4c4e3acde545ae4509f3f4eb7d8c8942_JaffaCakes118

General

Target
4c4e3acde545ae4509f3f4eb7d8c8942_JaffaCakes118
Size 743KB
Sample240716-b64pfazarn
SHA256 d45568b1f8f868b38cc6e64d58adcf5668b8f5e2460f8719fe9604baa87a03a2
MD5 4c4e3acde545ae4509f3f4eb7d8c8942
SHA1 cda03f93ed400918c1fc8315f576222c0378f78d
SHA512 337d31b624ed144ffd2bc2bb94c991d19e7dff10b8b24256e9819d0527eeafeea57fdb775ad7271068027354a3260f15fd534ef4e4fa3e9de7e92cc55d0cbe94
SSDEEP 12288:Dh2wuk0aZ7PWqdACJAwN/N3VlVOfPzHVe1O8Xn7Sumn:Dh25qqG5NFNOjHVe1J7Pmn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c4e3acde545ae4509f3f4eb7d8c8942_JaffaCakes118

File Explorer

4c4e3acde545ae4509f3f4eb7d8c8942_JaffaCakes118

.exe 743KB

4c4e3acde545ae4509f3f4eb7d8c8942_JaffaCakes118

IMPHASH f06b07c86b8ec34d37bc05cf656343f1
SHA256 d45568b1f8f868b38cc6e64d58adcf5668b8f5e2460f8719fe9604baa87a03a2
MD5 4c4e3acde545ae4509f3f4eb7d8c8942
SHA1 cda03f93ed400918c1fc8315f576222c0378f78d
SHA512 337d31b624ed144ffd2bc2bb94c991d19e7dff10b8b24256e9819d0527eeafeea57fdb775ad7271068027354a3260f15fd534ef4e4fa3e9de7e92cc55d0cbe94
SSDEEP 12288:Dh2wuk0aZ7PWqdACJAwN/N3VlVOfPzHVe1O8Xn7Sumn:Dh25qqG5NFNOjHVe1J7Pmn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\windows\system32\advapi32

RegCloseKey RegCreateKeyA RegSetValueExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegQueryValueExA

c:\windows\system32\kernel32

GetProcAddress GetSystemDirectoryA GetCurrentProcess RtlMoveMemory CreateToolhelp32Snapshot LoadLibraryA MoveFileExA Module32First CloseHandle Module32Next

c:\windows\system32\user32

CallWindowProcA

msvbvm60

__vbaVarTstGt _CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaPut4 __vbaRaiseEvent __vbaFreeObjList ord516 _adj_fprem1 ord518 __vbaCopyBytes __vbaStrCat __vbaLsetFixstr __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar ord666 ord667 __vbaAryDestruct __vbaExitProc __vbaVarForInit __vbaStrLike ord595 __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaStrFixstr _CIsin __vbaErase ord631 ord525 __vbaVarZero ord632 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaI2I4 __vbaObjVar _adj_fpatan __vbaFixstrConstruct __vbaRedim EVENT_SINK_Release _CIsqrt EVENT_SINK_QueryInterface __vbaStr2Vec __vbaExceptHandler ord711 __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaStrVarVal __vbaUbound __vbaVarCat ord644 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaVar2Vec __vbaNew2 ord648 __vbaR8Str _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList __vbaDerefAry1 _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarSetVar __vbaI4Var __vbaAryLock __vbaLateMemCall __vbaVarDup __vbaStrToAnsi ord616 __vbaFpI4 __vbaVarLateMemCallLd ord617 __vbaLateMemCallLd _CIatan __vbaAryCopy __vbaStrMove __vbaUI1Str __vbaR8IntI4 _allmul _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaI4ErrVar __vbaFreeObj

Sharing

General

Malware Config

Signatures

File Explorer

4c4e3acde545ae4509f3f4eb7d8c8942_JaffaCakes118

c:\windows\system32\advapi32

c:\windows\system32\kernel32

c:\windows\system32\user32

msvbvm60

generic