b0ce0e2fddef773e557033a6a01392ee_JaffaCakes118

General

Target
b0ce0e2fddef773e557033a6a01392ee_JaffaCakes118
Size 2.8MB
Sample240616-achpfavamj
SHA256 d56306ff26c0b38d40d6327987c4d1b22c6084868778c2a4672dd46cc5f4ceb5
MD5 b0ce0e2fddef773e557033a6a01392ee
SHA1 0d843e1e55e293fe6a93d5d6aa9a90bc44c08e8c
SHA512 40fb3f68124ccb2d3b5e2dd630a868bd899d2c706d9fb5e2739ca571f50f994cd8ee24b1cbd4033822ee7f07d1434cf91803a458371fd6d5c9f8300af8d33664
SSDEEP 49152:5Q4TsMvqAa64SDW0nyc/zbNip45BIaUM+nNr8EOxS2uQ065mfV6LAspUPBDK/+F:5oMuHSDWiDT5BfUPmnSFl65mfVC5UZDk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0ce0e2fddef773e557033a6a01392ee_JaffaCakes118

File Explorer

b0ce0e2fddef773e557033a6a01392ee_JaffaCakes118

.exe 2.8MB
DogeX.pyc

19KB

b0ce0e2fddef773e557033a6a01392ee_JaffaCakes118

IMPHASH fc40519af20116c903e3ff836e366e39
SHA256 d56306ff26c0b38d40d6327987c4d1b22c6084868778c2a4672dd46cc5f4ceb5
MD5 b0ce0e2fddef773e557033a6a01392ee
SHA1 0d843e1e55e293fe6a93d5d6aa9a90bc44c08e8c
SHA512 40fb3f68124ccb2d3b5e2dd630a868bd899d2c706d9fb5e2739ca571f50f994cd8ee24b1cbd4033822ee7f07d1434cf91803a458371fd6d5c9f8300af8d33664
SSDEEP 49152:5Q4TsMvqAa64SDW0nyc/zbNip45BIaUM+nNr8EOxS2uQ065mfV6LAspUPBDK/+F:5oMuHSDWiDT5BfUPmnSFl65mfVC5UZDk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError SetDllDirectoryW GetModuleFileNameW GetProcAddress GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW GetStartupInfoW LoadLibraryExW GetShortPathNameW FormatMessageA LoadLibraryA MultiByteToWideChar WideCharToMultiByte DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetCommandLineA ReadFile CreateFileW GetDriveTypeW GetFileType CloseHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW GetFullPathNameA CreateDirectoryW RemoveDirectoryW FindClose FindFirstFileExW FindNextFileW SetStdHandle SetConsoleCtrlHandler DeleteFileW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers SetEnvironmentVariableA GetFileAttributesExW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetProcessHeap WriteConsoleW GetTimeZoneInformation HeapSize HeapReAlloc SetEndOfFile RaiseException

ws2_32

ntohl

Sharing

General

Malware Config

Signatures

File Explorer

b0ce0e2fddef773e557033a6a01392ee_JaffaCakes118

kernel32

ws2_32

generic

DogeX.pyc