ae65dcd1d52b59918c124adc247131f5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ae65dcd1d52b59918c124adc247131f5_JaffaCakes118
Size 788KB
Sample240615-phstxstgql
SHA256 70cbc5486e9ba67493c90d4e6fc950c27eb53adc2422845ffba7e6f747f8fcb1
MD5 ae65dcd1d52b59918c124adc247131f5
SHA1 99905eea0520598d7a701f6ffccc660c65a7cc50
SHA512 67d02e7adcd86097578db7d72141606bfe98802178b0bb0f16a58d9581e70d5aa95c7e9bd9dcb51078d05100fad2a7b725cce629e12002990dd8cc8a445641d5
SSDEEP 12288:8skA5tjvS3/BPUiaAJTadihLZbSRpky2nF2v8JFQzJjZa3RkffMpRQyt:2AzSyiZJ1mkF2EJF4lcRGfMpuu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae65dcd1d52b59918c124adc247131f5_JaffaCakes118

File Explorer

ae65dcd1d52b59918c124adc247131f5_JaffaCakes118

.exe 788KB

ae65dcd1d52b59918c124adc247131f5_JaffaCakes118

IMPHASH 639c1f8941fdd39c79924b95643392fc
SHA256 70cbc5486e9ba67493c90d4e6fc950c27eb53adc2422845ffba7e6f747f8fcb1
MD5 ae65dcd1d52b59918c124adc247131f5
SHA1 99905eea0520598d7a701f6ffccc660c65a7cc50
SHA512 67d02e7adcd86097578db7d72141606bfe98802178b0bb0f16a58d9581e70d5aa95c7e9bd9dcb51078d05100fad2a7b725cce629e12002990dd8cc8a445641d5
SSDEEP 12288:8skA5tjvS3/BPUiaAJTadihLZbSRpky2nF2v8JFQzJjZa3RkffMpRQyt:2AzSyiZJ1mkF2EJF4lcRGfMpuu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7797

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\hofajayoho75-wic_zeyoseragojaxuyagu-jiwuzij.pdb

kernel32

OpenSemaphoreW LoadLibraryA GetModuleFileNameW GetProcessShutdownParameters SetEnvironmentVariableA GetFirmwareEnvironmentVariableA EnumResourceTypesA EndUpdateResourceW GetProfileStringA WritePrivateProfileSectionW GetPrivateProfileSectionNamesA GetCurrentDirectoryW CreateDirectoryExW DefineDosDeviceA GetFileAttributesExW lstrlenA CopyFileW IsBadStringPtrA CommConfigDialogW GetDefaultCommConfigW OpenJobObjectA QueryInformationJobObject ReleaseActCtx GetCalendarInfoA GetSystemDefaultLCID ReadConsoleInputW WriteConsoleW FlushFileBuffers SetFilePointerEx lstrcatA lstrcpyA lstrcmpW CreateMailslotW GetNamedPipeInfo FindClose CancelDeviceWakeupRequest UnlockFile FreeEnvironmentStringsW GetEnvironmentStringsW GetExitCodeProcess HeapReAlloc HeapAlloc VirtualAlloc GlobalFree GlobalAlloc DeleteFileW GetProcAddress QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree GetFileType GetStringTypeW DecodePointer CloseHandle FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW LCMapStringW SetStdHandle GetProcessHeap RaiseException HeapSize GetConsoleCP GetConsoleMode CreateFileW

user32

ModifyMenuW GetClipboardFormatNameA PeekMessageA GetMonitorInfoW

advapi32

GetServiceKeyNameA RegSaveKeyW RegQueryValueExW RegQueryValueA RegOpenKeyExW RegCreateKeyW RegCloseKey LogonUserW GetFileSecurityA GetSecurityDescriptorControl AddAccessDeniedAce GetAce AddAce AreAllAccessesGranted ObjectPrivilegeAuditAlarmW ClearEventLogA RegisterServiceCtrlHandlerA

Name

.text

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

664KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

32.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xax

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dasaca

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ae65dcd1d52b59918c124adc247131f5_JaffaCakes118

kernel32

user32

advapi32

generic