d0cc9a5ec35365619ffdc1fc89f1750f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
d0cc9a5ec35365619ffdc1fc89f1750f_JaffaCakes118
Size 1.1MB
Sample240907-bwe84axhrl
SHA256 b97710861c37a16498f15085ab4c578b2d6b83a80249530b3a33b1edaeb13618
MD5 d0cc9a5ec35365619ffdc1fc89f1750f
SHA1 3893739b1b8b0818973a417b41d2601d71a69c95
SHA512 e1ce189b04913a0101a28d8269c6e36814223523d407b44ad86a2132c99b26572f127d335a795b6d3e583bc4179d927efc0f616be12974bcfca23f6fe28994b5
SSDEEP 6144:tUg69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6kI:699trKTX84bkQfUO/aQdeMo3e+k4jAC7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

d0cc9a5ec35365619ffdc1fc89f1750f_JaffaCakes118

.exe 1.1MB

d0cc9a5ec35365619ffdc1fc89f1750f_JaffaCakes118

IMPHASH 3bd7c16a16ad7d5b3966a30a82496732
SHA256 b97710861c37a16498f15085ab4c578b2d6b83a80249530b3a33b1edaeb13618
MD5 d0cc9a5ec35365619ffdc1fc89f1750f
SHA1 3893739b1b8b0818973a417b41d2601d71a69c95
SHA512 e1ce189b04913a0101a28d8269c6e36814223523d407b44ad86a2132c99b26572f127d335a795b6d3e583bc4179d927efc0f616be12974bcfca23f6fe28994b5
SSDEEP 6144:tUg69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6kI:699trKTX84bkQfUO/aQdeMo3e+k4jAC7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

e8:83:26:f0:04:80:1d:ff:aa:7b:55:95:f9:c7:b8:37:2d:9a:60:83

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DocsGen Software Solutions Inc.,OU=IT,O=DocsGen Software Solutions Inc.,POSTALCODE=M5H 3E5,STREET=250 University Ave,L=Toronto,ST=Ontario,C=CA

Chains

Sep 6, 2024

Minor OS version

Major OS version

Entry point

63906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress GetVersion LoadLibraryA VirtualAlloc VirtualFree VirtualProtect GetModuleHandleA lstrcmpA ReadConsoleInputExA GetCommModemStatus GetConsoleOutputCP SizeofResource RegisterConsoleIME DefineDosDeviceA GetConsoleAliasesW FillConsoleOutputCharacterW GetSystemDefaultLCID OpenThread GetCommState GetCurrentActCtx CancelDeviceWakeupRequest Heap32Next SetLastConsoleEventActive ReadFileEx EnumCalendarInfoA SetThreadLocale CopyFileExA OpenSemaphoreW SetProcessPriorityBoost

user32

GetWindowThreadProcessId UnhookWindowsHook DefMDIChildProcW SetMenuContextHelpId GetOpenClipboardWindow IsRectEmpty SendMessageTimeoutA EqualRect DrawTextW GetClipCursor GetDlgCtrlID PrivateExtractIconsA ClientToScreen EnumDisplayDevicesW CalcMenuBar LoadMenuA SendMessageW DlgDirSelectComboBoxExA RegisterClipboardFormatA NotifyWinEvent GetDlgItemTextW SetWindowPlacement OemToCharW UnregisterClassA LoadMenuIndirectA SetClassWord GetWindowModuleFileName FindWindowExW SetKeyboardState GetWindowTextW UpdateWindow GetMenuBarInfo GetAsyncKeyState SetWindowRgn GetPropA MessageBoxIndirectW BuildReasonArray DestroyReasons

comctl32

FlatSB_SetScrollPos CreateStatusWindowW UninitializeFlatSB FlatSB_GetScrollProp CreateStatusWindow DestroyPropertySheetPage DrawStatusTextW FlatSB_SetScrollInfo DSA_DeleteAllItems ImageList_GetImageCount DPA_GetPtr ImageList_SetBkColor ImageList_EndDrag ImageList_GetFlags DSA_Create CreatePropertySheetPageW ImageList_DragEnter ImageList_Draw InitCommonControls FlatSB_GetScrollPos DSA_InsertItem DPA_Destroy ImageList_SetFlags EnumMRUListW ImageList_Read ImageList_Copy _TrackMouseEvent ImageList_LoadImageA CreateStatusWindowA DPA_DeletePtr ImageList_Create ImageList_DrawEx MakeDragList DSA_GetItemPtr CreateUpDownControl FlatSB_SetScrollRange PropertySheetW

