12ed934b88c4f3e3b5479544d0dc689a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
12ed934b88c4f3e3b5479544d0dc689a_JaffaCakes118
Size 162KB
Sample241004-mcaeaasglf
SHA256 b2da606ae7be840fd3846a762e6ce7dd92d1369f7cc5ec68eedef1272b9d8414
MD5 12ed934b88c4f3e3b5479544d0dc689a
SHA1 d82aab466601cd22702cc113cc8cd876bb1b420a
SHA512 218fddfcb97e574509a4c9e5de1fb3d1cbd8a151d3157de53ecb104fa8c85a51fd049565f5e0ef44759960b67ebac8e97d613ccc0fdf7f8a56550b65a0c83ed8
SSDEEP 3072:PDefSklsMZBoPnFPaguIv30iqodAZbLTX/T6up+Pmm0FgRHmGj50ekQekR:7efLsMZePnFIIv30ixdEn/HpmzU40QeI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12ed934b88c4f3e3b5479544d0dc689a_JaffaCakes118

File Explorer

12ed934b88c4f3e3b5479544d0dc689a_JaffaCakes118

.exe 162KB

12ed934b88c4f3e3b5479544d0dc689a_JaffaCakes118

IMPHASH 02c7b59eca937b6f2d5dde3261903654
SHA256 b2da606ae7be840fd3846a762e6ce7dd92d1369f7cc5ec68eedef1272b9d8414
MD5 12ed934b88c4f3e3b5479544d0dc689a
SHA1 d82aab466601cd22702cc113cc8cd876bb1b420a
SHA512 218fddfcb97e574509a4c9e5de1fb3d1cbd8a151d3157de53ecb104fa8c85a51fd049565f5e0ef44759960b67ebac8e97d613ccc0fdf7f8a56550b65a0c83ed8
SSDEEP 3072:PDefSklsMZBoPnFPaguIv30iqodAZbLTX/T6up+Pmm0FgRHmGj50ekQekR:7efLsMZePnFIIv30ixdEn/HpmzU40QeI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress WriteFile FindNextFileA LocalAlloc WritePrivateProfileStringA GetPrivateProfileIntA LocalFree FreeResource IsDBCSLeadByte GetSystemInfo RemoveDirectoryA GlobalAlloc UnhandledExceptionFilter TerminateThread SetFileAttributesA GetTempFileNameA FindResourceA FindFirstFileA lstrcmpA GlobalUnlock GetModuleFileNameW lstrcpyA GetTempPathA GlobalLock GetShortPathNameA ExpandEnvironmentStringsA _lclose lstrlenA GetCurrentProcess GetModuleFileNameA GetDriveTypeA LoadLibraryExA _llseek SetEvent SetFilePointer GetVersionExA EnumResourceLanguagesA FreeLibrary SizeofResource ReadFile GetFileAttributesA GetModuleHandleA LocalFileTimeToFileTime GetCommandLineA ExitProcess LockResource SetCurrentDirectoryA SetFileTime _lopen CreateFileA lstrcmpiA GetSystemDirectoryA GetPrivateProfileStringA FormatMessageA IsBadStringPtrW DosDateTimeToFileTime GetExitCodeProcess CreateProcessA GetLastError lstrcpynA CreateMutexA LoadResource GetVolumeInformationA SetUnhandledExceptionFilter GlobalFree ResetEvent GetStartupInfoA GetDiskFreeSpaceA MapViewOfFile CreateEventA DeleteFileA GetWindowsDirectoryA lstrcatA FindClose GlobalSize GetCurrentDirectoryA

wintrust

WinVerifyTrust

gdiplus

GdipTranslateRegion GdipSaveImageToFile GdipDeleteRegion GdipCreateRegionRect GdipDrawLineI GdipFillRegion

advapi32

FreeSid RegQueryValueExA RegOpenKeyExA EqualSid AdjustTokenPrivileges AllocateAndInitializeSid RegSetValueExA OpenProcessToken RegCloseKey RegDeleteValueA GetTokenInformation RegCreateKeyExA LookupPrivilegeValueA RegQueryInfoKeyA

ole32

StgIsStorageILockBytes OleFlushClipboard OleIsCurrentClipboard OleDuplicateData DoDragDrop RegisterDragDrop RevokeDragDrop

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

Sharing

General

Malware Config

Signatures

File Explorer

12ed934b88c4f3e3b5479544d0dc689a_JaffaCakes118

kernel32

wintrust

gdiplus

advapi32

ole32

version

generic