ed19e458dc110536aa306a62f8039991_JaffaCakes118

General

Target
ed19e458dc110536aa306a62f8039991_JaffaCakes118
Size 135KB
Sample240920-h89rssvdjg
SHA256 2fc2f0c7e52c957df4bb997090c0167a0d388f1a8ddb3b61a20cb1a31c61f82e
MD5 ed19e458dc110536aa306a62f8039991
SHA1 a12c6be1cb9424728e4d00a969c06b61318bc1bb
SHA512 a007340b2e563549b42fb0776f13601965c3564172f8fd78bda52d4cddda4e455efaa920c3939496e8433baf69c1e00d6fd5118833b702f0aa8ade2e2d49d672
SSDEEP 3072:Kk1heKZtKLQeGNxQ8PQ/q6zs1DgNNDfB5EN7:TcdLQL3Qi6q6wJU9IN7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed19e458dc110536aa306a62f8039991_JaffaCakes118

File Explorer

ed19e458dc110536aa306a62f8039991_JaffaCakes118

.exe 135KB

ed19e458dc110536aa306a62f8039991_JaffaCakes118

IMPHASH 5f8e23f931be33291433d0ebb13e421b
SHA256 2fc2f0c7e52c957df4bb997090c0167a0d388f1a8ddb3b61a20cb1a31c61f82e
MD5 ed19e458dc110536aa306a62f8039991
SHA1 a12c6be1cb9424728e4d00a969c06b61318bc1bb
SHA512 a007340b2e563549b42fb0776f13601965c3564172f8fd78bda52d4cddda4e455efaa920c3939496e8433baf69c1e00d6fd5118833b702f0aa8ade2e2d49d672
SSDEEP 3072:Kk1heKZtKLQeGNxQ8PQ/q6zs1DgNNDfB5EN7:TcdLQL3Qi6q6wJU9IN7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10159

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile BuildCommDCBAndTimeoutsA ReadConsoleA SetConsoleActiveScreenBuffer CreateJobObjectW ConnectNamedPipe CallNamedPipeW SetTapeParameters GetProcessPriorityBoost SetCommState LoadLibraryW TerminateThread ReadFile lstrcatA GetBinaryTypeW GetACP lstrlenW FindNextVolumeMountPointW RaiseException InterlockedExchange SetLocalTime GetStdHandle FreeLibraryAndExitThread SetLastError GetProcAddress CopyFileA EnterCriticalSection LoadLibraryA LocalAlloc IsSystemResumeAutomatic SetFileApisToANSI FindAtomA GetPrivateProfileStructA WaitForMultipleObjects SetEnvironmentVariableA CreateMutexA EnumResourceNamesA GetCurrentDirectoryA OpenSemaphoreW LocalFree GetProfileSectionW lstrcpyW SetCurrentDirectoryA SetPriorityClass CreateFileA GetLastError MoveFileA HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RtlUnwind HeapFree DeleteCriticalSection LeaveCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetOEMCP IsValidCodePage MultiByteToWideChar GetModuleHandleA GetLocaleInfoA WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer SetStdHandle

advapi32

SetThreadToken RevertToSelf

winhttp

WinHttpCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

ed19e458dc110536aa306a62f8039991_JaffaCakes118

kernel32

advapi32

winhttp

generic