11f5479e24f1f79d0399f02b8477be37_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
11f5479e24f1f79d0399f02b8477be37_JaffaCakes118
Size 208KB
Sample240626-pm2mmavamb
SHA256 f36d83b7056bb2b0a3b33c9f35439514e71e3613d54723975633ddc158b5f2ab
MD5 11f5479e24f1f79d0399f02b8477be37
SHA1 f3ea33a22790744e1f7760e5c36b526ad804c1d9
SHA512 5f9358f202404ce1dfe5370f0493cc803e3e194c71f1381c2db02333f2315bb25beb876e7d1c0ce2fb5ca62745a28f100482e283a3402c81c6983eb0e02b0d50
SSDEEP 3072:z15ADXZM0k9yyDgbJ3A78qfI5dAuSphdyQ3mMdol0dPPQwkGLq:Z5ADX60xysbM80ndy4tRPHkGLq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11f5479e24f1f79d0399f02b8477be37_JaffaCakes118

File Explorer

11f5479e24f1f79d0399f02b8477be37_JaffaCakes118

.exe 208KB

11f5479e24f1f79d0399f02b8477be37_JaffaCakes118

IMPHASH 4e70dc9979c7f6c85973ea16a6af2a46
SHA256 f36d83b7056bb2b0a3b33c9f35439514e71e3613d54723975633ddc158b5f2ab
MD5 11f5479e24f1f79d0399f02b8477be37
SHA1 f3ea33a22790744e1f7760e5c36b526ad804c1d9
SHA512 5f9358f202404ce1dfe5370f0493cc803e3e194c71f1381c2db02333f2315bb25beb876e7d1c0ce2fb5ca62745a28f100482e283a3402c81c6983eb0e02b0d50
SSDEEP 3072:z15ADXZM0k9yyDgbJ3A78qfI5dAuSphdyQ3mMdol0dPPQwkGLq:Z5ADX60xysbM80ndy4tRPHkGLq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49043

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\test\RTInstaller\release\RTInstaller32.pdb

setupapi

CM_Disconnect_Machine SetupFindFirstLineW CM_Connect_MachineW SetupRemoveFromSourceListW SetupFindNextLine SetupDiSetClassInstallParamsW SetupDiGetClassDevsW SetupDiOpenDevRegKey CM_Reenumerate_DevNode_Ex SetupCopyOEMInfW SetupGetStringFieldW SetupUninstallOEMInfW CM_Locate_DevNode_ExW SetupDiDeleteDevRegKey SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupGetInfFileListW SetupAddToSourceListW SetupCloseInfFile CM_Get_DevNode_Status SetupDiClassGuidsFromNameW SetupDiCallClassInstaller SetupOpenInfFileW

newdev

UpdateDriverForPlugAndPlayDevicesW

kernel32

GetStringTypeW GetStringTypeA SetEnvironmentVariableW SetEnvironmentVariableA CompareStringW CompareStringA LoadLibraryA InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter FindFirstFileW CreateProcessW WaitForSingleObject Sleep GetVersionExW GetModuleFileNameW lstrlenW GetLastError GetCurrentDirectoryW SetLastError LocalAlloc CloseHandle GetWindowsDirectoryW DeleteFileW LocalFree SetFileAttributesW ExitProcess GetTickCount OpenProcess CopyFileW CreateFileW GetTempPathW GetCurrentProcessId GetStartupInfoA GetFileType GetLocaleInfoA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer SetEndOfFile ReadFile HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW GetExitCodeProcess HeapAlloc HeapFree CreateFileA GetVersionExA GetProcessHeap GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc HeapReAlloc GetProcAddress GetModuleHandleA WriteFile GetStdHandle GetModuleFileNameA MultiByteToWideChar FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId LCMapStringA WideCharToMultiByte LCMapStringW GetCommandLineA GetCommandLineW SetHandleCount

user32

MessageBoxW

advapi32

RegSetValueExW RegCloseKey QueryServiceConfigW CryptDestroyHash RegEnumKeyExW RegOpenKeyExW CryptCreateHash RegDeleteValueW RegDeleteKeyW RegQueryValueExW CryptReleaseContext RegCreateKeyExW OpenServiceW OpenSCManagerW CryptAcquireContextW CloseServiceHandle CryptGetHashParam CryptHashData

Sharing

General

Malware Config

Signatures

File Explorer

11f5479e24f1f79d0399f02b8477be37_JaffaCakes118

setupapi

newdev

kernel32

user32

advapi32

generic