sakula | d795d73097ce4c9d2d8214d89ae312df_JaffaCakes118

General

Target
d795d73097ce4c9d2d8214d89ae312df_JaffaCakes118
Size 80KB
Sample240910-e39ytsycje
SHA256 3fc82a1d4f6cde0cba0d97fc283901962538d7f971d91c6e23a2e9aa0cca7275
MD5 d795d73097ce4c9d2d8214d89ae312df
SHA1 c117b2479a42dd9a33d420414e2df82ae23e055c
SHA512 2ecf1645a9d4b67202cf1e390c31be5e322b860d9e832cad6bf72541338a5b241ab57dfa0a707c921c37f4cd1bf5fb82c40c999dc54ade9ffc660454e967517b
SSDEEP 1536:/oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtrov:A0hpgz6xGhTjwHN30BEv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Signatures

Sakula family
sakula

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d795d73097ce4c9d2d8214d89ae312df_JaffaCakes118

File Explorer

d795d73097ce4c9d2d8214d89ae312df_JaffaCakes118

.exe 80KB

d795d73097ce4c9d2d8214d89ae312df_JaffaCakes118

IMPHASH 539502771da573641ecc7f6497e39f8f
SHA256 3fc82a1d4f6cde0cba0d97fc283901962538d7f971d91c6e23a2e9aa0cca7275
MD5 d795d73097ce4c9d2d8214d89ae312df
SHA1 c117b2479a42dd9a33d420414e2df82ae23e055c
SHA512 2ecf1645a9d4b67202cf1e390c31be5e322b860d9e832cad6bf72541338a5b241ab57dfa0a707c921c37f4cd1bf5fb82c40c999dc54ade9ffc660454e967517b
SSDEEP 1536:/oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtrov:A0hpgz6xGhTjwHN30BEv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Sakula payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17029

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA ReadFile GetSystemDirectoryA MultiByteToWideChar SetThreadPriority GetTickCount GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA CreateDirectoryA ExitProcess CreateFileW GetProcessHeap SetEndOfFile HeapReAlloc GetStringTypeW LCMapStringW FlushFileBuffers WriteConsoleW SetStdHandle GetProcAddress GetModuleHandleW DecodePointer HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW HeapCreate RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize IsProcessorFeaturePresent

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Sharing