0429795a90aa4a325ee875dccbcc1535_JaffaCakes118

General

Target
0429795a90aa4a325ee875dccbcc1535_JaffaCakes118
Size 545KB
Sample240622-2fynls1gkl
SHA256 a75911d7e23552cee42fa20516ff2ac2951a45dd7e8ce1782f8007f5d3dcb93c
MD5 0429795a90aa4a325ee875dccbcc1535
SHA1 af2b5ccd4f508e8dab2d41242b52849f9dd127f8
SHA512 6dfc41c15f7e5ea46d92a8882a694d037c897f188da773d81e4adb6af730ff32eb7d07a5cef85f1a18b60749c31fcce0a7dc05027cce204105e18143221d67a5
SSDEEP 12288:5YHGjD2CU7QnpIyoImgvdo95FwV41DdjsehlXczxp6L:5hX2CU7kIV7ud+WGpdp3g36L
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0429795a90aa4a325ee875dccbcc1535_JaffaCakes118

File Explorer

0429795a90aa4a325ee875dccbcc1535_JaffaCakes118

.exe 545KB

0429795a90aa4a325ee875dccbcc1535_JaffaCakes118

IMPHASH d33805713bf84c5172011e6ee58dcc60
SHA256 a75911d7e23552cee42fa20516ff2ac2951a45dd7e8ce1782f8007f5d3dcb93c
MD5 0429795a90aa4a325ee875dccbcc1535
SHA1 af2b5ccd4f508e8dab2d41242b52849f9dd127f8
SHA512 6dfc41c15f7e5ea46d92a8882a694d037c897f188da773d81e4adb6af730ff32eb7d07a5cef85f1a18b60749c31fcce0a7dc05027cce204105e18143221d67a5
SSDEEP 12288:5YHGjD2CU7QnpIyoImgvdo95FwV41DdjsehlXczxp6L:5hX2CU7kIV7ud+WGpdp3g36L
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yiz-kizew\depeh.pdb

kernel32

HeapReAlloc GlobalDeleteAtom GetLocaleInfoA InterlockedIncrement GetQueuedCompletionStatus GetEnvironmentStringsW SetEvent ReadConsoleW GetCommandLineA CreateActCtxW GlobalAlloc CopyFileW FreeConsole LeaveCriticalSection GetFileAttributesA HeapCreate WriteConsoleW GetModuleFileNameW lstrlenW ReleaseSemaphore SetConsoleTitleA FlushFileBuffers DeactivateActCtx InterlockedExchange GetProcAddress BeginUpdateResourceW RemoveDirectoryA VerLanguageNameW LocalAlloc SetConsoleWindowInfo SetEnvironmentVariableA SetConsoleTitleW GetModuleHandleA EraseTape VirtualProtect EndUpdateResourceA FindFirstVolumeW GetCurrentProcessId GetPrivateProfileSectionW FindNextVolumeA lstrcpyW GetConsoleOutputCP WideCharToMultiByte InterlockedDecrement InterlockedCompareExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection GetLastError HeapFree HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetCPInfo RtlUnwind RaiseException LCMapStringW LCMapStringA GetStringTypeW VirtualFree VirtualAlloc GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId SetHandleCount GetFileType GetStartupInfoA SetFilePointer GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetStringTypeA HeapSize GetUserDefaultLCID EnumSystemLocalesA IsValidLocale InitializeCriticalSectionAndSpinCount LoadLibraryA CloseHandle CreateFileA SetStdHandle GetConsoleCP GetConsoleMode GetLocaleInfoW SetEndOfFile GetProcessHeap ReadFile WriteConsoleA

Sharing

General

Malware Config

Signatures

File Explorer

0429795a90aa4a325ee875dccbcc1535_JaffaCakes118

kernel32

generic