8ee601b4303dc702a0ee92e9286360a4_JaffaCakes118

General

Target
8ee601b4303dc702a0ee92e9286360a4_JaffaCakes118
Size 140KB
Sample240812-qpre4sxcja
SHA256 945c83f89a6f6e1e6666eb08e01858f6d5afe0adfe9123af8632bbabca363f4a
MD5 8ee601b4303dc702a0ee92e9286360a4
SHA1 a79f17604e4b14668cefca1176d18f1e715bfa7d
SHA512 631bffe987474619f48b7383e3efd487b017b37784441b132902e94a7bab3bbce7e56ea968151434a9b832640dff860a447a3bdcebe562bc603600fa98aca248
SSDEEP 3072:Xf7sCpC/cIZOzU5k156/GR1ahkLfEe7Ke77CyqY8Xb8Y+o/:gCp5IZOzjAksyfEQp1Yn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ee601b4303dc702a0ee92e9286360a4_JaffaCakes118

File Explorer

8ee601b4303dc702a0ee92e9286360a4_JaffaCakes118

.exe 140KB

8ee601b4303dc702a0ee92e9286360a4_JaffaCakes118

IMPHASH 6f5b837b646e95bb85fce407952b8858
SHA256 945c83f89a6f6e1e6666eb08e01858f6d5afe0adfe9123af8632bbabca363f4a
MD5 8ee601b4303dc702a0ee92e9286360a4
SHA1 a79f17604e4b14668cefca1176d18f1e715bfa7d
SHA512 631bffe987474619f48b7383e3efd487b017b37784441b132902e94a7bab3bbce7e56ea968151434a9b832640dff860a447a3bdcebe562bc603600fa98aca248
SSDEEP 3072:Xf7sCpC/cIZOzU5k156/GR1ahkLfEe7Ke77CyqY8Xb8Y+o/:gCp5IZOzjAksyfEQp1Yn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalFree FormatMessageW GetPrivateProfileStringW GetVersion InterlockedExchange GetACP GetLocaleInfoA GetVersionExW WaitForSingleObject OutputDebugStringW GetPrivateProfileIntW WritePrivateProfileStructW WritePrivateProfileStringW IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA CloseHandle GetModuleFileNameW GetCurrentProcess GetLastError GlobalAlloc GlobalFree FlushFileBuffers SetStdHandle GetPrivateProfileStructW GetStartupInfoW SetFilePointer GetCPInfo LoadLibraryA IsBadWritePtr SetUnhandledExceptionFilter HeapSize HeapReAlloc LCMapStringW WideCharToMultiByte GetModuleHandleA GetOEMCP GetVersionExA ExitProcess RtlUnwind RaiseException HeapAlloc GetProcAddress TerminateProcess WriteFile GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery LCMapStringA

advapi32

RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid

shlwapi

PathFileExistsW PathAddBackslashW PathRemoveFileSpecW PathRemoveBackslashW

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

268B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8ee601b4303dc702a0ee92e9286360a4_JaffaCakes118

kernel32

advapi32

shlwapi

generic