01281d065034eea10aab76d01fbbee3b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
01281d065034eea10aab76d01fbbee3b_JaffaCakes118
Size 192KB
Sample240622-ejfwmsxapg
SHA256 59bdc6c68fbfba4084707306c263651da02dece85ec2f04444baf23241f03f17
MD5 01281d065034eea10aab76d01fbbee3b
SHA1 2c4bfb504228f5700d4a11b07262fd1dea76afcf
SHA512 afd0506be4a9995ac2054fa2c51036788d902a802bd89b01243d714b2d78f9b8159434a16fed1d7b86f5835655706a13510c444e3e43bd9b09fe5642d1a9c34b
SSDEEP 3072:p9NkAs3vNMzIduJ0fUq1mp5WeT9u7dlHsNr/r:HNkAsFSlqYjWH7O
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01281d065034eea10aab76d01fbbee3b_JaffaCakes118

File Explorer

01281d065034eea10aab76d01fbbee3b_JaffaCakes118

.dll 192KB

01281d065034eea10aab76d01fbbee3b_JaffaCakes118

IMPHASH 97bf0a88201cc9ee5a2406c67ee42212
SHA256 59bdc6c68fbfba4084707306c263651da02dece85ec2f04444baf23241f03f17
MD5 01281d065034eea10aab76d01fbbee3b
SHA1 2c4bfb504228f5700d4a11b07262fd1dea76afcf
SHA512 afd0506be4a9995ac2054fa2c51036788d902a802bd89b01243d714b2d78f9b8159434a16fed1d7b86f5835655706a13510c444e3e43bd9b09fe5642d1a9c34b
SSDEEP 3072:p9NkAs3vNMzIduJ0fUq1mp5WeT9u7dlHsNr/r:HNkAsFSlqYjWH7O
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

95936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetEndOfFile GetOEMCP GetACP SetFilePointer FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA GetCPInfo IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter WriteFile GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetFileType GetStdHandle SetHandleCount IsBadWritePtr VirtualAlloc VirtualFree HeapCreate ReadFile HeapSize TerminateProcess LCMapStringW LCMapStringA ExitProcess TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue GetVersion GetCommandLineA HeapReAlloc HeapAlloc RtlUnwind InterlockedExchange Sleep UnmapViewOfFile CreateFileA CreateFileMappingA MapViewOfFile WinExec IsDBCSLeadByte LoadLibraryExA FindResourceA LoadResource SizeofResource HeapDestroy InterlockedIncrement DeleteCriticalSection InitializeCriticalSection DisableThreadLibraryCalls CreateMutexA GetLastError GetShortPathNameA FreeLibrary FindFirstFileW FindNextFileW FindClose ExpandEnvironmentStringsW LocalFree lstrcatW GetModuleFileNameW LoadLibraryW lstrcmpiW lstrcpynW lstrlenW GetProcessHeap HeapFree WriteProcessMemory CreateToolhelp32Snapshot Module32First Module32Next lstrlenA lstrcmpiA GetCurrentProcessId CloseHandle OpenProcess GetModuleFileNameA lstrcatA GetSystemDefaultLangID GetPrivateProfileIntA GetPrivateProfileStringA lstrcpyW lstrcmpA lstrcpyA WideCharToMultiByte MultiByteToWideChar lstrcpynA GetModuleHandleA GetVersionExA InterlockedDecrement EnterCriticalSection LeaveCriticalSection GetCurrentProcess FlushInstructionCache GetCurrentThreadId LoadLibraryA GetProcAddress GetStartupInfoA

user32

SetWindowTextA GetCursorPos SetTimer UpdateWindow DefWindowProcA IsWindow GetWindowRect GetDlgCtrlID GetWindowTextW GetWindowTextLengthW SetWindowTextW PostMessageW SendMessageW DrawTextW FindWindowExW LoadImageW LoadIconW FindWindowW GetClassNameW SetWindowsHookExW wsprintfW CharNextA DrawIconEx GetWindowDC LoadImageA GetWindowThreadProcessId FillRect GetFocus LoadIconA DestroyIcon FindWindowExA GetSysColor SendMessageA GetWindowTextLengthA SetFocus LoadBitmapA CallWindowProcW SetWindowLongW GetClassNameA GetParent GetWindowLongW FindWindowA GetSystemMetrics GetClassInfoExA LoadCursorA wsprintfA RegisterClassExA ReleaseDC EndPaint CreateWindowExA CallWindowProcA GetWindowLongA SetWindowLongA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA ReleaseCapture SetCapture PtInRect GetDC InflateRect BeginPaint SystemParametersInfoA ShowWindow PostMessageA MoveWindow SetWindowRgn ScreenToClient OffsetRect SetRectEmpty GetClientRect DrawFrameControl GetWindowTextA DrawTextA IsRectEmpty CopyRect KillTimer

gdi32

SetStretchBltMode StretchBlt ExtTextOutA GetStockObject GetObjectA CreateFontIndirectA DeleteObject SetBkColor SelectObject CreateCompatibleDC SetTextColor SetBkMode FrameRgn OffsetRgn CreateSolidBrush ExcludeClipRect SetWindowOrgEx GetClipBox BitBlt EqualRgn CombineRgn CreateRectRgn CreatePolygonRgn SetViewportOrgEx GetViewportOrgEx SetPixel GetTextExtentPoint32A GetTextExtentPointA GetTextExtentPoint32W GetTextExtentPointW DeleteDC CreateCompatibleBitmap

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey RegQueryInfoKeyA RegEnumValueA RegSetValueExA RegCreateKeyExA RegDeleteKeyA RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegDeleteValueA RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegEnumValueW RegEnumKeyExA

shell32

SHGetDesktopFolder SHGetSpecialFolderPathW SHGetMalloc SHGetSpecialFolderLocation ShellExecuteA

ole32

CoTaskMemAlloc CoFreeUnusedLibraries CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemRealloc

oleaut32

RegisterTypeLi LoadTypeLi SysAllocString SysFreeString OleTranslateColor SysStringLen VarUI4FromStr LoadRegTypeLi

shlwapi

UrlApplySchemeW StrRetToBufW PathIsURLW StrCpyW StrDupW StrStrW StrStrIW StrStrA StrStrIA StrCmpW StrRStrIW PathFileExistsW PathIsDirectoryW StrCmpNIW StrDupA PathAppendA PathRemoveFileSpecA StrNCatW StrCmpIW

wininet

InternetCrackUrlW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Draw ImageList_SetBkColor ImageList_GetIconSize ImageList_ReplaceIcon ImageList_Remove ImageList_Destroy

Name

.text

Size

116KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Shared

Size

4KB

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

01281d065034eea10aab76d01fbbee3b_JaffaCakes118

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

comctl32

generic