d95293fbe2cd4c9240d36850e8cbe9af_JaffaCakes118

General

Target
d95293fbe2cd4c9240d36850e8cbe9af_JaffaCakes118
Size 12.3MB
Sample240911-a9h2gatelm
SHA256 b0d1d495f878b20a7656655008fe8418b597d5e35932d3efc344d7123f076ad1
MD5 d95293fbe2cd4c9240d36850e8cbe9af
SHA1 bc2af10130107760ec44e21966ca0780326e5f26
SHA512 82df1c0d9d16b53adf1788ac3b3ae223959b541911cd6ca36b299bb9bdc97c790a626e8bf2dced55ee6605ce3348019bdb3f641c4b40b263ddbe461acca6ed59
SSDEEP 196608:tRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRv:
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d95293fbe2cd4c9240d36850e8cbe9af_JaffaCakes118

File Explorer

d95293fbe2cd4c9240d36850e8cbe9af_JaffaCakes118

.exe 12.3MB

d95293fbe2cd4c9240d36850e8cbe9af_JaffaCakes118

IMPHASH 13d097bc679769118a9ca1658020024c
SHA256 b0d1d495f878b20a7656655008fe8418b597d5e35932d3efc344d7123f076ad1
MD5 d95293fbe2cd4c9240d36850e8cbe9af
SHA1 bc2af10130107760ec44e21966ca0780326e5f26
SHA512 82df1c0d9d16b53adf1788ac3b3ae223959b541911cd6ca36b299bb9bdc97c790a626e8bf2dced55ee6605ce3348019bdb3f641c4b40b263ddbe461acca6ed59
SSDEEP 196608:tRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRv:
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7359

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bisos\vexawomopate\piyug.pdb

kernel32

InterlockedIncrement GetEnvironmentStringsW SetEvent GetSystemTimeAsFileTime CancelDeviceWakeupRequest GetCommandLineA WriteFileGather EnumResourceTypesA SizeofResource LeaveCriticalSection GetFileAttributesW WriteConsoleW ReadFile GetModuleFileNameW CreateActCtxA GetProcAddress VerLanguageNameA RemoveDirectoryA FreeUserPhysicalPages PrepareTape GetProcessId LocalAlloc GlobalGetAtomNameW WaitForMultipleObjects GetModuleFileNameA GetModuleHandleA FindFirstVolumeA EndUpdateResourceA LocalSize AddConsoleAliasA LocalFree FindNextVolumeA lstrcpyW GetLocaleInfoA GetLastError HeapReAlloc HeapAlloc GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount GetStdHandle GetFileType DeleteCriticalSection SetFilePointer EnterCriticalSection HeapCreate VirtualFree HeapFree VirtualAlloc GetModuleHandleW Sleep ExitProcess WriteFile FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount SetStdHandle RtlUnwind FlushFileBuffers LoadLibraryA WriteConsoleA GetConsoleOutputCP MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW HeapSize CreateFileA CloseHandle

user32

GetCursorPos

gdi32

GetCharWidthFloatW

advapi32

DeregisterEventSource

Sharing

General

Malware Config

Signatures

File Explorer

d95293fbe2cd4c9240d36850e8cbe9af_JaffaCakes118

kernel32

user32

gdi32

advapi32

generic