17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118

General

Target
17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118
Size 6.7MB
Sample240627-22cchazamn
SHA256 95053ff336290f30f1b26b974cbc567711c1d647e96fbb989e62b6230b9481d8
MD5 17ddf2ebc8a2c90039757eb88a160e48
SHA1 08ae89e1428e569042a284b52aafaab16e116c43
SHA512 d4be93e43dd02e179e09399add919f623d5aeda6e89556741828ee3e892f9e45eb668551dceae8285bdf3517b86eb2c8c0cc2da7798955a7e60d361df830deb4
SSDEEP 196608:x+TwuskzQ5IAFMhZF2JW7V1796MS6XJq9mJE2pVK++U/z:xAwusJ5IAFof2UXQ6XsmNpT1/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118

File Explorer

17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118

.exe 6.7MB

17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118

IMPHASH 1a049f8dbd948bf35b061a8ea4a0fc62
SHA256 95053ff336290f30f1b26b974cbc567711c1d647e96fbb989e62b6230b9481d8
MD5 17ddf2ebc8a2c90039757eb88a160e48
SHA1 08ae89e1428e569042a284b52aafaab16e116c43
SHA512 d4be93e43dd02e179e09399add919f623d5aeda6e89556741828ee3e892f9e45eb668551dceae8285bdf3517b86eb2c8c0cc2da7798955a7e60d361df830deb4
SSDEEP 196608:x+TwuskzQ5IAFMhZF2JW7V1796MS6XJq9mJE2pVK++U/z:xAwusJ5IAFof2UXQ6XsmNpT1/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW LoadLibraryW SizeofResource GetModuleFileNameW CreateFileW lstrcatA GetProcAddress MoveFileW LockResource CloseHandle GetWindowsDirectoryW DeleteFileW LocalFree lstrcpyW lstrcpyA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc RaiseException Sleep ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError WriteFile InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW GetModuleHandleW CreateDirectoryW LoadResource FreeLibrary GetCurrentThreadId FindResourceW

user32

SendMessageW FindWindowW

shlwapi

StrCpyW PathFileExistsW PathRemoveFileSpecW PathAppendW

advapi32

AllocateAndInitializeSid SetSecurityInfo SetEntriesInAclW FreeSid GetSecurityInfo

Sharing

General

Malware Config

Signatures

File Explorer

17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118

kernel32

user32

shlwapi

advapi32

generic