1161b337db7062d676d3305932c4e35f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
1161b337db7062d676d3305932c4e35f_JaffaCakes118
Size 246KB
Sample240626-kjb6caware
SHA256 2c71e9bfb8eb418aab8698a5b1333f397cafe98c06834b4cbcda0967125db971
MD5 1161b337db7062d676d3305932c4e35f
SHA1 76ac100a42d7f1175f0ca4ca2f6accb34b15f8cb
SHA512 f30ef318643122f691a42f4655ea7d925e0ea4fc66dfe0a19672cda8a7f45b45ce0fd4f3b818a538cdc68c9f3ea4edbd3dd2694e45bcb8cf5ce5165a03f38626
SSDEEP 6144:fkbHTBIubE30ZhZxbpvqwowowowowowowowowowowowowowowowowowowowowow3:fkfBIuhZj5pTbE5PnMz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1161b337db7062d676d3305932c4e35f_JaffaCakes118

File Explorer

1161b337db7062d676d3305932c4e35f_JaffaCakes118

.exe 246KB

1161b337db7062d676d3305932c4e35f_JaffaCakes118

IMPHASH 4a6aa184f74d3c1d08c3452152cc0d08
SHA256 2c71e9bfb8eb418aab8698a5b1333f397cafe98c06834b4cbcda0967125db971
MD5 1161b337db7062d676d3305932c4e35f
SHA1 76ac100a42d7f1175f0ca4ca2f6accb34b15f8cb
SHA512 f30ef318643122f691a42f4655ea7d925e0ea4fc66dfe0a19672cda8a7f45b45ce0fd4f3b818a538cdc68c9f3ea4edbd3dd2694e45bcb8cf5ce5165a03f38626
SSDEEP 6144:fkbHTBIubE30ZhZxbpvqwowowowowowowowowowowowowowowowowowowowowow3:fkfBIuhZj5pTbE5PnMz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\pulse\recipes\283718449\base\branches\ci_release_branch\googleclient\ci\build\ship\obj\service\GoogleUpdaterService_not_signed_exe.pdb

kernel32

GetStdHandle GetModuleFileNameA GetCPInfo GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA SystemTimeToTzSpecificLocalTime lstrcmpW DuplicateHandle GetProcAddress GetCurrentThread MultiByteToWideChar GetTempPathW WaitForSingleObject SetLastError OpenProcess InitializeCriticalSection lstrcpynW CloseHandle lstrlenW CreateThread lstrcmpiW FindResourceExW CreateEventW LoadResource FindResourceW LoadLibraryExW LockResource InterlockedIncrement SizeofResource SetEvent GetLastError InterlockedDecrement GetCurrentThreadId GetModuleHandleW DeleteCriticalSection VirtualFree HeapCreate RtlUnwind GetModuleHandleA VirtualAlloc LoadLibraryA GetStartupInfoW SetUnhandledExceptionFilter RaiseException GetModuleFileNameW FreeLibrary GetCommandLineW GetCurrentProcessId Sleep GetTempFileNameW UnhandledExceptionFilter GetLocaleInfoA GetACP InterlockedExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA QueryPerformanceFrequency QueryPerformanceCounter ResetEvent CreateFileW GetFileAttributesExW FindFirstFileW FindNextFileW GetFileAttributesW SetFileAttributesW DeleteFileW CopyFileW MoveFileExW GetTickCount FlushFileBuffers SetFilePointer ReadFile WriteFile GetFileSize GetSystemTimeAsFileTime FindClose FileTimeToSystemTime CreateProcessW GetCurrentProcess ReleaseMutex EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange CreateMutexW RemoveDirectoryW GetExitCodeProcess FileTimeToLocalFileTime GetVersionExW WideCharToMultiByte GetThreadLocale GetDateFormatW GetTimeFormatW IsDebuggerPresent ExitProcess TerminateProcess

user32

UnregisterClassA CharLowerW CharNextW LoadStringW DispatchMessageW TranslateMessage GetMessageW PostThreadMessageW KillTimer wvsprintfW SetTimer

ole32

CoRevertToSelf CoCreateGuid StringFromGUID2 CoCreateInstance CoTaskMemRealloc CoUninitialize CoRegisterClassObject CoInitializeSecurity CoInitialize CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree CoImpersonateClient

oleaut32

SysFreeString RegisterTypeLi SysStringLen VarUI4FromStr SysAllocString LoadTypeLi UnRegisterTypeLi

advapi32

GetSecurityDescriptorControl GetSecurityDescriptorLength GetSidSubAuthority RegCloseKey RegDeleteKeyW MakeSelfRelativeSD InitializeSid FreeSid AllocateAndInitializeSid CheckTokenMembership OpenThreadToken ControlService SetSecurityDescriptorDacl StartServiceW GetSecurityDescriptorDacl QueryServiceStatus SetSecurityDescriptorGroup RegSetValueExW GetSecurityDescriptorGroup ChangeServiceConfigW RegCreateKeyExW SetSecurityDescriptorOwner OpenServiceW GetSecurityDescriptorOwner DeleteService OpenSCManagerW ChangeServiceConfig2W CreateServiceW IsValidSid RegQueryInfoKeyW SetServiceStatus GetLengthSid DeregisterEventSource ReportEventW RegisterEventSourceW RegisterServiceCtrlHandlerW RegEnumKeyExW GetAclInformation AddAce StartServiceCtrlDispatcherW InitializeAcl InitializeSecurityDescriptor MakeAbsoluteSD SetSecurityDescriptorControl RegOpenKeyExW CopySid CloseServiceHandle GetSidLengthRequired GetSecurityDescriptorSacl RegQueryValueExW RegDeleteValueW

shlwapi

StrRetToStrW SHQueryValueExW PathStripPathW

crypt32

CryptQueryObject CertEnumCertificatesInStore CertCloseStore CertDuplicateCertificateContext CertFreeCertificateContext CertNameToStrW

shell32

SHGetDesktopFolder SHCreateDirectoryExW SHGetFolderLocation SHFileOperationW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

1161b337db7062d676d3305932c4e35f_JaffaCakes118

kernel32

user32

ole32

oleaut32

advapi32

shlwapi

crypt32

shell32

version

wintrust

generic