88175d86d6ff1cb49e09783039ced12d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
88175d86d6ff1cb49e09783039ced12d_JaffaCakes118
Size 172KB
Sample240810-3d56catdpj
SHA256 c22f344f29c4fbf5f2098793349923b058b4a02a5b1694a833d78d11a8a86532
MD5 88175d86d6ff1cb49e09783039ced12d
SHA1 33c630c82bb3b47e4e8d491c468807b2ce8bd0b8
SHA512 d88be70c424a9725fb722c2d7d17cd54e20dc31b577060c39290b2cb5433dac4fae06e3d4d7def760053adba4a9d9cd6896ec1699de97f674611d6cba4c77a68
SSDEEP 3072:n1H5JspfOCxIjUO4rhFcaOx6aE8BSyJ7hUW/x7u7jQ6:dnUduhADXs7hLuX5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88175d86d6ff1cb49e09783039ced12d_JaffaCakes118

File Explorer

88175d86d6ff1cb49e09783039ced12d_JaffaCakes118

.exe 172KB

88175d86d6ff1cb49e09783039ced12d_JaffaCakes118

IMPHASH a1c5f60499c5732000cbd7d7f76bc58b
SHA256 c22f344f29c4fbf5f2098793349923b058b4a02a5b1694a833d78d11a8a86532
MD5 88175d86d6ff1cb49e09783039ced12d
SHA1 33c630c82bb3b47e4e8d491c468807b2ce8bd0b8
SHA512 d88be70c424a9725fb722c2d7d17cd54e20dc31b577060c39290b2cb5433dac4fae06e3d4d7def760053adba4a9d9cd6896ec1699de97f674611d6cba4c77a68
SSDEEP 3072:n1H5JspfOCxIjUO4rhFcaOx6aE8BSyJ7hUW/x7u7jQ6:dnUduhADXs7hLuX5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVersionExA GetSystemDirectoryA GetLastError CreateFileA DuplicateHandle GetCurrentProcess OpenProcess WinExec GetModuleFileNameA SetFileTime GetFileAttributesExA GetStartupInfoA GetModuleHandleA WideCharToMultiByte CreateProcessA WaitForSingleObject TerminateProcess CloseHandle LoadLibraryA GetProcAddress Sleep FreeLibrary WriteFile

user32

PostMessageA EnumChildWindows GetWindowThreadProcessId GetClassNameA ShowWindow CreateWindowExA RegisterClassExA DispatchMessageA GetDesktopWindow TranslateMessage GetMessageA DefWindowProcA RegisterWindowMessageA SendMessageTimeoutA EnumWindows PostQuitMessage

advapi32

RegQueryValueExA OpenSCManagerA ConvertSidToStringSidA LookupAccountNameA GetUserNameA CreateServiceA StartServiceA OpenServiceA DeleteService RegCloseKey RegOpenKeyExA CloseServiceHandle

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize

oleaut32

SysFreeString VariantClear

msvcrt

fopen _strlwr _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit time srand ??2@YAPAXI@Z ??3@YAXPAX@Z _stricmp wcslen atoi strchr strstr rand __CxxFrameHandler sprintf _access fclose fflush fwrite

shlwapi

SHGetValueA SHSetValueA

dbghelp

ImageNtHeader

Name

.text

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

116KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

odata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ndata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

mdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

edata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

cdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

idata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

88175d86d6ff1cb49e09783039ced12d_JaffaCakes118

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

dbghelp

generic