bd8d12dcc31a003ee9169088061dfea8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
bd8d12dcc31a003ee9169088061dfea8_JaffaCakes118
Size 153KB
Sample240823-3cf5tsshpf
SHA256 8e7b8582e8b53563ec38888812b143e38e7c84316691e35614a441ffbf3e7540
MD5 bd8d12dcc31a003ee9169088061dfea8
SHA1 636dfcdf7a48d84241be6bb463711a6931eebed3
SHA512 6402e08fb22027df5d7c84ed55dbb1cd648d68c730ae12b355db10a9e25adc4b9e0e14ea88e7182f0b3d2aece65f3d19c1fa894b8667507298c573084c760122
SSDEEP 3072:vlhTufPd5UeZI+46kernNhbvB7qmv5Y+jGIAhpvRG:vlMfPTemrXbJ7qI5Y9J5R
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd8d12dcc31a003ee9169088061dfea8_JaffaCakes118

File Explorer

bd8d12dcc31a003ee9169088061dfea8_JaffaCakes118

.exe 153KB

bd8d12dcc31a003ee9169088061dfea8_JaffaCakes118

IMPHASH bdb98856b649aba6449ad8fab0e7e4b0
SHA256 8e7b8582e8b53563ec38888812b143e38e7c84316691e35614a441ffbf3e7540
MD5 bd8d12dcc31a003ee9169088061dfea8
SHA1 636dfcdf7a48d84241be6bb463711a6931eebed3
SHA512 6402e08fb22027df5d7c84ed55dbb1cd648d68c730ae12b355db10a9e25adc4b9e0e14ea88e7182f0b3d2aece65f3d19c1fa894b8667507298c573084c760122
SSDEEP 3072:vlhTufPd5UeZI+46kernNhbvB7qmv5Y+jGIAhpvRG:vlMfPTemrXbJ7qI5Y9J5R
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalAlloc GetProcessAffinityMask SetProcessAffinityMask GetProcessIoCounters SetProcessWorkingSetSize GetCurrentProcessId TerminateProcess GetLastError CloseHandle DuplicateHandle SetHandleInformation CompareFileTime lstrcpyA lstrcpyW GlobalMemoryStatus GetTempPathA GetCPInfo WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW OutputDebugStringW HeapReAlloc GetOEMCP GetACP IsValidCodePage LoadLibraryW GetProcAddress LoadLibraryExW LeaveCriticalSection EnterCriticalSection EncodePointer DecodePointer IsProcessorFeaturePresent RaiseException RtlUnwind GetCommandLineA HeapAlloc HeapFree ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte HeapSize IsDebuggerPresent SetLastError GetCurrentThreadId GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA WriteFile GetModuleFileNameW QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LCMapStringW CreateFileW

user32

BeginPaint EndPaint ReleaseDC GetDC PostMessageW CopyImage LoadImageW DestroyIcon GetPropW SetPropA ShowScrollBar

gdi32

GetMapMode

shell32

ShellExecuteW

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpWriteData WinHttpQueryOption WinHttpCreateUrl

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

63KB

Virtual Size

348KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mysec

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bd8d12dcc31a003ee9169088061dfea8_JaffaCakes118

kernel32

user32

gdi32

shell32

winhttp

generic