privateloader | 0965da18bfbf19bafb1c414882e19081_JaffaCakes118

General

Target
0965da18bfbf19bafb1c414882e19081_JaffaCakes118
Size 1.6MB
Sample241002-hlan7awdnb
SHA256 1cdddf182f161ab789edfcc68a0706d0b8412a9ba67a3f918fe60fab270eabff
MD5 0965da18bfbf19bafb1c414882e19081
SHA1 e4556bac206f74d3a3d3f637e594507c30707240
SHA512 fe4702a2fde36b4fb0015ad7d3e2169a1ccbf5e29d7edef40f104ed47661b4b0365b13b1913e9f4e0ab7bc9ac542ee86c02a802a13567dfd0b8f5485a5be829b
SSDEEP 24576:/IBprJ8XdBig7LxureALwLhuhDUauBL8hxCMcIYwTxKAyuxCQyD2uG8wTVXglfg+:/17bBQxC/wTW2owTh8fpSKc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0965da18bfbf19bafb1c414882e19081_JaffaCakes118

File Explorer

0965da18bfbf19bafb1c414882e19081_JaffaCakes118

.exe 1.6MB

0965da18bfbf19bafb1c414882e19081_JaffaCakes118

IMPHASH ba9ba55b1a716b6a71a11f5d3a4844e7
SHA256 1cdddf182f161ab789edfcc68a0706d0b8412a9ba67a3f918fe60fab270eabff
MD5 0965da18bfbf19bafb1c414882e19081
SHA1 e4556bac206f74d3a3d3f637e594507c30707240
SHA512 fe4702a2fde36b4fb0015ad7d3e2169a1ccbf5e29d7edef40f104ed47661b4b0365b13b1913e9f4e0ab7bc9ac542ee86c02a802a13567dfd0b8f5485a5be829b
SSDEEP 24576:/IBprJ8XdBig7LxureALwLhuhDUauBL8hxCMcIYwTxKAyuxCQyD2uG8wTVXglfg+:/17bBQxC/wTW2owTh8fpSKc
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

636079

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError CloseHandle FindClose lstrcatA GetModuleHandleA SetCurrentDirectoryA Sleep CreateFileW GetSystemDirectoryA lstrcpyA VerSetConditionMask WideCharToMultiByte VerifyVersionInfoW GetSystemTimeAsFileTime HeapFree lstrlenA HeapAlloc GetProcAddress lstrcpynA GetProcessHeap LoadLibraryW WriteFile QueryFullProcessImageNameA InitializeSListHead EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetCurrentProcess TerminateProcess DeleteFileW FindFirstFileExW FindNextFileW SetEndOfFile SetFilePointerEx SetLastError MultiByteToWideChar QueryPerformanceFrequency SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer DecodePointer GetCPInfo LCMapStringW GetLocaleInfoW GetStringTypeW GetThreadTimes GetCurrentThread InterlockedPushEntrySList InterlockedFlushSList RaiseException RtlUnwind FreeLibrary LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx FlushFileBuffers HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize WriteConsoleW ReadFile TryEnterCriticalSection SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx CreateTimerQueue VirtualQuery

user32

CharNextA

advapi32

OpenProcessToken GetTokenInformation CryptReleaseContext

Sharing