1c9dde2d9c030c516c39a47fd4830f6e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
1c9dde2d9c030c516c39a47fd4830f6e_JaffaCakes118
Size 7.3MB
Sample240701-1qllcs1hrf
SHA256 d95ecb9839e216d8ba69c5aaf9a78d5cd5954f4d9cd6ff67d02491b8e1096e44
MD5 1c9dde2d9c030c516c39a47fd4830f6e
SHA1 1d49b69f0aa79fc59ddfe5b4810e1ae3953a02d1
SHA512 989263c8ec1ad6c583e767cfed66955f69277a313d8d43a745b698ebafdac22e7a599e70b12b70e5e2f27587f7d42458a3107d532b1963bff9d235b63066b26d
SSDEEP 98304:dxC3ud6MOIvysi7CQKzo5qphIHVruP3WpF3UdE1hZHEdLF00l:SGQgMkhgJuP32+dmhZk/0W
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c9dde2d9c030c516c39a47fd4830f6e_JaffaCakes118

File Explorer

1c9dde2d9c030c516c39a47fd4830f6e_JaffaCakes118

.exe 7.3MB

1c9dde2d9c030c516c39a47fd4830f6e_JaffaCakes118

IMPHASH 7919c2f06f2b8d1d63b9af30c10fcfcc
SHA256 d95ecb9839e216d8ba69c5aaf9a78d5cd5954f4d9cd6ff67d02491b8e1096e44
MD5 1c9dde2d9c030c516c39a47fd4830f6e
SHA1 1d49b69f0aa79fc59ddfe5b4810e1ae3953a02d1
SHA512 989263c8ec1ad6c583e767cfed66955f69277a313d8d43a745b698ebafdac22e7a599e70b12b70e5e2f27587f7d42458a3107d532b1963bff9d235b63066b26d
SSDEEP 98304:dxC3ud6MOIvysi7CQKzo5qphIHVruP3WpF3UdE1hZHEdLF00l:SGQgMkhgJuP32+dmhZk/0W
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

952704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\B\T\BuildResults\bin\Release\AcroCEF\RdrCEF.pdb

kernel32

DuplicateHandle GetFileType SetHandleInformation RegisterWaitForSingleObject UnregisterWaitEx AssignProcessToJobObject WriteProcessMemory CreateFileMappingW MapViewOfFile VirtualFree GetProcessHandleCount GetProcessHeaps SignalObjectAndWait GetFileAttributesW QueryDosDeviceW GetLongPathNameW CreateFileW VirtualProtectEx ReadProcessMemory GetCurrentDirectoryW GetModuleFileNameW GetLocalTime OutputDebugStringA WriteFile FormatMessageA LoadLibraryExW LoadLibraryW FreeLibrary ReleaseSRWLockExclusive VirtualFreeEx CreateNamedPipeW CreateProcessW CreateRemoteThread CreateJobObjectW UnmapViewOfFile FindResourceW SizeofResource LoadResource LockResource CreateDirectoryW ReadFile TlsGetValue TryAcquireSRWLockExclusive AcquireSRWLockExclusive GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter QueryThreadCycleTime VirtualAlloc SetThreadPriority SearchPathW lstrlenW DebugBreak GetModuleHandleExW SetFilePointerEx GetFileSizeEx SetEndOfFile FlushFileBuffers FindClose FindNextFileW FindFirstFileExW SetUnhandledExceptionFilter RtlCaptureStackBackTrace TlsAlloc TlsFree TlsSetValue VirtualQuery WideCharToMultiByte K32QueryWorkingSetEx SwitchToThread QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation CreateTimerQueue FreeLibraryAndExitThread ExitThread GetExitCodeThread AreFileApisANSI GetWindowsDirectoryW DeviceIoControl GetEnvironmentVariableW TryEnterCriticalSection CreateEventA GetThreadId RaiseException IsDebuggerPresent Sleep ProcessIdToSessionId GetCurrentProcessId LocalFree GetNativeSystemInfo GetVersionExW GetTickCount EnumSystemLocalesEx GetUserDefaultLocaleName GetUserDefaultLCID GetUserDefaultLangID TerminateProcess GetCurrentThreadId SetInformationJobObject DeleteCriticalSection WaitForSingleObject PostQueuedCompletionStatus SetEvent TerminateJobObject LeaveCriticalSection EnterCriticalSection GetQueuedCompletionStatus ResetEvent SetLastError CreateThread CreateEventW CreateIoCompletionPort InitializeCriticalSection VirtualAllocEx VirtualQueryEx GetCurrentThread GetModuleHandleA HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy HeapCreate GetSystemInfo VerifyVersionInfoW SetDllDirectoryW GetProcAddress GetModuleHandleW GetCurrentProcess CreateMutexW ReleaseMutex HeapSetInformation GetProcessHeap GetLastError CloseHandle GetCommandLineW GetThreadPriority CancelIoEx DisconnectNamedPipe ConnectNamedPipe CancelSynchronousIo GetProcessTimes VerSetConditionMask SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage OutputDebugStringW GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW IsValidLocale GetTimeFormatW VirtualProtect LoadLibraryExA InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared FormatMessageW LocalAlloc TerminateThread CreateFileMappingA MapViewOfFileEx OpenFileMappingA ExitProcess MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetConsoleCP GetConsoleMode SetStdHandle GetStdHandle WriteConsoleW GetDateFormatW

user32

CloseDesktop CloseWindowStation GetSystemMetrics GetProcessWindowStation CreateWindowStationW GetThreadDesktop SetProcessWindowStation GetUserObjectInformationW CreateDesktopW

advapi32

GetUserNameW EventWrite EventUnregister EventRegister GetSidSubAuthorityCount SetEntriesInAclW GetSecurityInfo GetSidSubAuthority InitializeSid CreateWellKnownSid CopySid LookupPrivilegeValueW DuplicateToken CreateRestrictedToken RegQueryValueExW RegCreateKeyExW SetThreadToken GetTokenInformation CreateProcessAsUserW AccessCheck EqualSid IsValidSid GetNamedSecurityInfoW MapGenericMask ImpersonateLoggedOnUser FreeSid SystemFunction036 ConvertSidToStringSidW DuplicateTokenEx GetKernelObjectSecurity SetKernelObjectSecurity GetAce OpenProcessToken SetTokenInformation GetLengthSid ConvertStringSidToSidW SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW RegDisablePredefinedCache RevertToSelf SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegOpenKeyExA RegCloseKey RegOpenKeyA

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemFree

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

500KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1c9dde2d9c030c516c39a47fd4830f6e_JaffaCakes118

kernel32

user32

advapi32

shell32

ole32

generic