36944c561c440754a90e3e4035fae82e_JaffaCakes118

General

Target
36944c561c440754a90e3e4035fae82e_JaffaCakes118
Size 878KB
Sample241011-yslysswapl
SHA256 742ef893c775a600818c2d349f754a09dcac568b01340f0c7abf9741fb1a0437
MD5 36944c561c440754a90e3e4035fae82e
SHA1 43c12e3c90ef01fa705467b401e56767eba89b02
SHA512 bc0d1918dd0a126a9372aa5602f920eda0d2e2ae9b71f0758139969d9a9a25f2799b3e0c5d3e53ee1dbbf4f12274aaccaacb667f3bd93475867132c29b1e72ae
SSDEEP 12288:s8ksz3AzekhT6eMXMaA8DGBbKgCnIFB14lcDYIYZ0eoho5hbAsfTLdd/3m6JyVUw:R7z3ADbddFKjnIFXzDkbfNzVZP/qbE0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36944c561c440754a90e3e4035fae82e_JaffaCakes118

File Explorer

36944c561c440754a90e3e4035fae82e_JaffaCakes118

.exe 878KB

36944c561c440754a90e3e4035fae82e_JaffaCakes118

IMPHASH ffc9ddecb26f5788649c964b56d5ff9f
SHA256 742ef893c775a600818c2d349f754a09dcac568b01340f0c7abf9741fb1a0437
MD5 36944c561c440754a90e3e4035fae82e
SHA1 43c12e3c90ef01fa705467b401e56767eba89b02
SHA512 bc0d1918dd0a126a9372aa5602f920eda0d2e2ae9b71f0758139969d9a9a25f2799b3e0c5d3e53ee1dbbf4f12274aaccaacb667f3bd93475867132c29b1e72ae
SSDEEP 12288:s8ksz3AzekhT6eMXMaA8DGBbKgCnIFB14lcDYIYZ0eoho5hbAsfTLdd/3m6JyVUw:R7z3ADbddFKjnIFXzDkbfNzVZP/qbE0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

257782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA VirtualFree GetModuleHandleA GetCurrentProcessId GetModuleFileNameW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId WaitForSingleObject CloseHandle DeleteCriticalSection FreeLibrary IsWow64Process GetProcAddress VirtualAlloc GetCommandLineW GetTickCount CreateEventA Sleep SetEvent CreateEventW GetLastError GetFullPathNameW CopyFileW DeleteFileW GetCurrentProcess FreeResource SizeofResource LockResource LoadResource FindResourceExW VirtualProtect FindResourceW HeapFree ReadFile GetSystemTimeAsFileTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapAlloc IsProcessorFeaturePresent GetProcessHeap IsDebuggerPresent SetFilePointer MultiByteToWideChar GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount GetStartupInfoW RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement WriteFile WideCharToMultiByte GetConsoleCP ExitProcess GetModuleHandleExW AreFileApisANSI GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle FlushFileBuffers CreateFileW WriteConsoleW OutputDebugStringW LoadLibraryW HeapReAlloc GetStringTypeW LCMapStringW SetEndOfFile HeapSize

advapi32

AddAccessDeniedAce CryptGetDefaultProviderA CryptDuplicateKey

comctl32

GetMUILanguage ImageList_Add ImageList_DragLeave

Sharing

General

Malware Config

Signatures

File Explorer

36944c561c440754a90e3e4035fae82e_JaffaCakes118

kernel32

advapi32

comctl32

generic