e856a93a08f97a40c1e08805ceff132e_JaffaCakes118

General

Target
e856a93a08f97a40c1e08805ceff132e_JaffaCakes118
Size 14.3MB
Sample240918-e6qz5asgra
SHA256 ada1625907b9d1a90cb4ee844b69b9c66ea0c520bbf05c6a73e0812e435fa8da
MD5 e856a93a08f97a40c1e08805ceff132e
SHA1 5e5834e448da4c412fc63e4b9d3fe3f4ac0bb0aa
SHA512 791c044b02f574c2b84fae88cf60c7a2a085eba8bfc676d15d49aec499590aa238f8300dbab3c9bf28bbb12a7d9d88d07a34ab7d9d01b357e7cc23382b0d3e80
SSDEEP 49152:bsOuBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBJ:bL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e856a93a08f97a40c1e08805ceff132e_JaffaCakes118

File Explorer

e856a93a08f97a40c1e08805ceff132e_JaffaCakes118

.exe 14.3MB

e856a93a08f97a40c1e08805ceff132e_JaffaCakes118

IMPHASH 192411e2e19367f41197615b5b42abe3
SHA256 ada1625907b9d1a90cb4ee844b69b9c66ea0c520bbf05c6a73e0812e435fa8da
MD5 e856a93a08f97a40c1e08805ceff132e
SHA1 5e5834e448da4c412fc63e4b9d3fe3f4ac0bb0aa
SHA512 791c044b02f574c2b84fae88cf60c7a2a085eba8bfc676d15d49aec499590aa238f8300dbab3c9bf28bbb12a7d9d88d07a34ab7d9d01b357e7cc23382b0d3e80
SSDEEP 49152:bsOuBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBJ:bL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kusebu\jigi\51\wose-koxov.pdb

kernel32

FreeLibrary InterlockedIncrement GetCommState GetProfileStringW CallNamedPipeW GetNumberFormatA GetCommandLineA FindResourceExA GlobalAlloc GetVolumeInformationA GetSystemWow64DirectoryW GetSystemWindowsDirectoryA HeapDestroy GetCompressedFileSizeA GetSystemDirectoryA CreateActCtxA GetBinaryTypeW WritePrivateProfileStringW LCMapStringA GetPrivateProfileIntW GetStartupInfoA SetThreadLocale CopyFileExW GetCPInfoExW GetLastError SetLastError GetProcAddress CreateNamedPipeA LoadLibraryA OpenMutexA CreateSemaphoreW SetSystemTime GetModuleFileNameA CreateIoCompletionPort FindFirstChangeNotificationA HeapSetInformation FreeEnvironmentStringsW FindNextFileW GetCurrentDirectoryA SetFileShortNameA TerminateJobObject FindAtomW UnregisterWaitEx DeleteFileA lstrlenA GetStdHandle GetThreadContext CloseHandle CreateFileW WideCharToMultiByte EncodePointer DecodePointer GetStartupInfoW InterlockedDecrement GetModuleHandleW ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW WriteFile GetACP GetOEMCP GetCPInfo IsValidCodePage TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId TlsFree HeapValidate IsBadReadPtr QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapCreate EnterCriticalSection LeaveCriticalSection LoadLibraryW IsProcessorFeaturePresent OutputDebugStringA WriteConsoleW OutputDebugStringW RtlUnwind LCMapStringW MultiByteToWideChar GetStringTypeW HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree SetFilePointer GetConsoleCP GetConsoleMode RaiseException SetStdHandle FlushFileBuffers

advapi32

InitiateSystemShutdownA AbortSystemShutdownA

winhttp

WinHttpOpen

Sharing

General

Malware Config

Signatures

File Explorer

e856a93a08f97a40c1e08805ceff132e_JaffaCakes118

kernel32

advapi32

winhttp

generic