109501687d7ed43ba97699f19ce50b45_JaffaCakes118

General

Target
109501687d7ed43ba97699f19ce50b45_JaffaCakes118
Size 253KB
Sample240626-d3tfeasdmb
SHA256 bcfeda6d22c47c5c1ff37c1abbf3145f94e056d3ac4250e944b82dd0f77b9998
MD5 109501687d7ed43ba97699f19ce50b45
SHA1 ce37ee22b572103692755a4a20c2510bddb879c7
SHA512 f22ca2f35f525b1a62dd0a503d0c8870e549c46c3bb92bcdb946c14bd30b90093b81beaa6442d724aac926ed2720841e8cf934d650ac71a81eca8570240e83a8
SSDEEP 3072:7E/i83OM3Ao9D5448xUIWNwRAoQtf03lwW3QPm7BiK4aQdbJ4rrGHkhzgCvbwZcW:ZQFTDIWObl0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
109501687d7ed43ba97699f19ce50b45_JaffaCakes118

File Explorer

109501687d7ed43ba97699f19ce50b45_JaffaCakes118

.exe 253KB

109501687d7ed43ba97699f19ce50b45_JaffaCakes118

IMPHASH abf20edd12be51172087e34b78264efa
SHA256 bcfeda6d22c47c5c1ff37c1abbf3145f94e056d3ac4250e944b82dd0f77b9998
MD5 109501687d7ed43ba97699f19ce50b45
SHA1 ce37ee22b572103692755a4a20c2510bddb879c7
SHA512 f22ca2f35f525b1a62dd0a503d0c8870e549c46c3bb92bcdb946c14bd30b90093b81beaa6442d724aac926ed2720841e8cf934d650ac71a81eca8570240e83a8
SSDEEP 3072:7E/i83OM3Ao9D5448xUIWNwRAoQtf03lwW3QPm7BiK4aQdbJ4rrGHkhzgCvbwZcW:ZQFTDIWObl0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

225280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Dokumente und Einstellungen\Jonas\Desktop\Programmierung\wr-injector\Release\wr-injector.pdb

kernel32

Process32First WaitForSingleObject CreateRemoteThread OpenProcess Sleep FindFirstFileA GetProcAddress VirtualAllocEx Process32Next GetExitCodeThread GetModuleFileNameA GetModuleHandleA CreateToolhelp32Snapshot CloseHandle WriteProcessMemory CreateThread FlushFileBuffers CreateFileA GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId GetLastError ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW LeaveCriticalSection EnterCriticalSection GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSectionAndSpinCount HeapAlloc VirtualAlloc HeapReAlloc RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize

user32

EndDialog DialogBoxParamA SetDlgItemTextA MessageBoxA

Name

.text

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

56KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

109501687d7ed43ba97699f19ce50b45_JaffaCakes118

kernel32

user32

generic