305cd06c536c9df79b687c1898d3709d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
305cd06c536c9df79b687c1898d3709d_JaffaCakes118
Size 130KB
Sample240709-pk183swajc
SHA256 35866cc2ea5937dbe0c4df8fbd429633043ba26b3d80199cd628f0f8a491286a
MD5 305cd06c536c9df79b687c1898d3709d
SHA1 6afe6dcf3afac18476883ab6407c3e91ec7c8dc7
SHA512 5f5794789731a819795fe43d35d6a820d1661578d9731b4efef8666fea054b1d4c5702f0f398e04bdab7eb125336fc5dbaf4549dc14a6d7daeec0de396a22195
SSDEEP 1536:JsuQJc7vZ1bZjgf8pC++5B3ZOk4EEJtlY463Q8asf74pIpJJR7EJTZ:JQc7fbZs0pb+5L/3EJtlYdA8aS74goZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
305cd06c536c9df79b687c1898d3709d_JaffaCakes118

File Explorer

305cd06c536c9df79b687c1898d3709d_JaffaCakes118

.exe .vbs 130KB

305cd06c536c9df79b687c1898d3709d_JaffaCakes118

IMPHASH ef2c43bbd1d69c662e975f06c2f3267c
SHA256 35866cc2ea5937dbe0c4df8fbd429633043ba26b3d80199cd628f0f8a491286a
MD5 305cd06c536c9df79b687c1898d3709d
SHA1 6afe6dcf3afac18476883ab6407c3e91ec7c8dc7
SHA512 5f5794789731a819795fe43d35d6a820d1661578d9731b4efef8666fea054b1d4c5702f0f398e04bdab7eb125336fc5dbaf4549dc14a6d7daeec0de396a22195
SSDEEP 1536:JsuQJc7vZ1bZjgf8pC++5B3ZOk4EEJtlY463Q8asf74pIpJJR7EJTZ:JQc7fbZs0pb+5L/3EJtlYdA8aS74goZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86 polyglot

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar lstrlenA FindClose FindFirstFileA GetSystemDirectoryA MoveFileExA ReadFile WinExec GetTempFileNameA GetTempPathA SetFilePointer lstrcpynA CreateDirectoryA FindNextFileA ReleaseMutex WaitForSingleObject lstrcmpiA lstrcpyA lstrcmpA GetEnvironmentVariableA lstrcatA GetDiskFreeSpaceA GetModuleHandleA Sleep MoveFileA GetLocalTime GetCurrentProcess FormatMessageA GetLastError GetComputerNameA SetFileAttributesW GetSystemTime VirtualAlloc VirtualFree FileTimeToDosDateTime SetEndOfFile DosDateTimeToFileTime ExitProcess SetFileTime SystemTimeToFileTime CreateProcessA GetWindowsDirectoryA CreateMutexA CreateSemaphoreA CreateThread SizeofResource LockResource LoadResource FindResourceA DeviceIoControl HeapFree HeapAlloc GetProcessHeap GetDriveTypeA GetLogicalDrives GetLogicalDriveStringsA FileTimeToSystemTime ReleaseSemaphore OpenSemaphoreA GetFileSize CreateFileMappingA MapViewOfFile WriteFile UnmapViewOfFile CreateFileA GetFileTime CloseHandle DeleteFileA GetModuleFileNameA CopyFileA SetFileAttributesA LoadLibraryA SetCurrentDirectoryA GetProcAddress

user32

CharLowerBuffA wsprintfA DefWindowProcA SetTimer ShowWindow PostQuitMessage EndDialog KillTimer DialogBoxParamA

advapi32

InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl SetFileSecurityA InitializeSecurityDescriptor AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSaveKeyA RegOpenKeyExA RegRestoreKeyA RegCloseKey RegQueryValueExA LookupAccountNameA

shell32

SHChangeNotify

ole32

CoInitialize CoUninitialize

msvcrt

strrchr _strcmpi atol isdigit _except_handler3 memmove strchr wcslen strncmp __CxxFrameHandler atoi _strlwr strncpy _findfirst _findclose _findnext

ws2_32

gethostbyname WSAStartup WSACleanup inet_addr

Sharing

General

Malware Config

Signatures

File Explorer

305cd06c536c9df79b687c1898d3709d_JaffaCakes118

kernel32

user32

advapi32

shell32

ole32

msvcrt

ws2_32

generic