0a6435def7875e021544a096c6404498_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
0a6435def7875e021544a096c6404498_JaffaCakes118
Size 147KB
Sample240621-jxxtjawdql
SHA256 6d2b7afb37bb90d952c8a0053d59fe1cd3e18ed145c3cc35eddf5fb83d28d0b0
MD5 0a6435def7875e021544a096c6404498
SHA1 4a11988835efeffadf56e626f7c30a2cb42f5a1c
SHA512 81e13fd81742908a83cac9c89809339dd4be56e75442fc38d433e6ea3454e9505091ad12a6946dd173fcad0ae4fa112b42023a8add7be52034201c962d314d87
SSDEEP 3072:/i46ZtzQ6FfGtAQHTItiwlGmwUwtDDGNhM42y:/ixhGtXItiwmUqDTM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

0a6435def7875e021544a096c6404498_JaffaCakes118

.dll 147KB

0a6435def7875e021544a096c6404498_JaffaCakes118

IMPHASH 7f41536cd1cdad77f13904e18a35eb3a
SHA256 6d2b7afb37bb90d952c8a0053d59fe1cd3e18ed145c3cc35eddf5fb83d28d0b0
MD5 0a6435def7875e021544a096c6404498
SHA1 4a11988835efeffadf56e626f7c30a2cb42f5a1c
SHA512 81e13fd81742908a83cac9c89809339dd4be56e75442fc38d433e6ea3454e9505091ad12a6946dd173fcad0ae4fa112b42023a8add7be52034201c962d314d87
SSDEEP 3072:/i46ZtzQ6FfGtAQHTItiwlGmwUwtDDGNhM42y:/ixhGtXItiwmUqDTM
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

45622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\projects\CertGrabber\Release\cert.pdb

kernel32

RaiseException InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetLastError lstrcmpiW InterlockedIncrement InterlockedDecrement EnterCriticalSection LeaveCriticalSection GetModuleFileNameW FreeLibrary MultiByteToWideChar GetModuleHandleW WriteFile CreateFileW SetThreadLocale GetThreadLocale MapViewOfFile CreateFileMappingW CreateDirectoryW GetFileAttributesW GetSystemDirectoryW InterlockedExchangeAdd lstrlenW SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA WideCharToMultiByte GetSystemInfo GetModuleHandleA GetCurrentProcessId LoadLibraryExW LoadLibraryW LoadLibraryA lstrcmpiA GetCurrentProcess WriteProcessMemory VirtualQuery GetProcAddress SetStdHandle GetStringTypeW GetConsoleMode GetConsoleCP SetFilePointer GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetStringTypeA LCMapStringW Module32NextW Module32FirstW CreateToolhelp32Snapshot CloseHandle GetWindowsDirectoryW ExitProcess GetModuleFileNameA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedExchange GetACP GetLocaleInfoA GetVersionExA RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep VirtualFree VirtualAlloc HeapCreate GetStdHandle GetCPInfo GetOEMCP GetTimeFormatA GetDateFormatA GetTimeZoneInformation SetHandleCount GetFileType LCMapStringA

user32

MessageBoxA GetActiveWindow CharNextW GetParent GetClassNameW GetWindow GetTopWindow UnregisterClassA

advapi32

CryptImportKey RegDeleteValueW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryInfoKeyW RegQueryValueExW RegEnumKeyExW RegDeleteKeyW CryptDestroyKey CryptReleaseContext

ole32

StringFromGUID2 CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc

oleaut32

RegisterTypeLi UnRegisterTypeLi SysAllocString LoadTypeLi LoadRegTypeLi DispCallFunc SysStringLen VariantClear VariantInit VarUI4FromStr SysFreeString

imagehlp

ImageDirectoryEntryToData

crypt32

CertCloseStore CertFreeCertificateContext CryptAcquireCertificatePrivateKey CertFindCertificateInStore CertOpenStore CertNameToStrW PFXExportCertStore

Sharing

General

Malware Config

Signatures

File Explorer

0a6435def7875e021544a096c6404498_JaffaCakes118

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

imagehlp

crypt32

generic