c0407970a7ea2f6aad3b0f1b5e0da740_JaffaCakes118

General

Target
c0407970a7ea2f6aad3b0f1b5e0da740_JaffaCakes118
Size 249KB
Sample240825-jerjssvanp
SHA256 d90d607753d64da9f29607d7dadee078c5cf658fde84ef7aa09f1b3f4b31c3bf
MD5 c0407970a7ea2f6aad3b0f1b5e0da740
SHA1 d254bd31365c2f5cf9e132fefda3a7c8e308a94a
SHA512 e3820ad3e23fac9d9f4111f7922327d149e8e0f4e66cd5b8184f9f88c7b5184b2bbd977aede373a9702ff1f805057a987e90def5a9eeaecb4b2a40c86e350e19
SSDEEP 3072:VKGfSgUBJN9hbcVfYVgDysJUaKY74w1TDn09HBTZz2lA/CLOskn4r5x:EGagc/rYHDyOU5YMCXnk8A/CLOsknQ5x
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0407970a7ea2f6aad3b0f1b5e0da740_JaffaCakes118

File Explorer

c0407970a7ea2f6aad3b0f1b5e0da740_JaffaCakes118

.exe 249KB

c0407970a7ea2f6aad3b0f1b5e0da740_JaffaCakes118

IMPHASH 6063bc03b4e0ee4ea6eefa565926a67d
SHA256 d90d607753d64da9f29607d7dadee078c5cf658fde84ef7aa09f1b3f4b31c3bf
MD5 c0407970a7ea2f6aad3b0f1b5e0da740
SHA1 d254bd31365c2f5cf9e132fefda3a7c8e308a94a
SHA512 e3820ad3e23fac9d9f4111f7922327d149e8e0f4e66cd5b8184f9f88c7b5184b2bbd977aede373a9702ff1f805057a987e90def5a9eeaecb4b2a40c86e350e19
SSDEEP 3072:VKGfSgUBJN9hbcVfYVgDysJUaKY74w1TDn09HBTZz2lA/CLOskn4r5x:EGagc/rYHDyOU5YMCXnk8A/CLOsknQ5x
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

96033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceExW FindResourceW LoadResource CreateProcessW LoadLibraryW Sleep SizeofResource GetStartupInfoW GetTempPathW GetProcAddress LockResource CloseHandle GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange InterlockedExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetCurrentProcessId

user32

LoadStringW

msvcp90

?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z ?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ ?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ ?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ ?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ ??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z ?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ ?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ ?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z ?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z ?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z ?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z ?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z ?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z ?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z ?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z ?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ ??0?$_String_val@_WV?$allocator@_W@std@@@std@@IAE@V?$allocator@_W@1@@Z ??0?$allocator@_W@std@@QAE@XZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z

msvcr90

free _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _except_handler4_common _unlock __dllonexit _lock _onexit _decode_pointer _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson _controlfp_s ??2@YAPAXI@Z _time64 memcpy_s _itow srand rand memset wcsstr _invalid_parameter_noinfo wcslen strlen _wtoi ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABQBD@Z ??0exception@std@@QAE@XZ ?what@exception@std@@UBEPBDXZ sprintf memmove_s memcpy ??3@YAXPAX@Z _recalloc __CxxFrameHandler3 ??1exception@std@@UAE@XZ _CxxThrowException

Sharing

General

Malware Config

Signatures

File Explorer

c0407970a7ea2f6aad3b0f1b5e0da740_JaffaCakes118

kernel32

user32

msvcp90

msvcr90

generic