urelas | c1d85dd702d718baa948e78bbcd62956_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
c1d85dd702d718baa948e78bbcd62956_JaffaCakes118
Size 136KB
Sample240825-3tn7rssdkd
SHA256 5e1517f12ca9f582a7fc5560c606f3eec5506751a85ed46171372d5fd4662358
MD5 c1d85dd702d718baa948e78bbcd62956
SHA1 db75a5721b69b398b3b8d296a4ccf84d6ff7b7d1
SHA512 8246fe097011976f113577603e3d7ba0249c201d7b412872062ebde156e80f965c51c83e1a8b6ece16df161a671a2383449f205bdd8c06f700ea420e3b33f617
SSDEEP 1536:P/oEkqfCZ10zcT9Yh8AIXcjyz9cOXfiXGImcatMrsWjcdf6odgR5APfIR:P/5kqCxiXEcO3XfGf2tMUf6odgR5A4R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1d85dd702d718baa948e78bbcd62956_JaffaCakes118

File Explorer

c1d85dd702d718baa948e78bbcd62956_JaffaCakes118

.exe 136KB

c1d85dd702d718baa948e78bbcd62956_JaffaCakes118

IMPHASH d0a02458b96b0a6cde3068c96d1cdba2
SHA256 5e1517f12ca9f582a7fc5560c606f3eec5506751a85ed46171372d5fd4662358
MD5 c1d85dd702d718baa948e78bbcd62956
SHA1 db75a5721b69b398b3b8d296a4ccf84d6ff7b7d1
SHA512 8246fe097011976f113577603e3d7ba0249c201d7b412872062ebde156e80f965c51c83e1a8b6ece16df161a671a2383449f205bdd8c06f700ea420e3b33f617
SSDEEP 1536:P/oEkqfCZ10zcT9Yh8AIXcjyz9cOXfiXGImcatMrsWjcdf6odgR5APfIR:P/5kqCxiXEcO3XfGf2tMUf6odgR5A4R
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21039

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathW GetSystemDirectoryW DeleteFileW GetModuleFileNameW GetTickCount GetVersionExW ReadFile CreateFileW DeviceIoControl GetTempPathA GetModuleFileNameA HeapAlloc GetProcessHeap HeapFree MultiByteToWideChar SetEndOfFile HeapReAlloc LCMapStringW CreateThread LoadLibraryW OutputDebugStringW LoadLibraryExW WriteConsoleW FlushFileBuffers SetStdHandle CreateEventW ExitProcess CloseHandle Sleep OpenEventW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage RaiseException SetFilePointerEx SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter DeleteCriticalSection GetFileType GetFileAttributesW GetSystemWindowsDirectoryW IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineW GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection RtlUnwind GetConsoleMode ReadConsoleW WriteFile WideCharToMultiByte GetConsoleCP InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetModuleHandleExW AreFileApisANSI GetStdHandle HeapSize

user32

LoadAcceleratorsW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW LoadStringW wsprintfW LoadIconW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersAddresses