urelas | 27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118
Size 693KB
Sample241009-ax2caaybpf
SHA256 a24c0426d17c33cbc4a2eafe5dfb4bd2acb6c0453e977d103f628dbd87250489
MD5 27d524b5c4969858886b8652c2fc9e1d
SHA1 2b65cb21cc8945ac9be7d3eb69333ba5602dce60
SHA512 ce8d41f6fb9cf140c9eb0395f44448feea003474802b102a1e6bbdfd8f9ab64978ce557cf22c88a24cdb9f2ffc92ec8d275684829223ebaf668381d747a2cea8
SSDEEP 12288:LUyI6hJQglQA0IWb8DmPySxEuBZDxywHBlP94jpguwDxXlZ1nrv:dVh6gl6Iy8R9+ZdnnP94jpgl9Bnrv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118

File Explorer

27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118

.exe 693KB

27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118

IMPHASH 44e28e549210a9abd46e82a4b58f66b5
SHA256 a24c0426d17c33cbc4a2eafe5dfb4bd2acb6c0453e977d103f628dbd87250489
MD5 27d524b5c4969858886b8652c2fc9e1d
SHA1 2b65cb21cc8945ac9be7d3eb69333ba5602dce60
SHA512 ce8d41f6fb9cf140c9eb0395f44448feea003474802b102a1e6bbdfd8f9ab64978ce557cf22c88a24cdb9f2ffc92ec8d275684829223ebaf668381d747a2cea8
SSDEEP 12288:LUyI6hJQglQA0IWb8DmPySxEuBZDxywHBlP94jpguwDxXlZ1nrv:dVh6gl6Iy8R9+ZdnnP94jpgl9Bnrv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CreateEventW CreateThread GetSystemDirectoryW DeleteFileW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer OpenEventW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateDirectoryW SetFileTime SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CopyFileW GetTempPathW GetFileAttributesW Sleep GetTickCount ExitProcess FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException GetConsoleMode GetConsoleCP HeapCreate HeapDestroy HeapReAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc

user32

LoadStringW LoadAcceleratorsW GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW wsprintfW DialogBoxParamW DestroyWindow DefWindowProcW EndDialog PostQuitMessage EndPaint BeginPaint

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

htonl connect WSAGetLastError recv send WSAStartup closesocket gethostbyaddr socket gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

Name

.text

Size

132KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512KB

Virtual Size

512KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

generic