00d3b52833b30a79c9a01813d7d75e20_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
00d3b52833b30a79c9a01813d7d75e20_JaffaCakes118
Size 198KB
Sample240930-mcp5qszbrj
SHA256 1fa31d2ca9a5ef34449ca5696cccdbc5cc445204edd2d55756355f89cbffccb0
MD5 00d3b52833b30a79c9a01813d7d75e20
SHA1 854335ebcc42c16f3a5090d2233b6fd575f3fe8c
SHA512 d167dc626262c9a70438ef0a333dac901a9fae5a385c61a4074c40b19de031f3561e070a1900c0fc5abb4caeba9a5892fc4c89a23848cd5cfc058fd93694aae4
SSDEEP 3072:y1l25DjIbBFtEsNtzqR+stML/6wTwwr3JCF/veijcTP3qx7lzjII:ZIbBws/OyLC0w4JCVveiH7JI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00d3b52833b30a79c9a01813d7d75e20_JaffaCakes118

File Explorer

00d3b52833b30a79c9a01813d7d75e20_JaffaCakes118

.exe 198KB

00d3b52833b30a79c9a01813d7d75e20_JaffaCakes118

IMPHASH 069ec14247e62dd0c047e11ecd28e3d8
SHA256 1fa31d2ca9a5ef34449ca5696cccdbc5cc445204edd2d55756355f89cbffccb0
MD5 00d3b52833b30a79c9a01813d7d75e20
SHA1 854335ebcc42c16f3a5090d2233b6fd575f3fe8c
SHA512 d167dc626262c9a70438ef0a333dac901a9fae5a385c61a4074c40b19de031f3561e070a1900c0fc5abb4caeba9a5892fc4c89a23848cd5cfc058fd93694aae4
SSDEEP 3072:y1l25DjIbBFtEsNtzqR+stML/6wTwwr3JCF/veijcTP3qx7lzjII:ZIbBws/OyLC0w4JCVveiH7JI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

PulseEvent lstrcpyA lstrlenA VirtualFree FreeResource SizeofResource LockResource LoadResource FindResourceExA GetLastError VirtualProtect GetModuleHandleA DeleteFileA ReadFile CreateFileA HeapAlloc GetSystemInfo VirtualAlloc LocalAlloc InterlockedDecrement GlobalFree WriteFile GlobalAlloc LoadLibraryA SystemTimeToFileTime GetSystemTime EndUpdateResourceA UpdateResourceA BeginUpdateResourceA GetStartupInfoA DebugBreak HeapReAlloc HeapFree GetModuleFileNameA VirtualQuery LoadLibraryW GetProcAddress SetEvent FreeLibrary ExitProcess GetCommandLineA GetCurrentThreadId lstrcmpiA Sleep CreateEventA CreateThread WaitForSingleObject CloseHandle HeapCreate

user32

GetDesktopWindow TranslateAcceleratorA LoadAcceleratorsA LoadStringA RegisterClassExA LoadCursorA LoadIconA UpdateWindow ShowWindow CreateWindowExA PostQuitMessage EndPaint DrawTextA BeginPaint IsWindow DialogBoxParamA EndDialog UnregisterClassA PeekMessageA TranslateMessage PostMessageA GetDC FillRect ReleaseDC GetClientRect RegisterClassA BringWindowToTop DefWindowProcA GetMessageA IsWindowVisible IsRectEmpty DestroyWindow SetRect DispatchMessageA CharNextA PostThreadMessageA AttachThreadInput

gdi32

Rectangle CreateCompatibleDC CreateCompatibleBitmap SelectObject GetDIBits SetROP2 GetObjectA

ole32

CoUninitialize CoInitialize CoCreateInstance

oleaut32

VariantClear VariantInit

atl

ord57 ord21 ord16 ord23 ord17 ord20 ord18

pdh

PdhGetLogFileSize PdhGetDataSourceTimeRangeW

wininet

InternetCloseHandle InternetOpenW

Name

.text

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

160KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

00d3b52833b30a79c9a01813d7d75e20_JaffaCakes118

kernel32

user32

gdi32

ole32

oleaut32

atl

pdh

wininet

generic