f6626e65f1eb82888caee56c3f658b89_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
f6626e65f1eb82888caee56c3f658b89_JaffaCakes118
Size 2.8MB
Sample240925-tpmnpsvbql
SHA256 41aff36e468738584879894efb4062f634c5bfe9c9300db8e15fe3f638f85f95
MD5 f6626e65f1eb82888caee56c3f658b89
SHA1 8a45d192c080a0923cbc2757df086d34b39c63e1
SHA512 10ec80ec7db80e0c39f48d688a06ca3cde6c4dd37a26dc872967f3d663cc2dc2dd26d2211877c23e72f965189ab784fd851f0e45f3e2899ab96070957e5fa877
SSDEEP 49152:2hUacRT39VIQfT3WUacRT39VIQfTzWUacRT39VIQfTfWUacRT39VIQfT:2hUzRjwQfjWUzRjwQfHWUzRjwQfLWUzJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6626e65f1eb82888caee56c3f658b89_JaffaCakes118

File Explorer

f6626e65f1eb82888caee56c3f658b89_JaffaCakes118

.exe 2.8MB

f6626e65f1eb82888caee56c3f658b89_JaffaCakes118

IMPHASH a262877a36fc7e0f830054e0f70f76cb
SHA256 41aff36e468738584879894efb4062f634c5bfe9c9300db8e15fe3f638f85f95
MD5 f6626e65f1eb82888caee56c3f658b89
SHA1 8a45d192c080a0923cbc2757df086d34b39c63e1
SHA512 10ec80ec7db80e0c39f48d688a06ca3cde6c4dd37a26dc872967f3d663cc2dc2dd26d2211877c23e72f965189ab784fd851f0e45f3e2899ab96070957e5fa877
SSDEEP 49152:2hUacRT39VIQfT3WUacRT39VIQfTzWUacRT39VIQfTfWUacRT39VIQfT:2hUzRjwQfjWUzRjwQfHWUzRjwQfLWUzJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7799

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetACP GetCPInfo GetCurrentProcess TerminateProcess IsDebuggerPresent UnhandledExceptionFilter GetOEMCP HeapFree Sleep LoadLibraryW RtlUnwind HeapSize LCMapStringW MultiByteToWideChar GetStringTypeW HeapAlloc EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount IsValidCodePage VirtualProtect QueryPerformanceCounter HeapCreate InterlockedDecrement GetLastError GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue HeapReAlloc

mpr

WNetCancelConnectionA WNetCancelConnectionW WNetGetUniversalNameW WNetGetProviderNameW WNetGetProviderNameA WNetGetNetworkInformationA WNetGetResourceParentA

ole32

CreateDataCache CreateILockBytesOnHGlobal StringFromIID HBITMAP_UserFree OleInitializeWOW OleQueryLinkFromData

avifil32

AVIFileOpen AVIFileCreateStreamA AVISaveW AVIStreamGetFrameOpen AVIFileWriteData

avicap32

capGetDriverDescriptionW

msvfw32

ICClose ICInfo

setupapi

SetupDiGetHwProfileListExA SetupGetInfInformationA SetupDiDrawMiniIcon

loadperf

LoadPerfCounterTextStringsA UnloadPerfCounterTextStringsW UnloadPerfCounterTextStringsA

gdi32

GetFontUnicodeRanges GetDeviceCaps GetEnhMetaFileDescriptionW

shlwapi

ord29 PathGetArgsW ord432 ord158

rpcrt4

RpcNsBindingInqEntryNameW I_RpcMapWin32Status

winmm

waveOutSetVolume mmioWrite

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

714KB

Virtual Size

714KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.l2

Size

714KB

Virtual Size

714KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.l2

Size

714KB

Virtual Size

714KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.l2

Size

714KB

Virtual Size

714KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f6626e65f1eb82888caee56c3f658b89_JaffaCakes118

kernel32

mpr

ole32

avifil32

avicap32

msvfw32

setupapi

loadperf

gdi32

shlwapi

rpcrt4

winmm

generic