40c9ae2e3cf8003a603318358c9151e6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
40c9ae2e3cf8003a603318358c9151e6_JaffaCakes118
Size 365KB
Sample241013-tjee5svejb
SHA256 aac772ddbb248c80f3b69484ab5e0e540e6a7134cc6d598178337e78115d420c
MD5 40c9ae2e3cf8003a603318358c9151e6
SHA1 1387bbca0944240d5a854e7dfd23527c9aeb06e3
SHA512 9849a6e8dbc8b7db7dd35de0a4c8c57a2f23bf7c136c8fd2efada66858d642444527228ab7e916616fb622db234eaf9b2c34b128a44e19f454e02177434626a5
SSDEEP 6144:SZyeNQfFH5+RolCSa8TXyQbGOKEESSPV8PkcreWIY4AfL4O4LRUoYv4YKps:SZyeNAH5oolCSa8TyQyOKXPPV8lyWIYL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40c9ae2e3cf8003a603318358c9151e6_JaffaCakes118

File Explorer

40c9ae2e3cf8003a603318358c9151e6_JaffaCakes118

.exe 365KB

40c9ae2e3cf8003a603318358c9151e6_JaffaCakes118

IMPHASH 16864451805f19fa62541013b71f943a
SHA256 aac772ddbb248c80f3b69484ab5e0e540e6a7134cc6d598178337e78115d420c
MD5 40c9ae2e3cf8003a603318358c9151e6
SHA1 1387bbca0944240d5a854e7dfd23527c9aeb06e3
SHA512 9849a6e8dbc8b7db7dd35de0a4c8c57a2f23bf7c136c8fd2efada66858d642444527228ab7e916616fb622db234eaf9b2c34b128a44e19f454e02177434626a5
SSDEEP 6144:SZyeNQfFH5+RolCSa8TXyQbGOKEESSPV8PkcreWIY4AfL4O4LRUoYv4YKps:SZyeNAH5oolCSa8TyQyOKXPPV8lyWIYL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

117216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleToolbarUser_unsigned_32.pdb

msi

ord175 ord238 ord141

kernel32

FindClose FindNextFileW FindFirstFileW GetSystemInfo GetTickCount GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetACP GetLocaleInfoA GetThreadLocale WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle SetFilePointer LoadLibraryA GetStringTypeW GetStringTypeA CompareFileTime GetConsoleCP LCMapStringW GetFileSizeEx ReadFile VerSetConditionMask VerifyVersionInfoW GetTempPathW GetSystemTime SystemTimeToFileTime LocalAlloc OpenProcess GetSystemTimeAsFileTime GetCurrentProcess TerminateProcess GetExitCodeProcess MapViewOfFile WideCharToMultiByte InterlockedDecrement InterlockedIncrement lstrlenW Sleep MultiByteToWideChar InterlockedExchange FlushFileBuffers CreateMutexW CreateEventW WaitForSingleObject OpenEventW ReleaseMutex WriteFile SetEvent CreateFileW DeleteFileW MoveFileExW GetTempFileNameW GetFileAttributesExW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection CreateFileMappingW GetCurrentProcessId OpenFileMappingW MapViewOfFileEx UnmapViewOfFile CreateProcessW LoadLibraryExW LocalFree FreeLibrary OutputDebugStringA GetModuleFileNameW IsValidCodePage GetOEMCP QueryPerformanceCounter VirtualFree HeapCreate GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA ExitProcess GetCurrentThreadId TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle GetCPInfo LCMapStringA RtlUnwind VirtualQuery VirtualAlloc VirtualProtect IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW SetLastError GetLastError LoadLibraryW CloseHandle FindResourceExW FindResourceW LoadResource LockResource SizeofResource RaiseException GetVersion GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA CreateFileA GetConsoleMode

user32

UnregisterClassA

advapi32

CryptDestroyKey RegEnumValueW GetSecurityDescriptorControl GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner MakeSelfRelativeSD GetSecurityDescriptorLength RegFlushKey AddAce InitializeAcl GetAclInformation MakeAbsoluteSD InitializeSecurityDescriptor GetLengthSid IsValidSid CryptVerifySignatureW CryptCreateHash CryptHashData CryptAcquireContextW RegDeleteValueW RegNotifyChangeKeyValue RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegCreateKeyExW RegEnumKeyExW RegDeleteKeyW RegOpenKeyExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorGroup SetSecurityDescriptorOwner GetSidIdentifierAuthority GetSidSubAuthorityCount OpenProcessToken GetTokenInformation ConvertSidToStringSidW AllocateAndInitializeSid CheckTokenMembership FreeSid GetAce GetSidLengthRequired InitializeSid GetSidSubAuthority SetSecurityDescriptorDacl EqualSid CopySid CryptDestroyHash

ole32

OleRun CoCreateInstance StringFromGUID2 CoInitialize CoCreateGuid CoUninitialize

shell32

ord165 SHGetFolderPathW

shlwapi

PathFileExistsW PathAppendW PathCanonicalizeW PathCombineW PathIsDirectoryW

userenv

UnloadUserProfile

crypt32

CryptImportPublicKeyInfo CertGetCertificateChain CertVerifyCertificateChainPolicy CertGetNameStringW CertFreeCertificateChain CertCreateContext CertFreeCertificateContext CertNameToStrW CertDuplicateCertificateContext CertEnumCertificatesInStore CryptQueryObject

version

GetFileVersionInfoSizeW GetFileVersionInfoW

wintrust

WinVerifyTrust

Name

.text

Size

184KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.2rdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

40c9ae2e3cf8003a603318358c9151e6_JaffaCakes118

msi

kernel32

user32

advapi32

ole32

shell32

shlwapi

userenv

crypt32

version

wintrust

generic