4013dc0bad3c5043e7f642560a15b4c4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
4013dc0bad3c5043e7f642560a15b4c4_JaffaCakes118
Size 34KB
Sample240713-eczp6svanm
SHA256 919c95161b6e528ff970cffb8ecee4199aed09f86d575b510fbda6e90f7e566a
MD5 4013dc0bad3c5043e7f642560a15b4c4
SHA1 42597c7da258a4da5a0c75bf6f228d286c0640bf
SHA512 c55b91388ac164bde9b63d60b530c4fa564c0c5e18b362f7a673f384a5bb82b6e1088ae05302c7129df2d0b645a1572c8a3923ac30d92ff211cb6c61b30cc24d
SSDEEP 768:AlOTjhcY4591BlnONd7hFyDhChw59FR6Cjf:AlOTL45jy7hF4M6XFR6Cj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4013dc0bad3c5043e7f642560a15b4c4_JaffaCakes118

File Explorer

4013dc0bad3c5043e7f642560a15b4c4_JaffaCakes118

.dll 34KB

4013dc0bad3c5043e7f642560a15b4c4_JaffaCakes118

IMPHASH 790e168cd9faf22077f08d77382947dd
SHA256 919c95161b6e528ff970cffb8ecee4199aed09f86d575b510fbda6e90f7e566a
MD5 4013dc0bad3c5043e7f642560a15b4c4
SHA1 42597c7da258a4da5a0c75bf6f228d286c0640bf
SHA512 c55b91388ac164bde9b63d60b530c4fa564c0c5e18b362f7a673f384a5bb82b6e1088ae05302c7129df2d0b645a1572c8a3923ac30d92ff211cb6c61b30cc24d
SSDEEP 768:AlOTjhcY4591BlnONd7hFyDhChw59FR6Cjf:AlOTL45jy7hF4M6XFR6Cj
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA CreateToolhelp32Snapshot ReadFile TerminateProcess OpenProcess SetFileAttributesA GetCommandLineA WaitForSingleObject GetSystemDirectoryA MultiByteToWideChar DeleteFileA GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect GetCurrentDirectoryA GetPrivateProfileStringA ExitProcess CreateThread IsBadReadPtr Sleep

user32

GetParent GetWindowThreadProcessId ReleaseDC wsprintfA GetWindowTextA GetWindowRect GetDC GetDesktopWindow

gdi32

SelectObject CreateCompatibleBitmap DeleteObject GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC GetDeviceCaps CreateDCA CreateCompatibleDC BitBlt

advapi32

CryptHashData CryptGetHashParam CryptCreateHash CryptAcquireContextA

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipSaveImageToFile GdiplusShutdown GdipLoadImageFromFile GdipDisposeImage

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

msvcrt

_access strrchr strchr atoi free __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev malloc wcscmp ??2@YAPAXI@Z memcpy __CxxFrameHandler strcat strncmp strstr memset sprintf strncpy strcmp strcpy strlen

netapi32

Netbios

Sharing

General

Malware Config

Signatures

File Explorer

4013dc0bad3c5043e7f642560a15b4c4_JaffaCakes118

kernel32

user32

gdi32

advapi32

gdiplus

msvcp60

ws2_32

msvcrt

netapi32

generic