urelas | 11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118
Size 412KB
Sample241004-faesnavdlp
SHA256 526f35f43b534370f6a3d732a110e3457e7ac878e24d22c639680318a290e3ad
MD5 11de899e7f3337f0432a1f1dc4024e04
SHA1 82a1e49023665d5a49e4a7f667d90d8ec4682df7
SHA512 80adf82d7dd4934796fde03e6edd32c9fc735d563da2eccdee26cef07f6b0ae0202c642917b2bcb9db1ee47dea79287e465f640ee057e5fb7e6d68101f85e425
SSDEEP 6144:tzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODonZk3:hU7M5ijWh0XOW4sEfeOX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118

File Explorer

11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118

.exe 412KB

11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118

IMPHASH 78cbfd92c4a2c4baef4202ec751e4238
SHA256 526f35f43b534370f6a3d732a110e3457e7ac878e24d22c639680318a290e3ad
MD5 11de899e7f3337f0432a1f1dc4024e04
SHA1 82a1e49023665d5a49e4a7f667d90d8ec4682df7
SHA512 80adf82d7dd4934796fde03e6edd32c9fc735d563da2eccdee26cef07f6b0ae0202c642917b2bcb9db1ee47dea79287e465f640ee057e5fb7e6d68101f85e425
SSDEEP 6144:tzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODonZk3:hU7M5ijWh0XOW4sEfeOX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW CreateEventW CreateThread GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer GetTempPathW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CloseHandle OpenEventW GetFileAttributesW GetTickCount ExitProcess Sleep FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetConsoleCP GetConsoleMode TlsGetValue

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

socket recv send closesocket connect WSAStartup htonl gethostbyaddr WSAGetLastError gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification