ad5e9847042787d16c67fa4190213940_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ad5e9847042787d16c67fa4190213940_JaffaCakes118
Size 145KB
Sample240615-jh8mgsseqh
SHA256 e114a6e69c52b0b033c532d57f52c97b671e58f4f8a4176d19c1391c41ee73d6
MD5 ad5e9847042787d16c67fa4190213940
SHA1 ff70e49d50b18c6fd89f658e1fc8752dab18dec6
SHA512 188c99b86944d1a42ec9dcfa3ab6999b7042fb6b01442919fd050e30388fb31c055a34872670ea3485cc597baa5c69b2c4314baf0686d558a862f6412c49736e
SSDEEP 3072:kyYIilXVCZV4xqbqP1AjTPsjuHY1aUycOo9EdAPioPZrnghGLOrigrcGN2:7zoMVuqePSHs6KOo9EdAPXPZLGGarmG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad5e9847042787d16c67fa4190213940_JaffaCakes118

File Explorer

ad5e9847042787d16c67fa4190213940_JaffaCakes118

.exe 145KB

ad5e9847042787d16c67fa4190213940_JaffaCakes118

IMPHASH fb07d04bdc5b2c60e496d1ee84f41509
SHA256 e114a6e69c52b0b033c532d57f52c97b671e58f4f8a4176d19c1391c41ee73d6
MD5 ad5e9847042787d16c67fa4190213940
SHA1 ff70e49d50b18c6fd89f658e1fc8752dab18dec6
SHA512 188c99b86944d1a42ec9dcfa3ab6999b7042fb6b01442919fd050e30388fb31c055a34872670ea3485cc597baa5c69b2c4314baf0686d558a862f6412c49736e
SSDEEP 3072:kyYIilXVCZV4xqbqP1AjTPsjuHY1aUycOo9EdAPioPZrnghGLOrigrcGN2:7zoMVuqePSHs6KOo9EdAPXPZLGGarmG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

75842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

A:\WindowsProcessManager-master\WindowsProcessManager-master\Release\TaskMgr.pdb

kernel32

Process32NextW Process32FirstW CreateToolhelp32Snapshot VirtualAlloc GetCurrentProcessId GetCurrentThreadId GetTickCount CreateProcessW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoA InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime TerminateProcess OpenProcess QueryFullProcessImageNameW CloseHandle GetCurrentProcess GetLastError FormatMessageW QueryPerformanceCounter ExitProcess

user32

SendMessageW DefWindowProcW CreateWindowExW wsprintfW GetMessageW UpdateWindow SetTimer RegisterClassExW LoadCursorW LoadIconW TranslateMessage DispatchMessageW PostQuitMessage ShowWindow MessageBoxW SetWindowTextW GetWindowTextW

advapi32

OpenProcessToken AdjustTokenPrivileges LookupAccountSidW GetTokenInformation GetUserNameW LookupPrivilegeValueW

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

comctl32

InitCommonControlsEx

psapi

GetProcessMemoryInfo

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

msvcr90

_invoke_watson _controlfp_s _lock _except_handler4_common _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode _adjust_fdiv wcschr ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ __setusermatherr ??3@YAXPAX@Z ??0exception@std@@QAE@XZ __CxxFrameHandler3 wprintf ??_V@YAXPAX@Z wcsncpy _wcsdup memset malloc _invalid_parameter_noinfo _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??2@YAPAXI@Z _unlock __dllonexit _encode_pointer ??1exception@std@@UAE@XZ _onexit _decode_pointer _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

ad5e9847042787d16c67fa4190213940_JaffaCakes118

kernel32

user32

advapi32

msvcp90

comctl32

psapi

version

msvcr90

generic