099c42dd583c4851eb1135b1e864a6d2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
099c42dd583c4851eb1135b1e864a6d2_JaffaCakes118
Size 164KB
Sample240620-1sxfmsshkl
SHA256 dff546b1e1331ef6bd0fcc0df0d80a96e4a8d5b5b4a98af77ff766d83475bcfe
MD5 099c42dd583c4851eb1135b1e864a6d2
SHA1 c4239ef46bb0f58562fb69394ad510ab797bea2e
SHA512 d9bd8707c8fcc34a191089e698b9aeede0eb6e65f59330b001905a00c61bab20970ea4116d589900033072161846232047517073eac6ce809ce61832eff211fa
SSDEEP 1536:RmTuHpYB0r03r1cxIfx92AGHx2UF4gDg26fYcijTH4yzgZr1uf54ywRrP9Er/il5:RmywxQAOVFrefYciLgt1uf54y2Er/i5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
099c42dd583c4851eb1135b1e864a6d2_JaffaCakes118

File Explorer

099c42dd583c4851eb1135b1e864a6d2_JaffaCakes118

.dll 164KB

099c42dd583c4851eb1135b1e864a6d2_JaffaCakes118

IMPHASH 50a30f5a425da8691b52a37469374408
SHA256 dff546b1e1331ef6bd0fcc0df0d80a96e4a8d5b5b4a98af77ff766d83475bcfe
MD5 099c42dd583c4851eb1135b1e864a6d2
SHA1 c4239ef46bb0f58562fb69394ad510ab797bea2e
SHA512 d9bd8707c8fcc34a191089e698b9aeede0eb6e65f59330b001905a00c61bab20970ea4116d589900033072161846232047517073eac6ce809ce61832eff211fa
SSDEEP 1536:RmTuHpYB0r03r1cxIfx92AGHx2UF4gDg26fYcijTH4yzgZr1uf54ywRrP9Er/il5:RmywxQAOVFrefYciLgt1uf54y2Er/i5
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86821

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW lstrcpynW MultiByteToWideChar lstrlenA SizeofResource LoadResource FindResourceW GetLastError LoadLibraryExW lstrcatW ReadFile CreateFileA GetTempPathA FlushFileBuffers WriteFile DeleteFileA DeviceIoControl WideCharToMultiByte IsBadReadPtr Module32NextW Module32FirstW InterlockedIncrement GetModuleHandleA WriteProcessMemory GetCurrentProcess VirtualProtect Sleep DebugBreak SetErrorMode OpenEventA ExitProcess GetFileSize GetSystemDirectoryA OutputDebugStringA LoadLibraryA ReadProcessMemory GlobalLock GlobalAlloc GetWindowsDirectoryA CreateThread GetTickCount LocalFree InterlockedDecrement LoadLibraryW GetProcAddress FreeLibrary lstrcpyW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DisableThreadLibraryCalls DeleteCriticalSection HeapDestroy CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle GetModuleFileNameW GetModuleHandleW GetShortPathNameW GetCurrentProcessId lstrlenW

user32

MessageBoxW CharLowerW wsprintfA SetWindowLongW CharNextW

advapi32

RegCreateKeyExA RegFlushKey RegDeleteKeyA RegOpenKeyExA RegQueryValueExA RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegEnumKeyExW RegDeleteKeyW RegDeleteValueW RegDeleteValueA AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegSetValueExA

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

VariantClear SysAllocStringLen LoadTypeLi SysAllocString VarUI4FromStr LoadRegTypeLi SysStringLen RegisterTypeLi SysFreeString

msvcrt

strncpy _CxxThrowException _strlwr _stricmp _adjust_fdiv _initterm _onexit __dllonexit strrchr abort atoi wcscpy ??1type_info@@UAE@XZ strlen strchr strcmp strstr sprintf _wcslwr free _wcsicmp memset ??3@YAXPAX@Z memcpy memcmp _purecall ??2@YAPAXI@Z malloc realloc strcat strcpy wcslen wcsstr

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

wsock32

connect ioctlsocket htons inet_ntoa select send recv __WSAFDIsSet WSACleanup WSAStartup gethostbyname closesocket socket shutdown inet_addr

Sharing

General

Malware Config

Signatures

File Explorer

099c42dd583c4851eb1135b1e864a6d2_JaffaCakes118

kernel32

user32

advapi32

ole32

oleaut32

msvcrt

wininet

wsock32

generic