b8bf1432efd384b71444740ba6001702_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
b8bf1432efd384b71444740ba6001702_JaffaCakes118
Size 36KB
Sample240822-xj16paveml
SHA256 3ac4ebb408e7d676fa0260303c0a4dab54dca55a23a4b603999e9676a777209f
MD5 b8bf1432efd384b71444740ba6001702
SHA1 d9114a996c6bdb53c651640fe680ae42c3035afc
SHA512 6e65b32690e07d4d0f23bd66697fb8c537ee5c0e4d51711e6d4ea05b4f99d59505ca0e0ab556f026629f3dd2bc9021e3dbfe2b8592a9705a7c909a24d26c5c5b
SSDEEP 768:KWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6603:R1lkwK3O4aW7MzSzLvKOhTR+6F
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8bf1432efd384b71444740ba6001702_JaffaCakes118

File Explorer

b8bf1432efd384b71444740ba6001702_JaffaCakes118

.dll 36KB

b8bf1432efd384b71444740ba6001702_JaffaCakes118

IMPHASH b38f61c08feb2027cf7e88bb89ab54dd
SHA256 3ac4ebb408e7d676fa0260303c0a4dab54dca55a23a4b603999e9676a777209f
MD5 b8bf1432efd384b71444740ba6001702
SHA1 d9114a996c6bdb53c651640fe680ae42c3035afc
SHA512 6e65b32690e07d4d0f23bd66697fb8c537ee5c0e4d51711e6d4ea05b4f99d59505ca0e0ab556f026629f3dd2bc9021e3dbfe2b8592a9705a7c909a24d26c5c5b
SSDEEP 768:KWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6603:R1lkwK3O4aW7MzSzLvKOhTR+6F
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteFileA MultiByteToWideChar GetSystemDirectoryA WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetTempPathA GetWindowsDirectoryA GlobalLock SetFileAttributesA GetCommandLineA CreateFileA WriteFile GlobalUnlock GlobalFree LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect CreateThread CloseHandle IsBadReadPtr GetCurrentDirectoryA GetPrivateProfileStringA Sleep GetModuleFileNameA WinExec ExitProcess

user32

GetParent GetWindowThreadProcessId ReleaseDC EnumWindows wsprintfA GetWindowTextA GetWindowRect GetDC GetDesktopWindow GetClientRect CallWindowProcA GetClassNameA SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA

gdi32

CreateDCA GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC

gdiplus

GdipCloneImage GdipAlloc GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipDisposeImage GdiplusShutdown GdipLoadImageFromFile GdipSaveImageToFile

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

wininet

InternetOpenA InternetReadFile InternetOpenUrlA InternetCloseHandle

msvcrt

_access strrchr strncpy abs malloc wcscmp free __dllonexit _initterm _adjust_fdiv _getpid _itoa _stricmp _strlwr _strrev _onexit ??2@YAPAXI@Z memcpy __CxxFrameHandler strcmp memcmp memset strchr atoi sprintf strlen strstr strcpy strcat

netapi32

Netbios

Sharing

General

Malware Config

Signatures

File Explorer

b8bf1432efd384b71444740ba6001702_JaffaCakes118

kernel32

user32

gdi32

gdiplus

msvcp60

ws2_32

wininet

msvcrt

netapi32

generic