a84329c6d136992a89171194bd80579a_JaffaCakes118

General

Target
a84329c6d136992a89171194bd80579a_JaffaCakes118
Size 845KB
Sample240614-gvx1ea1grj
SHA256 c519e9d48ca9104f2f698a4c667683344a0a4216a44bac80620e96ad38a84b6a
MD5 a84329c6d136992a89171194bd80579a
SHA1 0ce10e164cbcfbc2e0022ebdb19072ad17253810
SHA512 6ee262d8f231887ca472fc030cddab5411e2bf7fbdf7d7db6b6a25ab875e40738f44aecb574c2064341e2bac9f2fec1a4f12ec0c2f1562c382fe32b1716ca93c
SSDEEP 24576:LYL0rzeL+e/O0t3r8xfHN/DtONY4IEOJRyO:LsSey0dr8xfFgNYYOJoO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a84329c6d136992a89171194bd80579a_JaffaCakes118

File Explorer

a84329c6d136992a89171194bd80579a_JaffaCakes118

.exe 845KB

a84329c6d136992a89171194bd80579a_JaffaCakes118

IMPHASH e75eb985ef3959a0911d09d9d94bbb2f
SHA256 c519e9d48ca9104f2f698a4c667683344a0a4216a44bac80620e96ad38a84b6a
MD5 a84329c6d136992a89171194bd80579a
SHA1 0ce10e164cbcfbc2e0022ebdb19072ad17253810
SHA512 6ee262d8f231887ca472fc030cddab5411e2bf7fbdf7d7db6b6a25ab875e40738f44aecb574c2064341e2bac9f2fec1a4f12ec0c2f1562c382fe32b1716ca93c
SSDEEP 24576:LYL0rzeL+e/O0t3r8xfHN/DtONY4IEOJRyO:LsSey0dr8xfFgNYYOJoO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

92727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RemoveDirectoryA GetTempPathA CloseHandle WriteFile CreateFileA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect LoadLibraryA GetProcAddress VirtualAlloc GetCurrentThreadId CreateDirectoryA FreeLibrary DeleteCriticalSection GetCommandLineW GetTickCount CreateEventA SetEvent Sleep GetCurrentProcessId GetCurrentProcess CopyFileW DeleteFileW GetFullPathNameW GetTempPathW SetCurrentDirectoryA GetModuleFileNameW VirtualFree SizeofResource LoadResource GetModuleHandleA WaitForSingleObject FindResourceW GetLastError HeapFree ReadFile GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW GetSystemTimeAsFileTime HeapAlloc GetProcessHeap IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo GetFileAttributesExW SetStdHandle FlushFileBuffers GetConsoleCP CreateFileW HeapReAlloc OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW WriteConsoleW SetEndOfFile HeapSize

advapi32

CryptDuplicateKey ConvertSidToStringSidW AreAllAccessesGranted

comctl32

ImageList_DragShowNolock ImageList_DragMove ImageList_BeginDrag

Sharing

General

Malware Config

Signatures

File Explorer

a84329c6d136992a89171194bd80579a_JaffaCakes118

kernel32

advapi32

comctl32

generic