ba5d13d64133ff19ab43207d23f467c3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ba5d13d64133ff19ab43207d23f467c3_JaffaCakes118
Size 208KB
Sample240823-e35zwaxfpr
SHA256 ca28945917b92e552b7c7bacb6421bce34285f4bab5290ce14637d84ca5621e8
MD5 ba5d13d64133ff19ab43207d23f467c3
SHA1 449e77998a825d543995e138e10aa665381d97d3
SHA512 fb33e5ae73a642346d889271fc0fe3f90b5292a6792a4afd00dee7d5a11401bc0af20ce55b3552cac72bb4304929997de627aabdbdcc23b16826da31a052db9f
SSDEEP 6144:rWiT6BtfdcAXdK7Mp4Ik29CesuqVfDcT56BfL:rv6BxdcD7MpBJC/uqVuQp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba5d13d64133ff19ab43207d23f467c3_JaffaCakes118

File Explorer

ba5d13d64133ff19ab43207d23f467c3_JaffaCakes118

.dll 208KB

ba5d13d64133ff19ab43207d23f467c3_JaffaCakes118

IMPHASH f037fd858ffb9634d3f2f85667a3c6dd
SHA256 ca28945917b92e552b7c7bacb6421bce34285f4bab5290ce14637d84ca5621e8
MD5 ba5d13d64133ff19ab43207d23f467c3
SHA1 449e77998a825d543995e138e10aa665381d97d3
SHA512 fb33e5ae73a642346d889271fc0fe3f90b5292a6792a4afd00dee7d5a11401bc0af20ce55b3552cac72bb4304929997de627aabdbdcc23b16826da31a052db9f
SSDEEP 6144:rWiT6BtfdcAXdK7Mp4Ik29CesuqVfDcT56BfL:rv6BxdcD7MpBJC/uqVuQp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\baseWatch\timeDegree\Nameforest\Generalsimilar\home.pdb

advapi32

OpenProcessToken GetTokenInformation AdjustTokenPrivileges AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupPrivilegeValueA RegCloseKey RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA CloseServiceHandle ControlService CreateServiceA DeleteService RegisterServiceCtrlHandlerA SetServiceStatus StartServiceCtrlDispatcherA SetEntriesInAclA

kernel32

SetEndOfFile HeapReAlloc HeapSize GetStringTypeW CreateFileW GetConsoleCP WriteFile FlushFileBuffers SetStdHandle GetProcessHeap IsBadReadPtr FindNextFileA FindFirstFileA RemoveDirectoryA ExitProcess GetWindowsDirectoryA GetModuleFileNameA LoadLibraryA CreateSemaphoreA WriteConsoleW LCMapStringW CreateEventA FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapAlloc ReadConsoleW GetConsoleMode SetFilePointerEx GetFileSizeEx GetFileType GetStdHandle CloseHandle HeapFree GetModuleFileNameW GetModuleHandleExW ReadFile DecodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError GetLastError TlsGetValue TlsAlloc MulDiv FindClose Sleep VirtualProtect LocalFree LocalAlloc GlobalFree GlobalUnlock GlobalAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind InterlockedFlushSList

user32

FrameRect SetWindowsHookExA WindowFromPoint LoadIconA GetWindowTextLengthA ReleaseCapture CloseClipboard OffsetRect SystemParametersInfoA RegisterClassExA ClientToScreen EndDialog GetMessageA

gdi32

SelectObject MoveToEx StretchBlt SetPixel SetBkMode PatBlt LineTo GetTextExtentPoint32A ExcludeClipRect

ole32

OleInitialize CoInitialize OleUninitialize CoUninitialize CoCreateInstance

ws2_32

recvfrom WSACleanup WSAStartup getprotobynumber socket htonl htons recv getservbyname send setsockopt

wininet

HttpOpenRequestA FtpOpenFileA InternetSetOptionA InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA HttpSendRequestA HttpAddRequestHeadersA

shlwapi

PathFindFileNameA PathQuoteSpacesA PathIsFileSpecA

winspool.drv

DocumentPropertiesA GetPrinterA EnumPrintersA OpenPrinterA ClosePrinter GetPrinterDataA

winmm

mciSendCommandA timeEndPeriod timeBeginPeriod PlaySoundA mciGetErrorStringA

comdlg32

CommDlgExtendedError ChooseFontA FindTextA GetSaveFileNameA GetOpenFileNameA

comctl32

ImageList_EndDrag ImageList_GetIcon ImageList_GetBkColor ImageList_GetImageCount ImageList_Create ImageList_GetDragImage

Sharing

General

Malware Config

Signatures

File Explorer

ba5d13d64133ff19ab43207d23f467c3_JaffaCakes118

advapi32

kernel32

user32

gdi32

ole32

ws2_32

wininet

shlwapi

winspool.drv

winmm

comdlg32

comctl32

generic