22eaf0b9d4e96153dfe43dec57827e60_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
22eaf0b9d4e96153dfe43dec57827e60_JaffaCakes118
Size 473KB
Sample240703-s9dqvsxeqg
SHA256 43be1653b8aa71a319bb330aa479650b3c1f11510ce762eff9f30a189b7f221e
MD5 22eaf0b9d4e96153dfe43dec57827e60
SHA1 a85ac68b22d2a77fd660279bce7a44999a8cf367
SHA512 633b106ec517fbc78032f3ad782a536bb2d17ea38e07cfe9be2cfe25334803253c51367939e1464f3512b7065d853aca920c784a0db9aae3c06dd8f06fa13a9e
SSDEEP 6144:ReRTTiAH64Rl9ZB5US++nWIYQPneOT1msQhpCnCfueu5/xVqEZ/44721Ll:RCfs4Rl9Zv9WIne19a5QEZ/XI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22eaf0b9d4e96153dfe43dec57827e60_JaffaCakes118

File Explorer

22eaf0b9d4e96153dfe43dec57827e60_JaffaCakes118

.exe 473KB

22eaf0b9d4e96153dfe43dec57827e60_JaffaCakes118

IMPHASH 8c17841dd08a428cb7791a9050fe5d37
SHA256 43be1653b8aa71a319bb330aa479650b3c1f11510ce762eff9f30a189b7f221e
MD5 22eaf0b9d4e96153dfe43dec57827e60
SHA1 a85ac68b22d2a77fd660279bce7a44999a8cf367
SHA512 633b106ec517fbc78032f3ad782a536bb2d17ea38e07cfe9be2cfe25334803253c51367939e1464f3512b7065d853aca920c784a0db9aae3c06dd8f06fa13a9e
SSDEEP 6144:ReRTTiAH64Rl9ZB5US++nWIYQPneOT1msQhpCnCfueu5/xVqEZ/44721Ll:RCfs4Rl9Zv9WIne19a5QEZ/XI
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wmprph.pdb

advapi32

TraceMessage RegEnumValueW RegDeleteValueW RegOpenKeyExW UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel RegSetValueExW GetTraceEnableFlags RegEnumKeyExW GetTraceLoggerHandle RegCreateKeyExW RegQueryInfoKeyW RegCloseKey RegQueryValueExW

kernel32

SizeofResource VirtualProtect GetCommandLineW lstrcpynW VirtualAlloc GetModuleFileNameW InitializeCriticalSection WaitForSingleObject CreateEventW MultiByteToWideChar lstrcmpW SetEvent GlobalUnlock GetSystemInfo CreateThread FindResourceExW LoadResource HeapDestroy GetProcAddress DeleteCriticalSection FreeLibrary lstrcpyW lstrcmpiW VirtualQuery LoadLibraryExW GetModuleHandleW GlobalLock RaiseException DeleteFileW GlobalAlloc GetLastError GetCurrentThreadId LeaveCriticalSection EnterCriticalSection CloseHandle SetLastError GetVersionExW lstrlenA ExpandEnvironmentStringsW lstrlenW CompareStringW Sleep HeapFree VirtualFree GetCurrentProcess LoadLibraryExA EncodePointer HeapAlloc DecodePointer GetTickCount GetProcessHeap FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject GetDeviceCaps DeleteDC GetObjectW DeleteObject CreateSolidBrush BitBlt

user32

GetThreadDpiAwarenessContext DefWindowProcW GetWindowTextLengthW GetWindowLongW PostThreadMessageW CharNextW CharPrevW DispatchMessageW GetMessageW GetDC SetWindowPos SetWindowLongPtrW FillRect CreateWindowExW SendMessageW UnregisterClassW SetWindowTextW SetClassLongPtrW GetWindowLongPtrW PostMessageW ShowWindow IsWindow InvalidateRgn RedrawWindow IsChild SetThreadDpiAwarenessContext GetSysColor AreDpiAwarenessContextsEqual CreateAcceleratorTableW SetFocus LoadCursorW SetParent SetCapture GetWindowDpiAwarenessContext wsprintfW SetWindowLongW GetClientRect GetDlgItem GetDesktopWindow CallWindowProcW GetWindow GetFocus RegisterClassExW DestroyWindow GetClassInfoExW GetParent RegisterWindowMessageW ReleaseCapture InvalidateRect ReleaseDC BeginPaint EndPaint GetWindowTextW GetClassNameW

msvcrt

memcpy memcmp wcsrchr wcschr wcspbrk memcpy_s ?terminate@@YAXXZ _commode _fmode _wcmdln _initterm __setusermatherr _cexit _exit exit __set_app_type memset _amsg_exit _XcptFilter _callnewh malloc free wcscat_s wcscpy_s realloc __C_specific_handler __wgetmainargs _vsnwprintf

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

ole32

StringFromCLSID OleUninitialize CoTaskMemAlloc CoCreateInstance CLSIDFromProgID CoTaskMemFree CreateStreamOnHGlobal OleInitialize CLSIDFromString OleLockRunning CoInitialize CoUninitialize CoRegisterClassObject CoTaskMemRealloc CoRevokeClassObject

oleaut32

LoadTypeLi RegisterTypeLi VarUI4FromStr LoadRegTypeLi SysFreeString OleCreateFontIndirect SysAllocString SysStringLen SysAllocStringLen VariantClear

shell32

SHParseDisplayName SHCreateItemFromIDList ord155

Sharing

General

Malware Config

Signatures

File Explorer

22eaf0b9d4e96153dfe43dec57827e60_JaffaCakes118

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

ole32

oleaut32

shell32

generic