969025666604547189cfe0d5cc7d2e75_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
969025666604547189cfe0d5cc7d2e75_JaffaCakes118
Size 816KB
Sample240814-sbvaystbmp
SHA256 daa50d4b22e2529b007e0e72ee3eaea5da7dfe9b8468ca807b9565fd23a71b59
MD5 969025666604547189cfe0d5cc7d2e75
SHA1 b1a3a0236f98bbc9669540111894a04c24b159bb
SHA512 a0f0392531cad71df15a7ef7aafd39c21d655b13be18a782b370b130b6c3c6975ae54518addfcba8ddbaa3d56cc1e357b3b7fa5e5f8a9029b5a22d52d8350437
SSDEEP 24576:AJW2KjJ4Td3kJnbsPhnzq6DiysFuB1mprks:AInJ4Td3mbsPhne6rur
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
969025666604547189cfe0d5cc7d2e75_JaffaCakes118

File Explorer

969025666604547189cfe0d5cc7d2e75_JaffaCakes118

.exe 816KB

969025666604547189cfe0d5cc7d2e75_JaffaCakes118

IMPHASH d1a922c94a1f407cb2bbcad033c8ed7a
SHA256 daa50d4b22e2529b007e0e72ee3eaea5da7dfe9b8468ca807b9565fd23a71b59
MD5 969025666604547189cfe0d5cc7d2e75
SHA1 b1a3a0236f98bbc9669540111894a04c24b159bb
SHA512 a0f0392531cad71df15a7ef7aafd39c21d655b13be18a782b370b130b6c3c6975ae54518addfcba8ddbaa3d56cc1e357b3b7fa5e5f8a9029b5a22d52d8350437
SSDEEP 24576:AJW2KjJ4Td3kJnbsPhnzq6DiysFuB1mprks:AInJ4Td3mbsPhne6rur
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

powershell.pdb

msvcrt

?terminate@@YAXXZ _onexit __dllonexit _unlock _lock ??1type_info@@UAE@XZ _initterm _controlfp _except_handler4_common _vsnwprintf _wcsicmp _wcsnicmp bsearch memcpy _wfopen _itow_s wcstoul ??0exception@@QAE@ABQBD@Z wcschr memmove_s __uncaught_exception __setusermatherr __p__fmode _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit __p__commode _XcptFilter _CxxThrowException _callnewh ?what@exception@@UBEPBDXZ ??1exception@@UAE@XZ ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ malloc wcsncmp wcsrchr free _purecall memcpy_s __CxxFrameHandler3 fclose memcmp memset

atl

ord30

kernel32

GetModuleFileNameW GetModuleHandleExW LoadLibraryExW MapViewOfFile CreateFileMappingW FreeLibrary LoadResource FindResourceExW UnmapViewOfFile GetVersionExW GetProcAddress GetUserDefaultUILanguage GetSystemDefaultUILanguage SearchPathW SetErrorMode VerifyVersionInfoW GetTickCount GetSystemTimeAsFileTime EnterCriticalSection GetCurrentProcessId QueryPerformanceCounter TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW GetStartupInfoW SleepConditionVariableSRW FindFirstFileW LeaveCriticalSection CompareStringW SetConsoleTitleW SetLastError VerSetConditionMask GetCurrentProcess GetStdHandle WriteFile WakeAllConditionVariable ExpandEnvironmentStringsW LocalFree WriteConsoleW AcquireSRWLockExclusive SetThreadUILanguage GetCurrentThreadId GetModuleHandleW FindClose CreateFileW GetFileAttributesW FormatMessageW ReleaseSRWLockExclusive Sleep GetLastError CloseHandle IsWow64Process GetFileType

oleaut32

VariantClear SysFreeString SysAllocString SafeArrayPutElement SysStringLen SafeArrayCreate

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW RegGetValueW RegEnumKeyExW

ole32

CoInitializeEx PropVariantClear CoInitialize CoTaskMemAlloc CoUninitialize CoCreateInstance

user32

LoadStringW

mscoree

CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

969025666604547189cfe0d5cc7d2e75_JaffaCakes118

msvcrt

atl

kernel32

oleaut32

advapi32

ole32

user32

mscoree

generic