a85929d99bfd9a1b1a4982989c6ff4a6_JaffaCakes118

General

Target
a85929d99bfd9a1b1a4982989c6ff4a6_JaffaCakes118
Size 870KB
Sample240614-hbc2kaydkf
SHA256 6ed4c01d5efb35d530236a4c860a6f1826dd13a521f9b63eb53436ef21ea599d
MD5 a85929d99bfd9a1b1a4982989c6ff4a6
SHA1 e2d9577a2ef00f63900e708233738c5aff42376f
SHA512 acf3b033c547084c7f5780f65e375dd705e00091fbd6aa0042e0763ba7f73a1f6dc51a2261c045f02dcb5ac8cdc2bcbfc464c2277a7cb59b89eec05351dd1363
SSDEEP 12288:LBrbJCFWjFqiJqtfBisIqu/XlpTwSIVTYp+gEWPTCG7aGO5OXkh7AdYDkQKZfR1w:lgWH4V01dDEIG9GO5OUh7AdOM/TRG5MQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a85929d99bfd9a1b1a4982989c6ff4a6_JaffaCakes118

File Explorer

a85929d99bfd9a1b1a4982989c6ff4a6_JaffaCakes118

.exe 870KB

a85929d99bfd9a1b1a4982989c6ff4a6_JaffaCakes118

IMPHASH 8e5489c3134f0f9ce4cfd0b0b8b2df35
SHA256 6ed4c01d5efb35d530236a4c860a6f1826dd13a521f9b63eb53436ef21ea599d
MD5 a85929d99bfd9a1b1a4982989c6ff4a6
SHA1 e2d9577a2ef00f63900e708233738c5aff42376f
SHA512 acf3b033c547084c7f5780f65e375dd705e00091fbd6aa0042e0763ba7f73a1f6dc51a2261c045f02dcb5ac8cdc2bcbfc464c2277a7cb59b89eec05351dd1363
SSDEEP 12288:LBrbJCFWjFqiJqtfBisIqu/XlpTwSIVTYp+gEWPTCG7aGO5OXkh7AdYDkQKZfR1w:lgWH4V01dDEIG9GO5OUh7AdOM/TRG5MQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

250566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA VirtualFree GetModuleHandleA GetCurrentProcessId GetModuleFileNameW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId WaitForSingleObject CloseHandle DeleteCriticalSection FreeLibrary IsWow64Process GetProcAddress VirtualAlloc GetCommandLineW GetTickCount CreateEventA Sleep SetEvent CreateEventW GetLastError GetFullPathNameW CopyFileW DeleteFileW GetCurrentProcess FreeResource SizeofResource LockResource LoadResource FindResourceExW VirtualProtect FindResourceW HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc IsProcessorFeaturePresent GetProcessHeap IsDebuggerPresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

ConvertSidToStringSidA BuildTrusteeWithNameA CryptDeriveKey

comctl32

PropertySheetA GetMUILanguage ImageList_ReplaceIcon

Sharing

General

Malware Config

Signatures

File Explorer

a85929d99bfd9a1b1a4982989c6ff4a6_JaffaCakes118

kernel32

advapi32

comctl32

generic