1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118
Size 64KB
Sample240628-qq43lasamf
SHA256 b34de63c516fbfbb1669d95527de8f0d1e0e970d1397c2d329f5dc7135f5bdd7
MD5 1a4c451fab318cee6c4f8e6027f6cdf7
SHA1 d1516af58a89fe8d59e136bb0801d5bc53ea4f88
SHA512 52dba9624aa43f8f47b0d2a5191efb1786fd7129bbf9aded70ba2c6bee66bcfc3bdf960f64f70b1bde43279986e3e758458061d02a600d3a9607c1cc047615c4
SSDEEP 1536:BfHt9IKlLgTETKVS/gl+KRBgeKfhnr0lO7:B2Q/SBg3fhn4l6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118

File Explorer

1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118

.dll 64KB

1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118

IMPHASH e63aabf2b8775c41f6585899c06d757a
SHA256 b34de63c516fbfbb1669d95527de8f0d1e0e970d1397c2d329f5dc7135f5bdd7
MD5 1a4c451fab318cee6c4f8e6027f6cdf7
SHA1 d1516af58a89fe8d59e136bb0801d5bc53ea4f88
SHA512 52dba9624aa43f8f47b0d2a5191efb1786fd7129bbf9aded70ba2c6bee66bcfc3bdf960f64f70b1bde43279986e3e758458061d02a600d3a9607c1cc047615c4
SSDEEP 1536:BfHt9IKlLgTETKVS/gl+KRBgeKfhnr0lO7:B2Q/SBg3fhn4l6
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39883

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_adjust_fdiv _initterm _onexit __dllonexit printf longjmp _setjmp3 _itoa free memmove _purecall strncmp atoi strncpy strcmp _strcmpi isdigit _strdup sscanf ??2@YAPAXI@Z ??3@YAXPAX@Z _strlwr memset memcpy memcmp strchr strncat __CxxFrameHandler strstr sprintf strlen malloc strcpy strcat ??1type_info@@UAE@XZ _CxxThrowException strspn strcspn tolower isxdigit isupper isspace ispunct isprint islower isgraph iscntrl isalpha isalnum

advapi32

CryptAcquireContextA CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext CryptDestroyKey CryptDecrypt CryptEncrypt CryptImportKey CryptGetUserKey CryptDeriveKey CryptGenKey

kernel32

GetComputerNameA UnmapViewOfFile lstrcpynA CreateFileMappingA MapViewOfFile lstrcmpiA GetWindowsDirectoryA CreateFileA GetFileSize ReadFile SetFilePointer CreateMutexA WaitForSingleObject ReleaseMutex FlushViewOfFile Sleep GetCurrentProcess VirtualProtect FlushInstructionCache LocalFree GetVersionExA GetVolumeInformationA FreeLibrary VirtualQuery SetLastError LeaveCriticalSection EnterCriticalSection GetLastError GetTickCount TlsSetValue TlsGetValue lstrlenA GetCurrentProcessId TlsAlloc GetProcAddress LoadLibraryA TlsFree GetModuleHandleA GetModuleFileNameA CreateThread CreateEventA InitializeCriticalSection DeleteCriticalSection CloseHandle TerminateThread WaitForMultipleObjects SetEvent lstrcpyA SetEndOfFile WriteFile MultiByteToWideChar

user32

CallNextHookEx EnumWindows UpdateWindow BringWindowToTop SetForegroundWindow CharLowerA FindWindowA SendMessageA UnhookWindowsHookEx SetWindowsHookExA SetWindowTextA

ws2_32

send recv closesocket WSARecv connect WSAGetLastError ntohs getpeername WSASend inet_ntoa

ole32

CoCreateInstance OleUninitialize OleInitialize

wininet

HttpOpenRequestA InternetCloseHandle HttpSendRequestA InternetOpenUrlA InternetConnectA HttpQueryInfoA HttpAddRequestHeadersA InternetQueryOptionA InternetOpenA InternetReadFile

oleaut32

VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118

msvcrt

advapi32

kernel32

user32

ws2_32

ole32

wininet

oleaut32

generic