02a6cc8b7802baacbc85ed66b2ac5e83_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
02a6cc8b7802baacbc85ed66b2ac5e83_JaffaCakes118
Size 908KB
Sample240622-rwsges1gpf
SHA256 77ffd316c58e04a2fdf17072b8f4a9c048505e7f4c4758edd17ec02b3603b6b4
MD5 02a6cc8b7802baacbc85ed66b2ac5e83
SHA1 3da1c219344ef10e2973414db640cfba7bc4a60c
SHA512 e2bfd12f238fc3381e48a18365e0638082d2ca9e3aa262ccf84e75ce424ec8872066d654d59bfdc3566aed9a0328022733904f5bee8a06c2cd06b8ec9e43ae0b
SSDEEP 12288:JUIT2VNc9oJDGAbhZWPVhxTi5ZkvLy9SRFvvL+AQul5YzbYHXrJ8A4qMvkbL0mP1:J7SV9RbGPVbXvvRQullqAY8bL0mP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02a6cc8b7802baacbc85ed66b2ac5e83_JaffaCakes118

File Explorer

02a6cc8b7802baacbc85ed66b2ac5e83_JaffaCakes118

.dll 908KB

02a6cc8b7802baacbc85ed66b2ac5e83_JaffaCakes118

IMPHASH 5a36bb04e440f655ad78792828ae26bd
SHA256 77ffd316c58e04a2fdf17072b8f4a9c048505e7f4c4758edd17ec02b3603b6b4
MD5 02a6cc8b7802baacbc85ed66b2ac5e83
SHA1 3da1c219344ef10e2973414db640cfba7bc4a60c
SHA512 e2bfd12f238fc3381e48a18365e0638082d2ca9e3aa262ccf84e75ce424ec8872066d654d59bfdc3566aed9a0328022733904f5bee8a06c2cd06b8ec9e43ae0b
SSDEEP 12288:JUIT2VNc9oJDGAbhZWPVhxTi5ZkvLy9SRFvvL+AQul5YzbYHXrJ8A4qMvkbL0mP1:J7SV9RbGPVbXvvRQullqAY8bL0mP
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

614263

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

FindCloseUrlCache FindNextUrlCacheEntryW FindFirstUrlCacheEntryW DeleteUrlCacheEntryW

shlwapi

PathFindExtensionW PathFileExistsW PathAddBackslashW PathRemoveFileSpecW

winmm

PlaySoundW

dbghelp

SymLoadModule SymCleanup SymGetOptions SymSetOptions SymGetLineFromAddr SymFunctionTableAccess StackWalk SymGetSymFromAddr SymGetModuleBase SymInitialize

kernel32

InterlockedDecrement InterlockedIncrement lstrlenW EnterCriticalSection LeaveCriticalSection HeapAlloc GetProcessHeap FlushInstructionCache GetCurrentProcess InitializeCriticalSection DeleteCriticalSection GetCurrentThread CloseHandle HeapFree CreateDirectoryW GetTempPathW SetCurrentDirectoryW LoadLibraryA DebugBreak OutputDebugStringW lstrlenA IsBadCodePtr SetUnhandledExceptionFilter IsBadWritePtr GetCurrentProcessId lstrcpynW FormatMessageW IsBadReadPtr ReadProcessMemory CreateFileW OpenProcess MultiByteToWideChar WideCharToMultiByte GlobalUnlock GlobalLock WinExec RemoveDirectoryW DeleteFileW MoveFileExW WriteFile CreateFileA GetTempPathA GetTempFileNameW RaiseException FindFirstFileW FindNextFileW FindClose GlobalFree GlobalAlloc lstrcmpW MulDiv FreeLibrary lstrcatW GetVersion Sleep GetTickCount DisableThreadLibraryCalls SizeofResource LoadResource FindResourceW LoadLibraryExW lstrcmpiW ReadFile LCMapStringA SetFilePointer GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetTimeZoneInformation GetSystemInfo VirtualProtect UnhandledExceptionFilter HeapSize TerminateProcess VirtualAlloc VirtualFree HeapCreate HeapDestroy VirtualQuery TlsGetValue TlsSetValue TlsFree TlsAlloc ExitProcess GetCommandLineA GetSystemTimeAsFileTime GetFullPathNameW GetCurrentDirectoryW SetEnvironmentVariableW CreateThread ResumeThread ExitThread HeapReAlloc RtlUnwind GetVersionExA LocalFree LocalAlloc GetCurrentThreadId GetModuleHandleW GetModuleHandleA GetProcAddress GetModuleFileNameW LoadLibraryW OutputDebugStringA GetLastError SetLastError GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange GetVersionExW CompareStringA CompareStringW LCMapStringW GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW SetEnvironmentVariableA GetEnvironmentStringsW lstrcpyW SetEndOfFile GetOEMCP GetCPInfo GetStringTypeA GetStringTypeW SetStdHandle FlushFileBuffers GetDriveTypeA QueryPerformanceCounter

