2ecf7ec7ce175ab2296e6eaaac36fb73_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
2ecf7ec7ce175ab2296e6eaaac36fb73_JaffaCakes118
Size 234KB
Sample240709-dtc23atdkm
SHA256 daf7e350d270cbbaa0346a460106c73ab9a6d9fc589677e9ff1c1d29f5ff12eb
MD5 2ecf7ec7ce175ab2296e6eaaac36fb73
SHA1 9585ec38c96e056bca02cdc2b6b89ca7db7b85c4
SHA512 e18a2257be47fe7f97f94a1f2d1638dfd2fe18594ba8612fd90945d016726a4d025c094b0da493541c49ca6567de7a2dc1190aec1a557371946204f6d20c4b98
SSDEEP 6144:RL3Si2xLwgxYv/srWpAVs5uPD6h9FPjcsel:+xLVMsCpn5K6hvLY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ecf7ec7ce175ab2296e6eaaac36fb73_JaffaCakes118

File Explorer

2ecf7ec7ce175ab2296e6eaaac36fb73_JaffaCakes118

.exe 234KB

2ecf7ec7ce175ab2296e6eaaac36fb73_JaffaCakes118

IMPHASH 059c8b5c9fcbb1ab63e14cae9688b3fb
SHA256 daf7e350d270cbbaa0346a460106c73ab9a6d9fc589677e9ff1c1d29f5ff12eb
MD5 2ecf7ec7ce175ab2296e6eaaac36fb73
SHA1 9585ec38c96e056bca02cdc2b6b89ca7db7b85c4
SHA512 e18a2257be47fe7f97f94a1f2d1638dfd2fe18594ba8612fd90945d016726a4d025c094b0da493541c49ca6567de7a2dc1190aec1a557371946204f6d20c4b98
SSDEEP 6144:RL3Si2xLwgxYv/srWpAVs5uPD6h9FPjcsel:+xLVMsCpn5K6hvLY
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

245009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_AGGRESIVE_WS_TRIM IMAGE_FILE_32BIT_MACHINE

PDB paths

dmadmin.pdb

msvcrt

malloc free wcscmp wcsncmp __CxxFrameHandler ??2@YAPAXI@Z sprintf strstr swprintf wcscat ??3@YAXPAX@Z exit wcsstr wcslen wcscpy mbstowcs _wcsupr memmove wcsrchr towupper wcsncpy fclose fflush mbtowc __mb_cur_max fopen wcschr _c_exit _exit _XcptFilter _cexit __initenv __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 __dllonexit _onexit _controlfp

advapi32

RegDeleteKeyA RegOpenKeyExA RegOpenKeyW InitiateSystemShutdownW RegCreateKeyExW RegSetValueExW RegUnLoadKeyW RegLoadKeyW RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW DeregisterEventSource RegOpenKeyA RegQueryValueExA RegCloseKey RegisterServiceCtrlHandlerW LookupPrivilegeValueW PrivilegeCheck AllocateAndInitializeSid FreeSid CheckTokenMembership OpenThreadToken OpenProcessToken SetServiceStatus StartServiceCtrlDispatcherW RegDeleteKeyW

kernel32

FindClose GetFileAttributesW lstrlenA InterlockedIncrement ExitThread GetProcAddress FreeLibrary TerminateThread DeleteVolumeMountPointW SetVolumeMountPointW FindFirstVolumeW FindNextVolumeW FindVolumeClose LoadLibraryW ResumeThread CreateFileA LocalAlloc GetComputerNameW IsBadCodePtr FindFirstFileW lstrcpyA IsBadWritePtr GetSystemDirectoryW GetComputerNameExW WideCharToMultiByte MultiByteToWideChar LoadLibraryA SetEndOfFile SetFilePointerEx QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleA CompareStringW GetCurrentThreadId InterlockedDecrement SetLastError HeapAlloc GetProcessHeap HeapFree QueryDosDeviceW DeviceIoControl CloseHandle CreateFileW DefineDosDeviceW GetDriveTypeW Sleep LocalFree GetLastError lstrcmpiA SetEvent lstrcmpW lstrlenW FormatMessageW GetModuleHandleW CreateEventW WaitForSingleObject LeaveCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentThread CreateThread SetErrorMode InitializeCriticalSection DeleteCriticalSection IsBadStringPtrW IsBadReadPtr lstrcpyW GetVolumeNameForVolumeMountPointW GetVolumePathNameW lstrcatW GetVolumePathNamesForVolumeNameW

user32

PostThreadMessageW GetMessageW TranslateMessage DispatchMessageW LoadIconW LoadCursorW RegisterClassW CreateWindowExW ShowWindow DefWindowProcW BroadcastSystemMessageW PostMessageW DestroyWindow wsprintfW LoadStringW PostQuitMessage

ntdll

NtFlushBuffersFile NtDeviceIoControlFile NtQueryVolumeInformationFile NtQuerySystemTime RtlAdjustPrivilege RtlExtendedLargeIntegerDivide NtQuerySystemInformation RtlFreeUnicodeString NtOpenFile RtlCreateUnicodeString NtFsControlFile NtWriteFile NtReadFile NtDeleteBootEntry NtTranslateFilePath NtEnumerateBootEntries NtModifyBootEntry NtQuerySymbolicLinkObject RtlExtendedIntegerMultiply RtlInitUnicodeString NtOpenSymbolicLinkObject NtClose

ole32

CoSuspendClassObjects CoRevertToSelf CoImpersonateClient CoTaskMemAlloc CoSetProxyBlanket CoTaskMemRealloc CoTaskMemFree CoUninitialize CoRevokeClassObject CoRegisterClassObject CoInitializeSecurity CoInitializeEx

rpcrt4

RpcServerUseProtseqEpW RpcServerRegisterIf RpcServerListen RpcMgmtStopServerListening RpcServerUnregisterIf UuidFromStringW UuidEqual UuidCreate RpcImpersonateClient RpcRevertToSelf NdrServerCall2

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList CM_Locate_DevNodeW CM_Get_Device_IDW CM_Get_Device_ID_Size_Ex CM_Get_DevNode_Status_Ex SetupDiOpenDeviceInterfaceW SetupDiCreateDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiOpenDeviceInfoW CM_Get_Parent_Ex CM_Get_Device_ID_List_ExW CM_Get_Device_ID_List_Size_ExW SetupDiEnumDeviceInterfaces CM_Reenumerate_DevNode_Ex

clusapi

GetNodeClusterState

dmutil

AddEntryBootFileGpt LowNtWriteFile LowNtReadFile LowNtReadOnlyAttributeOff GetSystemVolume GetInstallDirectoryPath LowAcquirePrivilege DynamicSupport FreeRgszw RgszwFromArgs RgszwFromValist RgszwDupRgszw GetErrorData AddEntryBootFileMbr TranslateError

osuninst

IsUninstallImageValid

Sharing

General

Malware Config

Signatures

File Explorer

2ecf7ec7ce175ab2296e6eaaac36fb73_JaffaCakes118

msvcrt

advapi32

kernel32

user32

ntdll

ole32

rpcrt4

setupapi

clusapi

dmutil

osuninst

generic