04de69c39e4ab507cdb6640e482e8442_JaffaCakes118

General

Target
04de69c39e4ab507cdb6640e482e8442_JaffaCakes118
Size 253KB
Sample240623-cn9cmswckb
SHA256 55285cb81e0cc074503ad5d8c0ad64646d383c9516122d1713df65a9abb7cd45
MD5 04de69c39e4ab507cdb6640e482e8442
SHA1 0399275a2bf1ff96545355f9698e3959f69443a5
SHA512 51b267a491cafd99c015a059f5a61d9cc6f2b4669d081f9d9214e3f56f5afba665cbb9cc8f45c6215f96ca6b29ef2c081cba7e7ac127f939c0d149e6e8be18d8
SSDEEP 6144:hWOjEO8DKAabFAJH+1IvHAgITwf+gTD3VW/+KQUJ:gOjELDK3C9+1QAq2gDTBUJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04de69c39e4ab507cdb6640e482e8442_JaffaCakes118

File Explorer

04de69c39e4ab507cdb6640e482e8442_JaffaCakes118

.exe 253KB

04de69c39e4ab507cdb6640e482e8442_JaffaCakes118

IMPHASH 88f4856de6fc6a2d552f7a8f8ce048ec
SHA256 55285cb81e0cc074503ad5d8c0ad64646d383c9516122d1713df65a9abb7cd45
MD5 04de69c39e4ab507cdb6640e482e8442
SHA1 0399275a2bf1ff96545355f9698e3959f69443a5
SHA512 51b267a491cafd99c015a059f5a61d9cc6f2b4669d081f9d9214e3f56f5afba665cbb9cc8f45c6215f96ca6b29ef2c081cba7e7ac127f939c0d149e6e8be18d8
SSDEEP 6144:hWOjEO8DKAabFAJH+1IvHAgITwf+gTD3VW/+KQUJ:gOjELDK3C9+1QAq2gDTBUJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\RedRhino\PurpleCat.pdb

ws2_32

connect recv

kernel32

VirtualFree lstrlenA GetProcAddress LoadLibraryA GetTickCount GetCommandLineA GetStartupInfoA IsDebuggerPresent RaiseException DebugBreak WideCharToMultiByte MultiByteToWideChar TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleW Sleep InterlockedIncrement InterlockedDecrement ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetLastError GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType DeleteCriticalSection HeapValidate IsBadReadPtr TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate HeapFree WriteFile HeapAlloc GetProcessHeap GetModuleFileNameW VirtualQuery FreeLibrary GetACP GetOEMCP GetCPInfo IsValidCodePage EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount HeapSize HeapReAlloc VirtualAlloc RtlUnwind OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP CreateFileA CloseHandle FlushFileBuffers

Sharing

General

Malware Config

Signatures

File Explorer

04de69c39e4ab507cdb6640e482e8442_JaffaCakes118

ws2_32

kernel32

generic