5c0c3fe6616fe5cc8b906684d10e86dc_JaffaCakes118

General

Target
5c0c3fe6616fe5cc8b906684d10e86dc_JaffaCakes118
Size 209KB
Sample240719-p8rdsawbmf
SHA256 2b405c81d6210d441eb7a4d0c28c0b20601a93a73cec5d074d580eee6064636c
MD5 5c0c3fe6616fe5cc8b906684d10e86dc
SHA1 5b26324ecb6cbe774d81d349f8c16948422be924
SHA512 751bc2a73babcef8ab9cc3b12416778775dd2ab734c729912abfafd9697b987884270056112fca3decac463d34aa83a5f580dfa4b8d5fc0c19dbf620cdc15d45
SSDEEP 3072:f3fmLzd0UMN8DOz4pyzGHnGCwYB5D51UaJQMOFHHRayPPtW3Lz:Pfax01NWjnb5LqFtHRHHtW3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c0c3fe6616fe5cc8b906684d10e86dc_JaffaCakes118

File Explorer

5c0c3fe6616fe5cc8b906684d10e86dc_JaffaCakes118

.exe 209KB

5c0c3fe6616fe5cc8b906684d10e86dc_JaffaCakes118

IMPHASH 8c3d51d81353c28cf780e1b3afc93f6e
SHA256 2b405c81d6210d441eb7a4d0c28c0b20601a93a73cec5d074d580eee6064636c
MD5 5c0c3fe6616fe5cc8b906684d10e86dc
SHA1 5b26324ecb6cbe774d81d349f8c16948422be924
SHA512 751bc2a73babcef8ab9cc3b12416778775dd2ab734c729912abfafd9697b987884270056112fca3decac463d34aa83a5f580dfa4b8d5fc0c19dbf620cdc15d45
SSDEEP 3072:f3fmLzd0UMN8DOz4pyzGHnGCwYB5D51UaJQMOFHHRayPPtW3Lz:Pfax01NWjnb5LqFtHRHHtW3
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

217088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVersionExW IsBadReadPtr OpenProcess FlushInstructionCache MulDiv GetLocaleInfoW QueryPerformanceFrequency GlobalFree GlobalAlloc GlobalLock RemoveDirectoryW FlushFileBuffers CreateEventW GetTempFileNameA GetVersion LocalAlloc LocalFree SetEvent WaitForSingleObject GetCurrentProcess GetTempPathW FreeLibrary LoadLibraryW ExitProcess GetCurrentProcessId GetFileTime GetModuleFileNameW MultiByteToWideChar CopyFileW CreateDirectoryA ResetEvent WaitForMultipleObjects VirtualFree VirtualProtect VirtualAlloc GetCurrentThreadId GetCommandLineW GetModuleHandleW WriteConsoleA GetModuleHandleA GetStartupInfoA

ws2_32

WSACleanup getprotobynumber getservbyname getservbyport setsockopt socket getsockopt htonl htons ntohs send recvfrom recv

msvcr71

_exit _onexit __dllonexit _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs wcslen fclose fwrite fseek fopen memset free malloc _c_exit _amsg_exit _XcptFilter _ismbblead _cexit exit _acmdln _controlfp

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

sdcnmsz

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

106KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

5c0c3fe6616fe5cc8b906684d10e86dc_JaffaCakes118

kernel32

ws2_32

msvcr71

generic