01c46da04eea1fff80494dd1593d83f2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
01c46da04eea1fff80494dd1593d83f2_JaffaCakes118
Size 292KB
Sample240620-b3ldpawdlm
SHA256 7145980d03eae8a75e0075cd1322f9e18957a9d4c007b24bb97439d579388256
MD5 01c46da04eea1fff80494dd1593d83f2
SHA1 f7d5e44dd3d2ae4204137b696d681d9bd409f1fc
SHA512 fe1bd7d8da052acdd836be0d5408d7332a194f8985fb30fd2faba804fe892703b480060d6874752f8ac7a7e440f08f3de3d83cebde6be5ff8e0202a164496caa
SSDEEP 6144:eTYwY9BekMLlFpkmr+RaLRJW2K7Q3zM/xmZfNUjtgbw+IE:eT7YXekK1kmr+IbK83Km5Nctpq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01c46da04eea1fff80494dd1593d83f2_JaffaCakes118

File Explorer

01c46da04eea1fff80494dd1593d83f2_JaffaCakes118

.dll 292KB

01c46da04eea1fff80494dd1593d83f2_JaffaCakes118

IMPHASH 70687f11c915cd08c87cd2d0260fadf9
SHA256 7145980d03eae8a75e0075cd1322f9e18957a9d4c007b24bb97439d579388256
MD5 01c46da04eea1fff80494dd1593d83f2
SHA1 f7d5e44dd3d2ae4204137b696d681d9bd409f1fc
SHA512 fe1bd7d8da052acdd836be0d5408d7332a194f8985fb30fd2faba804fe892703b480060d6874752f8ac7a7e440f08f3de3d83cebde6be5ff8e0202a164496caa
SSDEEP 6144:eTYwY9BekMLlFpkmr+RaLRJW2K7Q3zM/xmZfNUjtgbw+IE:eT7YXekK1kmr+IbK83Km5Nctpq
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73523

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcatA InterlockedIncrement InterlockedDecrement GetFileAttributesA CreateDirectoryA SetEndOfFile CreateFileMappingA lstrcmpiA GetModuleHandleA lstrcpynA IsDBCSLeadByte Process32Next CloseHandle OpenProcess Process32First CreateToolhelp32Snapshot GetBinaryTypeA GetProcessHeap GetCurrentDirectoryA WinExec DeleteFileA CopyFileA SetFileAttributesA GetSystemDirectoryA GetWindowsDirectoryA CreateProcessW GetShortPathNameA GetDiskFreeSpaceExA SetFilePointer GetLogicalDriveStringsA SearchPathA WaitForSingleObject GetModuleFileNameA FreeLibrary GetProcAddress LoadLibraryA FindClose FindNextFileA lstrcmpA FindFirstFileA CreateEventA OpenMutexA GetVolumeInformationA GetFullPathNameA Module32Next Module32First CreateRemoteThread VirtualFreeEx WriteProcessMemory VirtualAllocEx MoveFileExA SetFileTime SystemTimeToFileTime CreateFileA GetSystemTime SetSystemTime ReadFile GetSystemTimeAsFileTime DeviceIoControl FlushFileBuffers SetStdHandle IsBadCodePtr IsBadReadPtr lstrcpyA InterlockedExchange lstrlenA GetLastError FindResourceExA FindResourceA LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW WideCharToMultiByte MultiByteToWideChar GetVersionExA GetThreadLocale GetLocaleInfoA GetACP CreateProcessA GetStringTypeW GetStringTypeA WriteFile UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetOEMCP SetUnhandledExceptionFilter HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery RtlUnwind ExitProcess GetCurrentThreadId GetCommandLineA MoveFileA LCMapStringA LCMapStringW GetCPInfo HeapCreate VirtualFree IsBadWritePtr TerminateProcess GetCurrentProcess QueryPerformanceCounter GetTickCount GetCurrentProcessId

user32

CharNextA

advapi32

RegDeleteValueA OpenServiceA QueryServiceStatus OpenSCManagerA OpenServiceW CloseServiceHandle InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameA CreateProcessAsUserW RegOpenKeyA RegQueryValueExA RegGetKeySecurity OpenProcessToken RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteKeyA

shell32

SHGetFileInfoA

ole32

CoGetClassObject StringFromGUID2 CoCreateInstance CoUninitialize StringFromCLSID CoInitialize CoTaskMemFree

oleaut32

SysFreeString SysStringLen LoadRegTypeLi VarUI4FromStr VariantInit RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString

shlwapi

PathFindExtensionA

Sharing

General

Malware Config

Signatures

File Explorer

01c46da04eea1fff80494dd1593d83f2_JaffaCakes118

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic