63dac0f10c65eb3e0f5fc48f2aa3f039_JaffaCakes118

General

Target
63dac0f10c65eb3e0f5fc48f2aa3f039_JaffaCakes118
Size 285KB
Sample240722-tj656awfmn
SHA256 bcc2de43ce9fb4d34c35f28f946f23d51742e5fff59d2e015180daab1626b547
MD5 63dac0f10c65eb3e0f5fc48f2aa3f039
SHA1 dd4d9229e84d441f5c62038d3e8ccf19a671979d
SHA512 7ce4b6b4b4004f1d4dc4bb75d1a8ca275c4abc374ca77051e1be9512c9beb973857342dfdb4b770199c559acd65fc2dc03bc364bf2f72db81dea5811be9fd8d4
SSDEEP 6144:LodOk0LdK5BTfRZK5d1nWyWL6MCOhxxFeTr/ekI:0IWTf3KQ7L6+zxF6L
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63dac0f10c65eb3e0f5fc48f2aa3f039_JaffaCakes118

File Explorer

63dac0f10c65eb3e0f5fc48f2aa3f039_JaffaCakes118

.exe 285KB

63dac0f10c65eb3e0f5fc48f2aa3f039_JaffaCakes118

IMPHASH 401c37f2bd821b3afe64e4a9a74e43f3
SHA256 bcc2de43ce9fb4d34c35f28f946f23d51742e5fff59d2e015180daab1626b547
MD5 63dac0f10c65eb3e0f5fc48f2aa3f039
SHA1 dd4d9229e84d441f5c62038d3e8ccf19a671979d
SHA512 7ce4b6b4b4004f1d4dc4bb75d1a8ca275c4abc374ca77051e1be9512c9beb973857342dfdb4b770199c559acd65fc2dc03bc364bf2f72db81dea5811be9fd8d4
SSDEEP 6144:LodOk0LdK5BTfRZK5d1nWyWL6MCOhxxFeTr/ekI:0IWTf3KQ7L6+zxF6L
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\faxu\yi.pdb

kernel32

HeapReAlloc GlobalDeleteAtom GetLocaleInfoA InterlockedIncrement GetQueuedCompletionStatus GetEnvironmentStringsW SetEvent ReadConsoleW GetCommandLineA CreateActCtxW GlobalAlloc CopyFileW FreeConsole LeaveCriticalSection GetFileAttributesA HeapCreate WriteConsoleW lstrlenW ReleaseSemaphore SetConsoleTitleA FlushFileBuffers DeactivateActCtx GetProcAddress BeginUpdateResourceW RemoveDirectoryA VerLanguageNameW LocalAlloc SetConsoleWindowInfo SetEnvironmentVariableA GetModuleFileNameA SetConsoleTitleW GetModuleHandleA EraseTape VirtualProtect EndUpdateResourceA FindFirstVolumeW GetCurrentProcessId GetPrivateProfileSectionW FindNextVolumeA lstrcpyW GetConsoleOutputCP InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection GetLastError HeapFree HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo VirtualFree VirtualAlloc GetModuleHandleW ExitProcess WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId SetHandleCount GetFileType GetStartupInfoA SetFilePointer GetACP GetOEMCP IsValidCodePage GetModuleFileNameW FreeEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime HeapSize GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount LoadLibraryA CloseHandle CreateFileA SetStdHandle GetConsoleCP GetConsoleMode GetLocaleInfoW SetEndOfFile GetProcessHeap ReadFile WriteConsoleA

Sharing

General

Malware Config

Signatures

File Explorer

63dac0f10c65eb3e0f5fc48f2aa3f039_JaffaCakes118

kernel32

generic