bc80dc8aa3d76f0e9c1eb92dfed6fa00_JaffaCakes118

General

Target
bc80dc8aa3d76f0e9c1eb92dfed6fa00_JaffaCakes118
Size 879KB
Sample240618-r5j7easdpl
SHA256 6d4c52c5d9e84cb0ef5dd6b779394a787d9379c8b3639a459ffa2653e7b113c0
MD5 bc80dc8aa3d76f0e9c1eb92dfed6fa00
SHA1 c539b9cb6f9b5dd81059003d68ce6363625be39a
SHA512 f28dceced2f8fd10616691ed30ce3851a20e6092ef4b113b61089c87363e11fbd42d95b0b8e2d7c72e11ce4f8ba69728a442ffcabe1bda794ecc7588ce2d31a9
SSDEEP 24576:nC+sfMYJsFZSjAHkY4d9xv0evK/tXHFpAB9vW4NHAP:nC+4tJsXs6d4dsTXHDAB7mP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc80dc8aa3d76f0e9c1eb92dfed6fa00_JaffaCakes118

File Explorer

bc80dc8aa3d76f0e9c1eb92dfed6fa00_JaffaCakes118

.exe 879KB

bc80dc8aa3d76f0e9c1eb92dfed6fa00_JaffaCakes118

IMPHASH 9253690c35506f14fc95e6152c058f07
SHA256 6d4c52c5d9e84cb0ef5dd6b779394a787d9379c8b3639a459ffa2653e7b113c0
MD5 bc80dc8aa3d76f0e9c1eb92dfed6fa00
SHA1 c539b9cb6f9b5dd81059003d68ce6363625be39a
SHA512 f28dceced2f8fd10616691ed30ce3851a20e6092ef4b113b61089c87363e11fbd42d95b0b8e2d7c72e11ce4f8ba69728a442ffcabe1bda794ecc7588ce2d31a9
SSDEEP 24576:nC+sfMYJsFZSjAHkY4d9xv0evK/tXHFpAB9vW4NHAP:nC+4tJsXs6d4dsTXHDAB7mP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

259222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA VirtualFree GetModuleHandleA GetCurrentProcessId GetModuleFileNameW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId WaitForSingleObject CloseHandle DeleteCriticalSection FreeLibrary IsWow64Process GetProcAddress VirtualAlloc GetCommandLineW GetTickCount CreateEventA Sleep SetEvent CreateEventW GetLastError GetFullPathNameW CopyFileW DeleteFileW GetCurrentProcess FreeResource SizeofResource LockResource LoadResource FindResourceExW VirtualProtect FindResourceW HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc IsProcessorFeaturePresent GetProcessHeap IsDebuggerPresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

AddAccessAllowedAce CryptDuplicateKey AddAccessAllowedObjectAce

comctl32

CreateStatusWindowW ImageList_DragEnter DrawStatusTextW

Sharing

General

Malware Config

Signatures

File Explorer

bc80dc8aa3d76f0e9c1eb92dfed6fa00_JaffaCakes118

kernel32

advapi32

comctl32

generic