38a6575b587dcfc70fd9d96b78ede844_JaffaCakes118

General

Target
38a6575b587dcfc70fd9d96b78ede844_JaffaCakes118
Size 361KB
Sample241012-gcplba1blr
SHA256 d3b63840b0cae3cc0d7244c57d12da54fc1b24850a887472bffc884ba2a5dcd7
MD5 38a6575b587dcfc70fd9d96b78ede844
SHA1 6f7156a196239194b5832021a8ef34d7167ab2d3
SHA512 82eae01ae8abeb8c3b7f6f9da8c8a95da1ff0590dd1fe708e1378363688cae9f38d797d3e2a5a9b474b1036cde523aa76bec7c07d1e0fa42017426c58f7dff7d
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38a6575b587dcfc70fd9d96b78ede844_JaffaCakes118

File Explorer

38a6575b587dcfc70fd9d96b78ede844_JaffaCakes118

.exe 361KB

38a6575b587dcfc70fd9d96b78ede844_JaffaCakes118

IMPHASH 52a948b5de7cc38ae8e6110ce48389ff
SHA256 d3b63840b0cae3cc0d7244c57d12da54fc1b24850a887472bffc884ba2a5dcd7
MD5 38a6575b587dcfc70fd9d96b78ede844
SHA1 6f7156a196239194b5832021a8ef34d7167ab2d3
SHA512 82eae01ae8abeb8c3b7f6f9da8c8a95da1ff0590dd1fe708e1378363688cae9f38d797d3e2a5a9b474b1036cde523aa76bec7c07d1e0fa42017426c58f7dff7d
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

12863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\软件工程\驱动编程\OK\KernelYK\bin\InstallSYS.pdb

kernel32

GetModuleFileNameW CreateFileW MultiByteToWideChar GetLastError GetProcAddress Process32FirstW ReadFile Process32NextW CreateToolhelp32Snapshot WinExec CloseHandle DeleteFileW GetVersionExW Sleep LoadLibraryW WriteFile GetTickCount WaitForSingleObject GetCurrentProcess UnmapViewOfFile MapViewOfFile GetFileSize CreateFileA CreateFileMappingW ExitProcess GetFileAttributesA HeapFree HeapAlloc GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA LCMapStringA WideCharToMultiByte GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CreateDirectoryA

advapi32

AdjustTokenPrivileges ChangeServiceConfigW StartServiceW LookupPrivilegeValueW RegCreateKeyExW OpenServiceW OpenSCManagerW OpenProcessToken CloseServiceHandle CreateServiceW RegSetValueExW

netapi32

NetUserDel

imagehlp

CheckSumMappedFile

Sharing

General

Malware Config

Signatures

File Explorer

38a6575b587dcfc70fd9d96b78ede844_JaffaCakes118

kernel32

advapi32

netapi32

imagehlp

generic