oleaut32

VarI4FromR4 VarCyFromUI4 OleLoadPictureFile VarUI2FromR4 VariantTimeToDosDateTime BSTR_UserUnmarshal DllRegisterServer VarI1FromUI2 DllCanUnloadNow VarDecFromBool VarUI4FromUI8 BSTR_UserFree VarI8FromBool VarCyFix VarI8FromCy VarUI8FromI2 VarI2FromDisp VarUI8FromUI4 BSTR_UserMarshal VarBstrFromI2 VarCat VarUI2FromStr VarI4FromI8 VarDecFromDate OleCreatePropertyFrame VarR4FromI4 GetErrorInfo OleLoadPictureFileEx VarR4FromDec VarDateFromStr

shlwapi

UrlUnescapeW SHRegisterValidateTemplate PathFindSuffixArrayA PathCreateFromUrlW StrChrNIW PathIsURLA PathStripPathA PathIsContentTypeA StrCmpIW PathIsSystemFolderW StrCpyNW SHRegGetPathA PathSetDlgItemPathA UrlEscapeW StrIsIntlEqualW SHDeleteEmptyKeyW StrStrNIW PathFindNextComponentA PathRemoveFileSpecA PathRemoveExtensionA PathAddExtensionA StrIsIntlEqualA wnsprintfW SHReleaseThreadRef SHRegDeleteEmptyUSKeyA SHRegSetUSValueA SHRegDeleteUSValueW PathCombineW PathCompactPathW SHRegWriteUSValueA AssocCreate PathCompactPathExA StrNCatA SHGetViewStatePropertyBag PathUnmakeSystemFolderA wvnsprintfW

winspool.drv

AddPortExW ScheduleJob CommitSpoolData GetPrinterDataExA DeleteMonitorW PlayGdiScriptOnPrinterIC ConvertUnicodeDevModeToAnsiDevmode AddFormA QuerySpoolMode DeletePrinter EnumPrintProcessorsW IsValidDevmodeA AdvancedDocumentPropertiesW AddPortExA GetPrinterA DeletePrinterDriverW EnumFormsW SpoolerPrinterEvent DeletePrinterDriverA GetPrinterW FindNextPrinterChangeNotification GetPrinterDriverA SetPrinterDataW SetFormA FindClosePrinterChangeNotification SetPrinterDataA PerfOpen ResetPrinterA ReadPrinter EnumJobsA AddPrinterDriverExW DeleteFormA ConfigurePortW SplDriverUnloadComplete

winmm

mmsystemGetVersion waveOutGetPlaybackRate mixerGetID midiInMessage PlaySoundA mciGetDeviceIDW wid32Message midiOutCacheDrumPatches waveOutGetPosition WOW32ResolveMultiMediaHandle mciGetDeviceIDFromElementIDA mixerSetControlDetails waveOutOpen joyGetDevCapsA waveOutPrepareHeader mmioRenameW mmDrvInstall joyReleaseCapture PlaySoundW sndPlaySoundW waveInGetErrorTextW midiOutGetDevCapsA WOWAppExit sndPlaySoundA midiInGetErrorTextA waveOutMessage mmTaskBlock midiOutCachePatches

imagehlp

ImageDirectoryEntryToDataEx ImageNtHeader SymEnumerateModules SymGetSymFromName GetTimestampForLoadedLibrary FindFileInPath SymGetOptions TouchFileTimes FindExecutableImage ImageGetCertificateHeader ImageDirectoryEntryToData SymGetModuleBase64 MapFileAndCheckSumA RemovePrivateCvSymbolic SymEnumerateSymbolsW SymGetTypeInfo ImageGetCertificateData ImageAddCertificate SymFunctionTableAccess SymGetSymNext CheckSumMappedFile ImageEnumerateCertificates SymRegisterCallback64 SplitSymbols BindImageEx SymGetModuleInfoW SymFindFileInPath SymEnumerateSymbolsW64 MapDebugInformation ReBaseImage64 ImageLoad

advapi32

RegQueryValueExW BuildTrusteeWithSidA SystemFunction010 LsaCreateSecret DecryptFileA CryptGetDefaultProviderW GetMultipleTrusteeOperationW LsaAddAccountRights LsaICLookupSids LsaSetSystemAccessAccount WmiOpenBlock CryptEnumProviderTypesA NotifyBootConfigStatus RegCreateKeyA RegEnumValueW AddAccessAllowedObjectAce SystemFunction024 SaferiCompareTokenLevels AccessCheckByTypeAndAuditAlarmW CommandLineFromMsiDescriptor ImpersonateLoggedOnUser SystemFunction040 UnregisterTraceGuids FindFirstFreeAce A_SHAFinal CryptSetProviderA LogonUserA LookupPrivilegeDisplayNameW CryptHashData RegSaveKeyA A_SHAInit InstallApplication AdjustTokenGroups GetSecurityInfo FreeEncryptedFileKeyInfo

Sharing

General

Malware Config

Signatures

File Explorer

d0cc9a5ec35365619ffdc1fc89f1750f_JaffaCakes118

PE Signature issue

kernel32

user32

comctl32

oleaut32

shlwapi

winspool.drv

winmm

imagehlp

advapi32

generic