8e7b76532c0bb541c727861f74a0b618_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
8e7b76532c0bb541c727861f74a0b618_JaffaCakes118
Size 393KB
Sample240812-m3htcascmd
SHA256 9f7e4c52af1b8afcb06ca88cc726d1e4681b0f87683b04d175bb70be4363d345
MD5 8e7b76532c0bb541c727861f74a0b618
SHA1 ef0d327aa5969f8ad65ddb7f605d645e3270e64a
SHA512 0ccc658a6eb0e4a29e558ffaf800ec8c381621af057134c6b26a944c0fcf1e974a140f45305dedfd1933a3a8466a03fefede278f69bc8762cd56c28f9c28ba6e
SSDEEP 6144:e9zgMUl3ABcePxx3K0mh5eu00S4KtDXaXYc+VKT8jHnAqYhf2k8Zl6:ozgTfePvK0mzeu00S4KBaWje2W
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

8e7b76532c0bb541c727861f74a0b618_JaffaCakes118

.exe 393KB

8e7b76532c0bb541c727861f74a0b618_JaffaCakes118

IMPHASH 4cf481a5253e8a0125b5c4a9a0a95a5a
SHA256 9f7e4c52af1b8afcb06ca88cc726d1e4681b0f87683b04d175bb70be4363d345
MD5 8e7b76532c0bb541c727861f74a0b618
SHA1 ef0d327aa5969f8ad65ddb7f605d645e3270e64a
SHA512 0ccc658a6eb0e4a29e558ffaf800ec8c381621af057134c6b26a944c0fcf1e974a140f45305dedfd1933a3a8466a03fefede278f69bc8762cd56c28f9c28ba6e
SSDEEP 6144:e9zgMUl3ABcePxx3K0mh5eu00S4KtDXaXYc+VKT8jHnAqYhf2k8Zl6:ozgTfePvK0mzeu00S4KBaWje2W
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

c1:e9:16:4d:76:91:be:d6:81:37:cd:fb:8c:7d:da:d3:67:df:6d:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1187847176505,CN=Nordkod LLC,O=Nordkod LLC,L=Saint-Petersburg,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Chains

Aug 5, 2024

Minor OS version

Major OS version

Entry point

13872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Izidu\Desktop\2019\WindowsSDK7-Samples-master\WindowsSDK7-Samples-master\com\uac\elevationsample\x64\Release\ElevationSample.pdb

kernel32

LoadResource SizeofResource LocalFree FormatMessageW FindResourceA WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx VirtualAlloc GetProcessHeap LCMapStringW GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW ExitProcess CreateThread GetLastError CreateDirectoryW GetFullPathNameW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW GetModuleHandleExW HeapFree HeapAlloc GetFileType

user32

LoadAcceleratorsW SendMessageW LoadStringW GetMessageW TranslateMessage IsDialogMessageW LoadIconW LoadCursorW MessageBoxW MessageBoxA GetWindowRect GetWindowTextW SetWindowTextW EndPaint BeginPaint DispatchMessageW TranslateAcceleratorW UpdateWindow GetDlgItem CreateDialogParamW SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW

gdi32

CreateSolidBrush

comdlg32

GetOpenFileNameW

advapi32

CryptAcquireContextA

ole32

CoUninitialize CoInitializeEx CoCreateInstance StringFromGUID2 CoGetObject

oleaut32

SysAllocString SysFreeString

Name

.text

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

263KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8e7b76532c0bb541c727861f74a0b618_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

generic