeAsFileTime TlsAlloc GetLastError ResumeThread CreateProcessA CreateProcessW VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory SetLastError GetCurrentProcess VirtualProtect VirtualQuery FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount WriteConsoleW TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess TerminateProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetCurrentThread GetFileType FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringA OutputDebugStringW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessHeap SetConsoleCtrlHandler HeapSize HeapReAlloc GetConsoleCP GetConsoleMode

advapi32

RegGetValueW

Sharing

General

Malware Config

Signatures

File Explorer

a6390146d6eccc040d6b912f1d2eaf81_JaffaCakes118

version

kernel32

advapi32

generic