02cdfdc0d1b43b93214d6b1f4a6b124b_JaffaCakes118

General

Target
02cdfdc0d1b43b93214d6b1f4a6b124b_JaffaCakes118
Size 212KB
Sample240620-e3ta3stbjk
SHA256 654c9630204e37ac0137ca00e8dbf2b85d669dd09401f345c6fd72116c8b56f0
MD5 02cdfdc0d1b43b93214d6b1f4a6b124b
SHA1 7c40b683b660f2d178ef30fc69186cc8a2542b74
SHA512 598b19d93d1c4af87dae0bbc8b70ab7e618e2576281afd32e4b94d9ef6f37ae5028b8018a6d650b007fc244827855865b368238bf57c971b95ee27c560570cf3
SSDEEP 3072:wgKKuiX63bw5dNjDh8pWVgTlFIYnV/DtJaOw4ycJkspMLTF+7:hKZp3KNjVGvV/HMFZsCTA7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02cdfdc0d1b43b93214d6b1f4a6b124b_JaffaCakes118

File Explorer

02cdfdc0d1b43b93214d6b1f4a6b124b_JaffaCakes118

.dll 212KB

02cdfdc0d1b43b93214d6b1f4a6b124b_JaffaCakes118

IMPHASH a68d51a78b7115c1573487ba15fe0cde
SHA256 654c9630204e37ac0137ca00e8dbf2b85d669dd09401f345c6fd72116c8b56f0
MD5 02cdfdc0d1b43b93214d6b1f4a6b124b
SHA1 7c40b683b660f2d178ef30fc69186cc8a2542b74
SHA512 598b19d93d1c4af87dae0bbc8b70ab7e618e2576281afd32e4b94d9ef6f37ae5028b8018a6d650b007fc244827855865b368238bf57c971b95ee27c560570cf3
SSDEEP 3072:wgKKuiX63bw5dNjDh8pWVgTlFIYnV/DtJaOw4ycJkspMLTF+7:hKZp3KNjVGvV/HMFZsCTA7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

122880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\perforce\Gep\HelpClient\1.0\Source\lib\windows\AdobeHelpLib\Release\AdobeHelpLib.pdb

kernel32

MultiByteToWideChar GetFileAttributesExW CloseHandle CreateProcessW InterlockedIncrement InterlockedDecrement RtlUnwind RaiseException ExitProcess HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA GetVersionExA TlsAlloc SetLastError GetLastError TlsFree TlsSetValue TlsGetValue GetProcAddress GetModuleHandleA SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc TerminateProcess GetCurrentProcess HeapSize HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr WriteFile FlushFileBuffers SetFilePointer SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW UnhandledExceptionFilter IsBadReadPtr IsBadCodePtr GetACP GetOEMCP GetCPInfo LoadLibraryA InterlockedExchange VirtualQuery InitializeCriticalSection SetStdHandle ReadFile CreateFileW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetEndOfFile VirtualProtect GetSystemInfo GetLocaleInfoW

shell32

ShellExecuteExW SHGetFolderPathW

Name

.text

Size

76KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

02cdfdc0d1b43b93214d6b1f4a6b124b_JaffaCakes118

kernel32

shell32

generic