38b68790bb25bb424b805ffed610ee9c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
38b68790bb25bb424b805ffed610ee9c_JaffaCakes118
Size 155KB
Sample240711-mbdejsvcje
SHA256 c8e613ecd7b4783ea535f669d173a0306ba35b20de0f93e65015995feba43b6b
MD5 38b68790bb25bb424b805ffed610ee9c
SHA1 bed4b19f11c8b46d3098cf63b5159eac7b3ce428
SHA512 f86d549f12580641c8888cc05f1355ce6b305299864cc865dbd066b4649299ca9cb396471a2027e1a2bc9e9725adc8fdb2882b02e8536f88c67e9eaba892b838
SSDEEP 3072:QG2nb11GVTOeP5xh+ppanECyJRPjE/AYNHjE+ceo7Tho6nXZ:QTn/GVbP5xcppnPQndjEl9ThTp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38b68790bb25bb424b805ffed610ee9c_JaffaCakes118

File Explorer

38b68790bb25bb424b805ffed610ee9c_JaffaCakes118

.dll 155KB

38b68790bb25bb424b805ffed610ee9c_JaffaCakes118

IMPHASH 5f43e09aaffb3670227635bfc729d3d1
SHA256 c8e613ecd7b4783ea535f669d173a0306ba35b20de0f93e65015995feba43b6b
MD5 38b68790bb25bb424b805ffed610ee9c
SHA1 bed4b19f11c8b46d3098cf63b5159eac7b3ce428
SHA512 f86d549f12580641c8888cc05f1355ce6b305299864cc865dbd066b4649299ca9cb396471a2027e1a2bc9e9725adc8fdb2882b02e8536f88c67e9eaba892b838
SSDEEP 3072:QG2nb11GVTOeP5xh+ppanECyJRPjE/AYNHjE+ceo7Tho6nXZ:QTn/GVbP5xcppnPQndjEl9ThTp
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73545

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

VirtualQuery WriteProcessMemory GetCurrentProcess VirtualProtect lstrcmpiA GetModuleFileNameA LoadLibraryA LoadLibraryW LoadLibraryExA LoadLibraryExW WriteFile CreateFileA ReadFile GetFileSize UnmapViewOfFile MapViewOfFile CreateFileMappingA Sleep OpenFileMappingA SetLastError GetLastError CreateThread DeleteCriticalSection TerminateThread GetExitCodeThread LeaveCriticalSection EnterCriticalSection CreateToolhelp32Snapshot ConnectNamedPipe CreateNamedPipeA InitializeCriticalSection HeapAlloc HeapFree HeapSize HeapReAlloc DeleteFileA Process32Next TerminateProcess OpenProcess Process32First SetThreadPriority GetCurrentThread HeapCreate HeapDestroy SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetOEMCP Module32First Module32Next CloseHandle GetModuleHandleA GetProcAddress GetCurrentProcessId GetACP GetSystemInfo DisconnectNamedPipe RtlUnwind InterlockedDecrement InterlockedIncrement GetTimeZoneInformation GetSystemTime GetLocalTime GetCommandLineA GetVersion GetEnvironmentVariableA GetVersionExA VirtualFree VirtualAlloc IsBadWritePtr ExitProcess MultiByteToWideChar GetStringTypeA GetStringTypeW GetCurrentThreadId TlsSetValue TlsAlloc TlsFree TlsGetValue WideCharToMultiByte LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr SetFilePointer SetStdHandle FlushFileBuffers GetCPInfo InterlockedExchange

user32

CallNextHookEx SendMessageA PostMessageA UnhookWindowsHookEx SetWindowsHookExA FindWindowA

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

shlwapi

SHRegSetUSValueA

imagehlp

ImageDirectoryEntryToData

Sharing

General

Malware Config

Signatures

File Explorer

38b68790bb25bb424b805ffed610ee9c_JaffaCakes118

kernel32

user32

advapi32

shlwapi

imagehlp

generic