d405372467a08b85f9ca7fdf8c5d5863_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
d405372467a08b85f9ca7fdf8c5d5863_JaffaCakes118
Size 415KB
Sample240908-k848esxerr
SHA256 6c6ef6dde76387417db441b67e60d2b0a4bb37888f2faad751da11793abd017e
MD5 d405372467a08b85f9ca7fdf8c5d5863
SHA1 a67d2ea2a7b89c383635f82bfc3b18466e788968
SHA512 fbc35621c1910ef60ce19ff5f85bfc6ab2471645d2c36e730df316ea9a7be16dc32642c9105d43d33e90cec12608d962889402b66338b2187f58be4870d78964
SSDEEP 12288:+rSyKsinPgBBa8x2T8xzw8VRTdRoMWYokReWEUfNEn:+rSyKsinPgu8jheMWTQTE+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d405372467a08b85f9ca7fdf8c5d5863_JaffaCakes118

File Explorer

d405372467a08b85f9ca7fdf8c5d5863_JaffaCakes118

.exe 415KB

d405372467a08b85f9ca7fdf8c5d5863_JaffaCakes118

IMPHASH 58e185299ecca757fe68ba83a6495fde
SHA256 6c6ef6dde76387417db441b67e60d2b0a4bb37888f2faad751da11793abd017e
MD5 d405372467a08b85f9ca7fdf8c5d5863
SHA1 a67d2ea2a7b89c383635f82bfc3b18466e788968
SHA512 fbc35621c1910ef60ce19ff5f85bfc6ab2471645d2c36e730df316ea9a7be16dc32642c9105d43d33e90cec12608d962889402b66338b2187f58be4870d78964
SSDEEP 12288:+rSyKsinPgBBa8x2T8xzw8VRTdRoMWYokReWEUfNEn:+rSyKsinPgu8jheMWTQTE+
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

msvcrt

__wgetmainargs _exit _XcptFilter exit _initterm _amsg_exit __setusermatherr memcpy _controlfp _except_handler4_common ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode _cexit

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetCurrentProcess OpenProcessToken GetCurrentProcessId GetCurrentThreadId

kernel32

LocalAlloc CloseHandle DelayLoadFailureHook GetProcAddress GetLastError FreeLibrary InterlockedCompareExchange LoadLibraryExA InterlockedExchange Sleep SetUnhandledExceptionFilter GetModuleHandleA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime UnhandledExceptionFilter DeactivateActCtx LoadLibraryExW ActivateActCtx LeaveCriticalSection lstrcmpW EnterCriticalSection RegCloseKey RegOpenKeyExW HeapSetInformation lstrcmpiW lstrlenW LCMapStringW RegQueryValueExW ReleaseActCtx CreateActCtxW ExpandEnvironmentStringsW GetCommandLineW ExitProcess SetProcessAffinityUpdateMode RegDisablePredefinedCacheEx InitializeCriticalSection GetProcessHeap SetErrorMode RegisterWaitForSingleObjectEx LocalFree HeapFree WideCharToMultiByte HeapAlloc

ntdll

RtlAllocateHeap RtlLengthRequiredSid RtlSubAuthoritySid RtlInitializeSid RtlCopySid RtlSubAuthorityCountSid RtlInitializeCriticalSection RtlSetProcessIsCritical RtlImageNtHeader RtlUnhandledExceptionFilter EtwEventWrite EtwEventEnabled EtwEventRegister RtlFreeHeap

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl AddAccessAllowedAce SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetTokenInformation InitializeSecurityDescriptor GetLengthSid InitializeAcl

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

rpcrt4

RpcMgmtSetServerStackSize I_RpcMapWin32Status RpcServerUnregisterIf RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcServerUnregisterIfEx RpcServerRegisterIf RpcServerUseProtseqEpW RpcServerListen

Sharing

General

Malware Config

Signatures

File Explorer

d405372467a08b85f9ca7fdf8c5d5863_JaffaCakes118

msvcrt

api-ms-win-core-processthreads-l1-1-0

kernel32

ntdll

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

rpcrt4

generic