0dc61438b79668900bd081bac6109760_JaffaCakes118

General

Target
0dc61438b79668900bd081bac6109760_JaffaCakes118
Size 350KB
Sample240728-htwlmaxeme
SHA256 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd
MD5 0dc61438b79668900bd081bac6109760
SHA1 2ee66fd972c2d28ad30775971ba95056951910f0
SHA512 467b352ce6188e6126050c229cd47b526e83ef3535449c3f02b70491e159523d7cc8ebb28caab4e8d98627a22a0af1faf13b134072309dfe56ad175d18177ca7
SSDEEP 6144:RoX0oZ+rm/OV6ZH7XYuB4xpuMadbr2X3f+gOkXdhFr:Ry0xrm/h7XYuWCMaV2XWgO8hFr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0dc61438b79668900bd081bac6109760_JaffaCakes118

File Explorer

0dc61438b79668900bd081bac6109760_JaffaCakes118

.exe 350KB

0dc61438b79668900bd081bac6109760_JaffaCakes118

IMPHASH 1ffe8c197de69356ef37d0970e3fffd6
SHA256 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd
MD5 0dc61438b79668900bd081bac6109760
SHA1 2ee66fd972c2d28ad30775971ba95056951910f0
SHA512 467b352ce6188e6126050c229cd47b526e83ef3535449c3f02b70491e159523d7cc8ebb28caab4e8d98627a22a0af1faf13b134072309dfe56ad175d18177ca7
SSDEEP 6144:RoX0oZ+rm/OV6ZH7XYuB4xpuMadbr2X3f+gOkXdhFr:Ry0xrm/h7XYuWCMaV2XWgO8hFr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

49239

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile FindResourceExW HeapAlloc FindActCtxSectionGuid GetCurrentProcess WaitForSingleObject SetEvent GetModuleHandleW GetConsoleTitleA WriteFile GlobalAlloc Sleep FreeConsole ReadProcessMemory GetFileAttributesA lstrcpynW GetFileAttributesW GetCPInfo SetSystemPowerState ReadFile SetConsoleTitleA GetProcAddress BuildCommDCBW ResetEvent LocalAlloc OpenEventA WaitForMultipleObjects GetOEMCP GetModuleHandleA CreateMutexA GetPrivateProfileSectionA VirtualProtect ReleaseMutex SetFileShortNameA FindActCtxSectionStringW DeleteFileA CommConfigDialogA TryEnterCriticalSection CreateFileA LocalReAlloc PulseEvent InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RtlUnwind RaiseException LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW HeapCreate VirtualFree VirtualAlloc HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetACP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount LoadLibraryA GetLocaleInfoW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CloseHandle

advapi32

AreAnyAccessesGranted BackupEventLogA AdjustTokenGroups MapGenericMask AdjustTokenPrivileges

Name

.text

Size

147KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kuk

Size

512B

Virtual Size

1B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fihe

Size

512B

Virtual Size

1B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.luzehek

Size

512B

Virtual Size

1B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wilip

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0dc61438b79668900bd081bac6109760_JaffaCakes118

kernel32

advapi32

generic