9c4ca558532f3b2b9b86993f00efe285_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
9c4ca558532f3b2b9b86993f00efe285_JaffaCakes118
Size 7.3MB
Sample240816-a5jgfazdmk
SHA256 8036cf216d60a35496cdb83e2dcaf9a5dd64f3dc9e303a32dee0222d68e170f9
MD5 9c4ca558532f3b2b9b86993f00efe285
SHA1 d61244abe3d35bdc7abb2040a954fda9f41b4ea5
SHA512 2c1aefeb8e9543ab21b8603ef35826cbf6a704db0f78f031338968e37a74c210d34259179a4382b80882c8732a4f73de70e8f77a89d0853ea8108d74538ec024
SSDEEP 98304:QxC3ud6MOIvysi7CQKzo5qphIHVruP3WpF3UdE1hZHEdLF00I:7GQgMkhgJuP32+dmhZk/0L
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c4ca558532f3b2b9b86993f00efe285_JaffaCakes118

File Explorer

9c4ca558532f3b2b9b86993f00efe285_JaffaCakes118

.exe 7.3MB

9c4ca558532f3b2b9b86993f00efe285_JaffaCakes118

IMPHASH 7919c2f06f2b8d1d63b9af30c10fcfcc
SHA256 8036cf216d60a35496cdb83e2dcaf9a5dd64f3dc9e303a32dee0222d68e170f9
MD5 9c4ca558532f3b2b9b86993f00efe285
SHA1 d61244abe3d35bdc7abb2040a954fda9f41b4ea5
SHA512 2c1aefeb8e9543ab21b8603ef35826cbf6a704db0f78f031338968e37a74c210d34259179a4382b80882c8732a4f73de70e8f77a89d0853ea8108d74538ec024
SSDEEP 98304:QxC3ud6MOIvysi7CQKzo5qphIHVruP3WpF3UdE1hZHEdLF00I:7GQgMkhgJuP32+dmhZk/0L
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

952704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\B\T\BuildResults\bin\Release\AcroCEF\RdrCEF.pdb

kernel32

DuplicateHandle GetFileType SetHandleInformation RegisterWaitForSingleObject UnregisterWaitEx AssignProcessToJobObject WriteProcessMemory CreateFileMappingW MapViewOfFile VirtualFree GetProcessHandleCount GetProcessHeaps SignalObjectAndWait GetFileAttributesW QueryDosDeviceW GetLongPathNameW CreateFileW VirtualProtectEx ReadProcessMemory GetCurrentDirectoryW GetModuleFileNameW GetLocalTime OutputDebugStringA WriteFile FormatMessageA LoadLibraryExW LoadLibraryW FreeLibrary ReleaseSRWLockExclusive VirtualFreeEx CreateNamedPipeW CreateProcessW CreateRemoteThread CreateJobObjectW UnmapViewOfFile FindResourceW SizeofResource LoadResource LockResource CreateDirectoryW ReadFile TlsGetValue TryAcquireSRWLockExclusive AcquireSRWLockExclusive GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter QueryThreadCycleTime VirtualAlloc SetThreadPriority SearchPathW lstrlenW DebugBreak GetModuleHandleExW SetFilePointerEx GetFileSizeEx SetEndOfFile FlushFileBuffers FindClose FindNextFileW FindFirstFileExW SetUnhandledExceptionFilter RtlCaptureStackBackTrace TlsAlloc TlsFree TlsSetValue VirtualQuery WideCharToMultiByte K32QueryWorkingSetEx SwitchToThread QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation CreateTimerQueue FreeLibraryAndExitThread ExitThread GetExitCodeThread AreFileApisANSI GetWindowsDirectoryW DeviceIoControl GetEnvironmentVariableW TryEnterCriticalSection CreateEventA GetThreadId RaiseException IsDebuggerPresent Sleep ProcessIdToSessionId GetCurrentProcessId LocalFree GetNativeSystemInfo GetVersionExW GetTickCount EnumSystemLocalesEx GetUserDefaultLocaleName GetUserDefaultLCID GetUserDefaultLangID TerminateProcess GetCurrentThreadId SetInformationJobObject DeleteCriticalSection WaitForSingleObject PostQueuedCompletionStatus SetEvent TerminateJobObject LeaveCriticalSection EnterCriticalSection GetQueuedCompletionStatus ResetEvent SetLastError CreateThread CreateEventW CreateIoCompletionPort InitializeCriticalSection VirtualAllocEx VirtualQueryEx GetCurrentThread GetModuleHandleA HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy HeapCreate GetSystemInfo VerifyVersionInfoW SetDllDirectoryW GetProcAddress GetModuleHandleW GetCurrentProcess CreateMutexW ReleaseMutex HeapSetInformation GetProcessHeap GetLastError CloseHandle GetCommandLineW GetThreadPriority CancelIoEx DisconnectNamedPipe ConnectNamedPipe CancelSynchronousIo GetProcessTimes VerSetConditionMask SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage OutputDebugStringW GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW IsValidLocale GetTimeFormatW VirtualProtect LoadLibraryExA InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared FormatMessageW LocalAlloc TerminateThread CreateFileMappingA MapViewOfFileEx OpenFileMappingA ExitProcess MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetConsoleCP GetConsoleMode SetStdHandle GetStdHandle WriteConsoleW GetDateFormatW

user32

CloseDesktop CloseWindowStation GetSystemMetrics GetProcessWindowStation CreateWindowStationW GetThreadDesktop SetProcessWindowStation GetUserObjectInformationW CreateDesktopW

advapi32

GetUserNameW EventWrite EventUnregister EventRegister GetSidSubAuthorityCount SetEntriesInAclW GetSecurityInfo GetSidSubAuthority InitializeSid CreateWellKnownSid CopySid LookupPrivilegeValueW DuplicateToken CreateRestrictedToken RegQueryValueExW RegCreateKeyExW SetThreadToken GetTokenInformation CreateProcessAsUserW AccessCheck EqualSid IsValidSid GetNamedSecurityInfoW MapGenericMask ImpersonateLoggedOnUser FreeSid SystemFunction036 ConvertSidToStringSidW DuplicateTokenEx GetKernelObjectSecurity SetKernelObjectSecurity GetAce OpenProcessToken SetTokenInformation GetLengthSid ConvertStringSidToSidW SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW RegDisablePredefinedCache RevertToSelf SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegOpenKeyExA RegCloseKey RegOpenKeyA

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemFree

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

500KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9c4ca558532f3b2b9b86993f00efe285_JaffaCakes118

kernel32

user32

advapi32

shell32

ole32

generic