19f9640267ade9a59b1a6144a6a19543_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
19f9640267ade9a59b1a6144a6a19543_JaffaCakes118
Size 187KB
Sample241006-12dd5aserg
SHA256 afad3ba9767ab9d2487ca4972286c1d81f550e40fbaad2a123206efafe0b223b
MD5 19f9640267ade9a59b1a6144a6a19543
SHA1 c2fce198f408f9434b25e8b5386ef5f996e4b64b
SHA512 e006453fee6bf18cdda0247e2a13c3ba18f23b83820871ad56435e4cad99f8156bff8e8956c74e04741296e8f51d64e1a02ba9e56bfa75ccc4d1fbf4febef009
SSDEEP 3072:XhP16R/9RvS6WZlciK8Pcm0CdMz526RfjFNgegWNHDSb:Xhg/9R9SXd05VNg9WNG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

19f9640267ade9a59b1a6144a6a19543_JaffaCakes118

.exe 187KB

19f9640267ade9a59b1a6144a6a19543_JaffaCakes118

IMPHASH 8d2e8ab0a538cfdaef668267924ba684
SHA256 afad3ba9767ab9d2487ca4972286c1d81f550e40fbaad2a123206efafe0b223b
MD5 19f9640267ade9a59b1a6144a6a19543
SHA1 c2fce198f408f9434b25e8b5386ef5f996e4b64b
SHA512 e006453fee6bf18cdda0247e2a13c3ba18f23b83820871ad56435e4cad99f8156bff8e8956c74e04741296e8f51d64e1a02ba9e56bfa75ccc4d1fbf4febef009
SSDEEP 3072:XhP16R/9RvS6WZlciK8Pcm0CdMz526RfjFNgegWNHDSb:Xhg/9R9SXd05VNg9WNG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

2c:5e:53:59:37:88:95:40:75:a8:e0:5c:87:f7:f0:85:c2:8e:36:ad:af:f6:2e:f2:26:c9:fa:e5:4a:5d:12:db

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=BetterNet LLC,O=BetterNet LLC,L=Redwood City,ST=California,C=US

Chains

Jul 12, 2021

CN=BetterNet LLC,O=BetterNet LLC,L=Redwood City,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

Major OS version

Entry point

6625

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA Sleep GetProcAddress GetTickCount GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess

user32

MessageBoxA

msvcp140

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

vcruntime140

__std_terminate __CxxFrameHandler3 __current_exception_context memset _except_handler4_common __current_exception

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vfprintf __acrt_iob_func __p__commode

api-ms-win-crt-runtime-l1-1-0

_c_exit exit _initialize_onexit_table _register_onexit_function _cexit _crt_atexit _controlfp_s terminate _initterm_e _initterm _register_thread_local_exe_atexit_callback __p___argv __p___argc _get_initial_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _exit _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

19f9640267ade9a59b1a6144a6a19543_JaffaCakes118

PE Signature issue

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic