c03e7a834f3503acecf3c146f717c4b6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
c03e7a834f3503acecf3c146f717c4b6_JaffaCakes118
Size 1.0MB
Sample240825-ja322athkp
SHA256 1617242dd1cc9de8413f164290b97ee00095c7907f6cd117a18483a182cce628
MD5 c03e7a834f3503acecf3c146f717c4b6
SHA1 7fd6d92a555eb2425cacdc6739e04471415cb9ab
SHA512 c85a22cd8ad171b5abf373e2b3e9fd6541002edd0c18f8497ce5bbcb878ff71130b097aa77c8c9cf6fe6b03dd4b66d7510c74e929c16f17843a7834b217dd0b6
SSDEEP 24576:8v5+h7n8kErGb1u7SYXj2OgOVwlMhlD9MPj0zmo:8h+h7qrGb1uxjFwkDoASo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

c03e7a834f3503acecf3c146f717c4b6_JaffaCakes118

.exe 1.0MB

c03e7a834f3503acecf3c146f717c4b6_JaffaCakes118

IMPHASH 8b0ab078d74b94a4f744e2734973ee7c
SHA256 1617242dd1cc9de8413f164290b97ee00095c7907f6cd117a18483a182cce628
MD5 c03e7a834f3503acecf3c146f717c4b6
SHA1 7fd6d92a555eb2425cacdc6739e04471415cb9ab
SHA512 c85a22cd8ad171b5abf373e2b3e9fd6541002edd0c18f8497ce5bbcb878ff71130b097aa77c8c9cf6fe6b03dd4b66d7510c74e929c16f17843a7834b217dd0b6
SSDEEP 24576:8v5+h7n8kErGb1u7SYXj2OgOVwlMhlD9MPj0zmo:8h+h7qrGb1uxjFwkDoASo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

115614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

InitCommonControlsEx

kernel32

EnterCriticalSection GlobalFree GlobalUnlock GlobalLock FreeResource GlobalAlloc HeapAlloc GetProcessHeap GetTempPathW CreateThread InitializeCriticalSection GetTickCount ExitProcess CreateMutexW lstrcmpA GetTempFileNameW MoveFileExW TerminateThread SetEvent OutputDebugStringW CreateEventW RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrcmpiW FlushInstructionCache lstrcmpW MulDiv GetModuleFileNameW GetCurrentThreadId SetLastError LoadLibraryExW LocalAlloc InterlockedPopEntrySList VirtualFree InterlockedPushEntrySList InterlockedCompareExchange FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA HeapSize HeapReAlloc GetStringTypeW GetStdHandle HeapCreate LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsSetValue TlsGetValue TlsAlloc IsProcessorFeaturePresent GetStartupInfoW HeapSetInformation GetCommandLineA ExitThread VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect HeapFree RtlUnwind InterlockedExchange GetComputerNameW GetVolumeInformationW GetVersionExW CreateProcessW WaitForSingleObject GetExitCodeProcess lstrlenW lstrlenA GetModuleHandleW FindResourceW LoadResource LockResource SizeofResource SetFileTime CreateDirectoryW DosDateTimeToFileTime SystemTimeToFileTime GetCurrentProcess DuplicateHandle GetFileType LoadLibraryA SetFilePointer GetFileAttributesW MultiByteToWideChar WideCharToMultiByte InterlockedDecrement InterlockedIncrement ReadFile GetCurrentDirectoryW CreateFileW WriteFile DeleteFileW Sleep ExpandEnvironmentStringsW LoadLibraryW GetProcAddress LocalFree FreeLibrary GetLastError OpenProcess CloseHandle

user32

IsWindowVisible GetUpdateRect GetClassInfoExW PostThreadMessageW GetWindowThreadProcessId RegisterClassW CharNextW MoveWindow ClientToScreen UnregisterClassA FindWindowW wsprintfW GetWindowTextW SetActiveWindow SetForegroundWindow CreateWindowExW RegisterClassExW ScreenToClient GetDC InvalidateRgn SetCapture IsChild CallWindowProcW GetDesktopWindow DestroyAcceleratorTable GetWindow GetFocus CreateAcceleratorTableW ValidateRect SetTimer KillTimer PeekMessageW GetMonitorInfoW MonitorFromPoint GetClassNameW RegisterWindowMessageW CreateWindowExA GetCursorPos MapWindowPoints RedrawWindow FillRect GetWindowTextLengthW GetClientRect GetSysColor SetWindowPos IsWindow InvalidateRect SetWindowTextW GetMessageW TranslateMessage DispatchMessageW MessageBoxExW IsDialogMessageW GetWindowDC SetCursor PostQuitMessage SetDlgItemTextW CloseWindow GetDlgCtrlID IsWindowEnabled CopyRect PostMessageW SystemParametersInfoW MessageBoxW GetParent IsDlgButtonChecked SendMessageW BeginPaint ReleaseDC EndPaint CheckDlgButton EnableWindow LoadCursorW SetWindowLongW GetWindowLongW DefWindowProcW GetDlgItem SetFocus GetWindowRect BringWindowToTop ShowWindow DestroyWindow LoadIconW ReleaseCapture

gdi32

GetDeviceCaps CreateCompatibleBitmap SetTextAlign SetTextColor TextOutW GetTextExtentPoint32W GetStockObject CreateCompatibleDC DeleteDC SelectObject SetDIBColorTable GetObjectW GetDIBColorTable DeleteObject StretchBlt CreateDIBSection CreateSolidBrush SetBkColor BitBlt SetBkMode CreateFontIndirectW

advapi32

OpenProcessToken RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCreateKeyW CheckTokenMembership RegLoadKeyW RegQueryValueExW LookupAccountSidW RegUnLoadKeyW RegOpenKeyExW GetLengthSid CopySid GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid RegCloseKey

shell32

ShellExecuteW SHGetFolderPathW

ole32

OleUninitialize OleInitialize CLSIDFromString CLSIDFromProgID CoGetClassObject OleLockRunning StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateStreamOnHGlobal CoInitialize CoCreateInstance CoUninitialize

oleaut32

LoadTypeLi LoadRegTypeLi OleCreateFontIndirect VariantInit VarUI4FromStr SysAllocStringLen SysStringLen VariantClear SysAllocString SysFreeString

shlwapi

StrStrIW SHDeleteKeyW StrStrW StrStrA wnsprintfW ord176 PathFileExistsW

msimg32

AlphaBlend TransparentBlt

Sharing

General

Malware Config

Signatures

File Explorer

c03e7a834f3503acecf3c146f717c4b6_JaffaCakes118

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

msimg32

generic