83ee800ab35ba61968a732bda3104bc7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
83ee800ab35ba61968a732bda3104bc7_JaffaCakes118
Size 432KB
Sample240809-268lhatgmj
SHA256 abba0e02f66a25af374711ec9564884002d39266e41f30c29181042b7304a633
MD5 83ee800ab35ba61968a732bda3104bc7
SHA1 795078cdc75048caca7efca027e8a259163d55e3
SHA512 04f39be8042f08d425ceaf1422a77007cdfde0fab4b306ab7ee7fb0e388f06d2ba09ed9ad9ae0d9510bee34be0101a6853535df19a92cf3c5b16c8640c3a4f1a
SSDEEP 12288:wUCmZiCEXURm/NYP2kvpni4BoTUYToGkzCAfPOe93:2CEXURmtkvpnvoTbToGmOK3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83ee800ab35ba61968a732bda3104bc7_JaffaCakes118

File Explorer

83ee800ab35ba61968a732bda3104bc7_JaffaCakes118

.exe 432KB

83ee800ab35ba61968a732bda3104bc7_JaffaCakes118

IMPHASH 41721e0f933696d50ab32d544d64dcd3
SHA256 abba0e02f66a25af374711ec9564884002d39266e41f30c29181042b7304a633
MD5 83ee800ab35ba61968a732bda3104bc7
SHA1 795078cdc75048caca7efca027e8a259163d55e3
SHA512 04f39be8042f08d425ceaf1422a77007cdfde0fab4b306ab7ee7fb0e388f06d2ba09ed9ad9ae0d9510bee34be0101a6853535df19a92cf3c5b16c8640c3a4f1a
SSDEEP 12288:wUCmZiCEXURm/NYP2kvpni4BoTUYToGkzCAfPOe93:2CEXURmtkvpnvoTbToGmOK3
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

api-ms-win-core-crt-l2-1-0

_initterm _initterm_e __wgetmainargs

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken SetProcessAffinityUpdateMode ExitProcess GetCurrentThreadId GetCurrentProcess GetCurrentProcessId TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount64 GetTickCount

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter SetErrorMode UnhandledExceptionFilter

api-ms-win-service-private-l1-1-3

I_RegisterSvchostNotificationCallback

api-ms-win-core-crt-l1-1-0

qsort_s memset memcpy _wcsicmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetProcAddress LoadLibraryExW

api-ms-win-core-heap-l1-1-0

HeapSetInformation HeapFree GetProcessHeap HeapAlloc

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive AcquireSRWLockShared InitializeSRWLock EnterCriticalSection LeaveCriticalSection ReleaseSRWLockShared

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-core-string-l1-1-0

CompareStringOrdinal MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenKeyExW RegEnumKeyExW RegDisablePredefinedCacheEx RegQueryValueExW RegGetValueW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy

api-ms-win-core-processthreads-l1-1-2

SetProtectedPolicy

rpcrt4

RpcServerUnregisterIfEx I_RpcMapWin32Status RpcServerUseProtseqEpW RpcMgmtSetServerStackSize RpcServerUnregisterIf RpcServerRegisterIf RpcMgmtStopServerListening RpcServerListen RpcMgmtWaitServerListen I_RpcServerDisableExceptionFilter

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl GetLengthSid AddAccessAllowedAce InitializeAcl GetTokenInformation InitializeSecurityDescriptor

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventRegister EventWriteTransfer

api-ms-win-crt-utility-l1-1-0

bsearch_s

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx CreateActCtxW DeactivateActCtx ActivateActCtx

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

ntdll

RtlQueryHeapInformation RtlImageNtHeader _vsnwprintf TpSetTimer TpReleaseTimer TpWaitForTimer TpSetTimerEx EtwEventWrite RtlRunOnceExecuteOnce RtlNtStatusToDosError EtwEventEnabled TpReleaseWait RtlNtStatusToDosErrorNoTeb TpSetWait TpAllocWait EtwEventRegister RtlUnhandledExceptionFilter NtSetInformationProcess RtlSetProcessIsCritical RtlInitializeCriticalSection RtlInitializeSid RtlAllocateHeap RtlSubAuthoritySid RtlGetDeviceFamilyInfoEnum RtlReleaseSRWLockExclusive RtlSubAuthorityCountSid RtlAcquireSRWLockExclusive RtlLengthRequiredSid RtlDeriveCapabilitySidsFromName RtlCopySid RtlFreeHeap TpAllocTimer NtQuerySystemInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

400KB

Virtual Size

992KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

83ee800ab35ba61968a732bda3104bc7_JaffaCakes118

api-ms-win-core-crt-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-service-private-l1-1-3

api-ms-win-core-crt-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processthreads-l1-1-2

rpcrt4

api-ms-win-core-localization-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic