179e2dd526cc74811563f13740741997_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
179e2dd526cc74811563f13740741997_JaffaCakes118
Size 7.3MB
Sample240627-1f1brsscpd
SHA256 13853b959dbcac59a697e77a61f2399cf406a93d2e265e79c585adec3f1770c0
MD5 179e2dd526cc74811563f13740741997
SHA1 b66ac897afb776af8f8a0fb5c873f0e6bf33988d
SHA512 bb9ffe73baa6bdb1ab86addb35e12f231ee2057f357b1cafac02a46e9939e357da84e47d8a28cc658fa45981befe6fe011a14ad66390f4ffd38702c2db481314
SSDEEP 98304:qxC3ud6MOIvysi7CQKzo5qphIHVruP3WpF3UdE1hZHEdLF00Q:9GQgMkhgJuP32+dmhZk/0j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
179e2dd526cc74811563f13740741997_JaffaCakes118

File Explorer

179e2dd526cc74811563f13740741997_JaffaCakes118

.exe 7.3MB

179e2dd526cc74811563f13740741997_JaffaCakes118

IMPHASH 7919c2f06f2b8d1d63b9af30c10fcfcc
SHA256 13853b959dbcac59a697e77a61f2399cf406a93d2e265e79c585adec3f1770c0
MD5 179e2dd526cc74811563f13740741997
SHA1 b66ac897afb776af8f8a0fb5c873f0e6bf33988d
SHA512 bb9ffe73baa6bdb1ab86addb35e12f231ee2057f357b1cafac02a46e9939e357da84e47d8a28cc658fa45981befe6fe011a14ad66390f4ffd38702c2db481314
SSDEEP 98304:qxC3ud6MOIvysi7CQKzo5qphIHVruP3WpF3UdE1hZHEdLF00Q:9GQgMkhgJuP32+dmhZk/0j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

952704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\B\T\BuildResults\bin\Release\AcroCEF\RdrCEF.pdb

kernel32

DuplicateHandle GetFileType SetHandleInformation RegisterWaitForSingleObject UnregisterWaitEx AssignProcessToJobObject WriteProcessMemory CreateFileMappingW MapViewOfFile VirtualFree GetProcessHandleCount GetProcessHeaps SignalObjectAndWait GetFileAttributesW QueryDosDeviceW GetLongPathNameW CreateFileW VirtualProtectEx ReadProcessMemory GetCurrentDirectoryW GetModuleFileNameW GetLocalTime OutputDebugStringA WriteFile FormatMessageA LoadLibraryExW LoadLibraryW FreeLibrary ReleaseSRWLockExclusive VirtualFreeEx CreateNamedPipeW CreateProcessW CreateRemoteThread CreateJobObjectW UnmapViewOfFile FindResourceW SizeofResource LoadResource LockResource CreateDirectoryW ReadFile TlsGetValue TryAcquireSRWLockExclusive AcquireSRWLockExclusive GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter QueryThreadCycleTime VirtualAlloc SetThreadPriority SearchPathW lstrlenW DebugBreak GetModuleHandleExW SetFilePointerEx GetFileSizeEx SetEndOfFile FlushFileBuffers FindClose FindNextFileW FindFirstFileExW SetUnhandledExceptionFilter RtlCaptureStackBackTrace TlsAlloc TlsFree TlsSetValue VirtualQuery WideCharToMultiByte K32QueryWorkingSetEx SwitchToThread QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation CreateTimerQueue FreeLibraryAndExitThread ExitThread GetExitCodeThread AreFileApisANSI GetWindowsDirectoryW DeviceIoControl GetEnvironmentVariableW TryEnterCriticalSection CreateEventA GetThreadId RaiseException IsDebuggerPresent Sleep ProcessIdToSessionId GetCurrentProcessId LocalFree GetNativeSystemInfo GetVersionExW GetTickCount EnumSystemLocalesEx GetUserDefaultLocaleName GetUserDefaultLCID GetUserDefaultLangID TerminateProcess GetCurrentThreadId SetInformationJobObject DeleteCriticalSection WaitForSingleObject PostQueuedCompletionStatus SetEvent TerminateJobObject LeaveCriticalSection EnterCriticalSection GetQueuedCompletionStatus ResetEvent SetLastError CreateThread CreateEventW CreateIoCompletionPort InitializeCriticalSection VirtualAllocEx VirtualQueryEx GetCurrentThread GetModuleHandleA HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy HeapCreate GetSystemInfo VerifyVersionInfoW SetDllDirectoryW GetProcAddress GetModuleHandleW GetCurrentProcess CreateMutexW ReleaseMutex HeapSetInformation GetProcessHeap GetLastError CloseHandle GetCommandLineW GetThreadPriority CancelIoEx DisconnectNamedPipe ConnectNamedPipe CancelSynchronousIo GetProcessTimes VerSetConditionMask SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage OutputDebugStringW GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW IsValidLocale GetTimeFormatW VirtualProtect LoadLibraryExA InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared FormatMessageW LocalAlloc TerminateThread CreateFileMappingA MapViewOfFileEx OpenFileMappingA ExitProcess MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetConsoleCP GetConsoleMode SetStdHandle GetStdHandle WriteConsoleW GetDateFormatW

user32

CloseDesktop CloseWindowStation GetSystemMetrics GetProcessWindowStation CreateWindowStationW GetThreadDesktop SetProcessWindowStation GetUserObjectInformationW CreateDesktopW

advapi32

GetUserNameW EventWrite EventUnregister EventRegister GetSidSubAuthorityCount SetEntriesInAclW GetSecurityInfo GetSidSubAuthority InitializeSid CreateWellKnownSid CopySid LookupPrivilegeValueW DuplicateToken CreateRestrictedToken RegQueryValueExW RegCreateKeyExW SetThreadToken GetTokenInformation CreateProcessAsUserW AccessCheck EqualSid IsValidSid GetNamedSecurityInfoW MapGenericMask ImpersonateLoggedOnUser FreeSid SystemFunction036 ConvertSidToStringSidW DuplicateTokenEx GetKernelObjectSecurity SetKernelObjectSecurity GetAce OpenProcessToken SetTokenInformation GetLengthSid ConvertStringSidToSidW SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW RegDisablePredefinedCache RevertToSelf SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegOpenKeyExA RegCloseKey RegOpenKeyA

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemFree

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

500KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

179e2dd526cc74811563f13740741997_JaffaCakes118

kernel32

user32

advapi32

shell32

ole32

generic