user32

CharLowerW EnableMenuItem CharUpperW PeekMessageW GetMessagePos DrawFrameControl LoadBitmapW GetCursorPos PostMessageW DrawTextW CopyRect GetMenu AdjustWindowRectEx KillTimer UpdateWindow LoadImageW IsWindowVisible SetWindowsHookExW TrackPopupMenu UnhookWindowsHookEx DrawStateW EndMenu GetMenuItemInfoW OffsetRect ClientToScreen GetAsyncKeyState SetWindowRgn DrawEdge GetDlgItem InvalidateRgn InvalidateRect SetCapture ReleaseCapture CreateAcceleratorTableW GetDC ReleaseDC RedrawWindow BeginPaint FillRect EndPaint IsChild DestroyAcceleratorTable RegisterWindowMessageW SystemParametersInfoW MapWindowPoints RegisterHotKey UnregisterHotKey GetDesktopWindow SetWindowPos DrawFocusRect GetWindow GetSystemMetrics DialogBoxIndirectParamW wsprintfA WindowFromPoint CallNextHookEx SetCursor ScreenToClient PtInRect GetKeyState GetClassNameW DestroyCursor SetDlgItemTextW IsDlgButtonChecked CheckDlgButton EndDialog SetFocus SetActiveWindow GetWindowTextLengthW GetWindowTextW GetWindowRect TranslateMessage DispatchMessageW CharUpperBuffW DialogBoxParamW GetActiveWindow SetLastErrorEx GetWindowLongW CallWindowProcW DefWindowProcW CharNextW wvsprintfW SetTimer LoadCursorFromFileW CharLowerBuffW OpenClipboard EmptyClipboard CloseClipboard MessageBoxW UnregisterClassW SetWindowLongW RegisterClassExW LoadCursorW wsprintfW GetClassInfoExW LoadStringW GetParent ShowWindow MoveWindow SetWindowTextW CreateWindowExW SendMessageW GetFocus IsWindow DestroyWindow DestroyMenu CreatePopupMenu AppendMenuW GetDlgCtrlID GetCapture IsWindowEnabled GetClientRect InflateRect GetSysColor

gdi32

SelectClipRgn SetBkColor CreatePatternBrush CreateRectRgnIndirect CreateBrushIndirect GetTextMetricsW CreateRectRgn SetBkMode ExtTextOutW SelectObject GetClipBox GetTextExtentPoint32W RestoreDC SaveDC SetTextColor GetTextExtentPointW GetStockObject GetObjectW GetDeviceCaps CreateSolidBrush CreateCompatibleBitmap CreateCompatibleDC BitBlt DeleteDC DeleteObject CreateFontW

shell32

DragQueryFileW SHAddToRecentDocs ShellExecuteW ShellExecuteA SHGetFolderPathW SHEmptyRecycleBinW

ole32

CLSIDFromString CLSIDFromProgID CoGetClassObject OleInitialize CreateStreamOnHGlobal StringFromGUID2 ReleaseStgMedium RegisterDragDrop CoCreateInstance CoInitialize CoUninitialize OleLockRunning CoTaskMemAlloc CoCreateGuid CoTaskMemFree CoTaskMemRealloc OleUninitialize

oleaut32

SysAllocString SysFreeString SysStringLen VarBstrCmp SysAllocStringByteLen VariantInit SysStringByteLen VariantClear SysAllocStringLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector DispCallFunc VariantCopy SafeArrayPutElement SafeArrayCreate VariantChangeType VarUI4FromStr RegisterTypeLi UnRegisterTypeLi VarBstrCat

Name

.text

Size

668KB

Virtual Size

666KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SHARED

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

02a6cc8b7802baacbc85ed66b2ac5e83_JaffaCakes118

wininet

shlwapi

winmm

dbghelp

kernel32

user32

gdi32

shell32

ole32

oleaut32

generic