ca751d2be8e93a84ec6815635b90b5d4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ca751d2be8e93a84ec6815635b90b5d4_JaffaCakes118
Size 19.5MB
Sample240830-jv136stdlg
SHA256 329666ffd3da4182c522530d196d15498ca39801d2c662a26b583eb2b09fd66e
MD5 ca751d2be8e93a84ec6815635b90b5d4
SHA1 78ed09e36cf43c3a1adc52cc7f4e0862885415eb
SHA512 a59a5b9f2f073b14a84ab6353a0d205d2353b2a32b722dec84a2db10d65b5c51b4669d1b32c6e825eb705a3878c3643e82bb3b6a4fd5a95f5225cf85b120231f
SSDEEP 393216:tlHZI2hMQdB7H/hUfaCVjTPEtOSNVW8ImMyX5/4BaPBr7rt2Rq:D1M4B7CC2AtjXImNXZ4c5kRq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca751d2be8e93a84ec6815635b90b5d4_JaffaCakes118

File Explorer

ca751d2be8e93a84ec6815635b90b5d4_JaffaCakes118

.exe 19.5MB

ca751d2be8e93a84ec6815635b90b5d4_JaffaCakes118

IMPHASH 3a657d7068d4af97f8db971ae034da0d
SHA256 329666ffd3da4182c522530d196d15498ca39801d2c662a26b583eb2b09fd66e
MD5 ca751d2be8e93a84ec6815635b90b5d4
SHA1 78ed09e36cf43c3a1adc52cc7f4e0862885415eb
SHA512 a59a5b9f2f073b14a84ab6353a0d205d2353b2a32b722dec84a2db10d65b5c51b4669d1b32c6e825eb705a3878c3643e82bb3b6a4fd5a95f5225cf85b120231f
SSDEEP 393216:tlHZI2hMQdB7H/hUfaCVjTPEtOSNVW8ImMyX5/4BaPBr7rt2Rq:D1M4B7CC2AtjXImNXZ4c5kRq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

113440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\B\T\BuildResults\bin\Release\WebInstaller\RdrServicesUpdater.pdb

kernel32

HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar WideCharToMultiByte GetFullPathNameW WaitForSingleObject GetCurrentProcessId ProcessIdToSessionId HeapAlloc GetWindowsDirectoryW lstrcpyW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW DeleteFileW RemoveDirectoryW FindResourceA CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW SetFileAttributesW SetFileTime InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW HeapDestroy RaiseException GetLastError WriteFile SetFilePointer ReadFile CreateFileW GetCurrentProcess OpenProcess CloseHandle IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringW

user32

PostMessageW RegisterWindowMessageW

advapi32

SystemFunction036 RegDeleteTreeW RegSetValueExW RegCreateKeyExW CreateProcessWithTokenW GetTokenInformation EqualSid DuplicateTokenEx AllocateAndInitializeSid CreateProcessAsUserW RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken

shell32

CommandLineToArgvW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ??Bid@locale@std@@QAEIXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z

shlwapi

PathFileExistsW PathCombineW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

vcruntime140

__current_exception_context __current_exception memcmp _except_handler4_common memmove __std_terminate __CxxFrameHandler3 memset _CxxThrowException memcpy wcsstr __std_exception_copy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _errno _controlfp_s terminate _register_thread_local_exe_atexit_callback _c_exit _exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type exit _get_narrow_winmain_command_line _initterm _initterm_e

api-ms-win-crt-stdio-l1-1-0

fwrite _set_fmode _ftelli64 ftell fsetpos fread __p__commode fputc fseek fopen fgetpos fgetc _fseeki64 fflush fclose _get_stream_buffer_pointers ferror _wfopen setvbuf ungetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file _wchdir

api-ms-win-crt-string-l1-1-0

_wcsicmp wcsnlen wcscat_s isspace isxdigit isdigit strlen wcsncpy _wcslwr_s wmemcpy_s wcscpy_s

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

_wgetcwd

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

ca751d2be8e93a84ec6815635b90b5d4_JaffaCakes118

kernel32

user32

advapi32

shell32

msvcp140

shlwapi

wtsapi32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic