441d1853a157fdc27fc440cb4ea8631f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
441d1853a157fdc27fc440cb4ea8631f_JaffaCakes118
Size 1.2MB
Sample240729-nsc1sa1cqa
SHA256 1eff5a535ca809bf653b2ffec4f0361055d8dece0889783b7df570dd19701cb9
MD5 441d1853a157fdc27fc440cb4ea8631f
SHA1 52b2b46c41c4f5e28df2c6562cd566b2ded6a07e
SHA512 690cb1dcbbce7746f13f9a99991c4d36937648c5a6c10a148d996e37d70c3abfc4d26833e41456f7910572f818cd059a74aa83492d0795ce95095c5b5c7c4819
SSDEEP 24576:UuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:M9cKrUqZWLAcU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
441d1853a157fdc27fc440cb4ea8631f_JaffaCakes118

File Explorer

441d1853a157fdc27fc440cb4ea8631f_JaffaCakes118

.dll 1.2MB

441d1853a157fdc27fc440cb4ea8631f_JaffaCakes118

IMPHASH 1719e6eb79abbb745bd327c250f33bb3
SHA256 1eff5a535ca809bf653b2ffec4f0361055d8dece0889783b7df570dd19701cb9
MD5 441d1853a157fdc27fc440cb4ea8631f
SHA1 52b2b46c41c4f5e28df2c6562cd566b2ded6a07e
SHA512 690cb1dcbbce7746f13f9a99991c4d36937648c5a6c10a148d996e37d70c3abfc4d26833e41456f7910572f818cd059a74aa83492d0795ce95095c5b5c7c4819
SSDEEP 24576:UuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:M9cKrUqZWLAcU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

933952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

AcceptSecurityContext AcquireCredentialsHandleA AcquireCredentialsHandleW AddCredentialsA AddCredentialsW AddSecurityPackageA AddSecurityPackageW ApplyControlToken ChangeAccountPasswordA ChangeAccountPasswordW CloseLsaPerformanceData CollectLsaPerformanceData CompleteAuthToken CredMarshalTargetInfo CredParseUserNameWithType CredUnmarshalTargetInfo DecryptMessage DeleteSecurityContext DeleteSecurityPackageA DeleteSecurityPackageW EncryptMessage EnumerateSecurityPackagesA EnumerateSecurityPackagesW ExportSecurityContext FreeContextBuffer FreeCredentialsHandle GetComputerObjectNameA GetComputerObjectNameW GetSecurityUserInfo GetUserNameExA GetUserNameExW ImpersonateSecurityContext ImportSecurityContextA ImportSecurityContextW InitSecurityInterfaceA InitSecurityInterfaceW InitializeSecurityContextA InitializeSecurityContextW LsaCallAuthenticationPackage LsaConnectUntrusted LsaDeregisterLogonProcess LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess LsaRegisterPolicyChangeNotification LsaUnregisterPolicyChangeNotification MakeSignature OpenLsaPerformanceData QueryContextAttributesA QueryContextAttributesW QueryCredentialsAttributesA QueryCredentialsAttributesW QuerySecurityContextToken QuerySecurityPackageInfoA QuerySecurityPackageInfoW RevertSecurityContext SaslAcceptSecurityContext SaslEnumerateProfilesA SaslEnumerateProfilesW SaslGetContextOption SaslGetProfilePackageA SaslGetProfilePackageW SaslIdentifyPackageA SaslIdentifyPackageW SaslInitializeSecurityContextA SaslInitializeSecurityContextW SaslSetContextOption SealMessage SeciAllocateAndSetCallFlags SeciAllocateAndSetIPAddress SeciFreeCallContext SecpFreeMemory SecpTranslateName SecpTranslateNameEx SetContextAttributesA SetContextAttributesW SetCredentialsAttributesA SetCredentialsAttributesW SspiCompareAuthIdentities SspiCopyAuthIdentity SspiDecryptAuthIdentity SspiEncodeAuthIdentityAsStrings SspiEncodeStringsAsAuthIdentity SspiEncryptAuthIdentity SspiExcludePackage SspiFreeAuthIdentity SspiGetTargetHostName SspiIsAuthIdentityEncrypted SspiLocalFree SspiMarshalAuthIdentity SspiPrepareForCredRead SspiPrepareForCredWrite SspiUnmarshalAuthIdentity SspiValidateAuthIdentity SspiZeroAuthIdentity TranslateNameA TranslateNameW UnsealMessage VerifySignature

Name

.text

Size

911KB

Virtual Size

910KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

336B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

388B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

782B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

441d1853a157fdc27fc440cb4ea8631f_JaffaCakes118

gdi32

advapi32

kernel32

user32

comdlg32

generic