4b5a9120fc7c8465ef6cfeb6ba09cdfd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
4b5a9120fc7c8465ef6cfeb6ba09cdfd_JaffaCakes118
Size 432KB
Sample240715-zphmms1eqe
SHA256 b130cbe3581b74858cb099558c72bb215485e830a9f9149cdab270f6dee92835
MD5 4b5a9120fc7c8465ef6cfeb6ba09cdfd
SHA1 dd72ecc665bf4f9a4020fee5e7a0d2ad9b11268d
SHA512 2c3cd412cfd166209c9f9d3666fee1cddb3364a52bfd08ad5ffe3fb3dd3244f03b87d097c3d4b60ff427c5d3336e09d8bf97055706c768177b0863c16a7bf4e0
SSDEEP 12288:DUCmZiCTKt+CygaXS313nIqLfJW3hhRpyUBtdutCnv:NCTi+wn313hfJmjdb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b5a9120fc7c8465ef6cfeb6ba09cdfd_JaffaCakes118

File Explorer

4b5a9120fc7c8465ef6cfeb6ba09cdfd_JaffaCakes118

.exe 432KB

4b5a9120fc7c8465ef6cfeb6ba09cdfd_JaffaCakes118

IMPHASH 41721e0f933696d50ab32d544d64dcd3
SHA256 b130cbe3581b74858cb099558c72bb215485e830a9f9149cdab270f6dee92835
MD5 4b5a9120fc7c8465ef6cfeb6ba09cdfd
SHA1 dd72ecc665bf4f9a4020fee5e7a0d2ad9b11268d
SHA512 2c3cd412cfd166209c9f9d3666fee1cddb3364a52bfd08ad5ffe3fb3dd3244f03b87d097c3d4b60ff427c5d3336e09d8bf97055706c768177b0863c16a7bf4e0
SSDEEP 12288:DUCmZiCTKt+CygaXS313nIqLfJW3hhRpyUBtdutCnv:NCTi+wn313hfJmjdb
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

api-ms-win-core-crt-l2-1-0

_initterm _initterm_e __wgetmainargs

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken SetProcessAffinityUpdateMode ExitProcess GetCurrentThreadId GetCurrentProcess GetCurrentProcessId TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount64 GetTickCount

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter SetErrorMode UnhandledExceptionFilter

api-ms-win-service-private-l1-1-3

I_RegisterSvchostNotificationCallback

api-ms-win-core-crt-l1-1-0

qsort_s memset memcpy _wcsicmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetProcAddress LoadLibraryExW

api-ms-win-core-heap-l1-1-0

HeapSetInformation HeapFree GetProcessHeap HeapAlloc

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive AcquireSRWLockShared InitializeSRWLock EnterCriticalSection LeaveCriticalSection ReleaseSRWLockShared

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-core-string-l1-1-0

CompareStringOrdinal MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenKeyExW RegEnumKeyExW RegDisablePredefinedCacheEx RegQueryValueExW RegGetValueW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy

api-ms-win-core-processthreads-l1-1-2

SetProtectedPolicy

rpcrt4

RpcServerUnregisterIfEx I_RpcMapWin32Status RpcServerUseProtseqEpW RpcMgmtSetServerStackSize RpcServerUnregisterIf RpcServerRegisterIf RpcMgmtStopServerListening RpcServerListen RpcMgmtWaitServerListen I_RpcServerDisableExceptionFilter

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl GetLengthSid AddAccessAllowedAce InitializeAcl GetTokenInformation InitializeSecurityDescriptor

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventRegister EventWriteTransfer

api-ms-win-crt-utility-l1-1-0

bsearch_s

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx CreateActCtxW DeactivateActCtx ActivateActCtx

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

ntdll

RtlQueryHeapInformation RtlImageNtHeader _vsnwprintf TpSetTimer TpReleaseTimer TpWaitForTimer TpSetTimerEx EtwEventWrite RtlRunOnceExecuteOnce RtlNtStatusToDosError EtwEventEnabled TpReleaseWait RtlNtStatusToDosErrorNoTeb TpSetWait TpAllocWait EtwEventRegister RtlUnhandledExceptionFilter NtSetInformationProcess RtlSetProcessIsCritical RtlInitializeCriticalSection RtlInitializeSid RtlAllocateHeap RtlSubAuthoritySid RtlGetDeviceFamilyInfoEnum RtlReleaseSRWLockExclusive RtlSubAuthorityCountSid RtlAcquireSRWLockExclusive RtlLengthRequiredSid RtlDeriveCapabilitySidsFromName RtlCopySid RtlFreeHeap TpAllocTimer NtQuerySystemInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

400KB

Virtual Size

992KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4b5a9120fc7c8465ef6cfeb6ba09cdfd_JaffaCakes118

api-ms-win-core-crt-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-service-private-l1-1-3

api-ms-win-core-crt-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processthreads-l1-1-2

rpcrt4

api-ms-win-core-localization-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic