4afddd219dc8c243d138580df9cd7cea_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
4afddd219dc8c243d138580df9cd7cea_JaffaCakes118
Size 860KB
Sample241016-cqxrmaxfnc
SHA256 63c724085a2d7a0010f5d52883840f8a16c5ce055f3fdf5a74909265bd7a6565
MD5 4afddd219dc8c243d138580df9cd7cea
SHA1 9136b1a764aa44eebca15a39af456406af6820d2
SHA512 9960c3a46c335a6a6ac6298711864652af421c14bdd68f9d1dd9127d7d5d203612480eaf007de3ec92e5f2e8e493cb250dee11377abfb4e3db5a590a9e325771
SSDEEP 12288:3Byu5uy1DcMk+bJEZpZuYBjb1B8pXxY84V1qQKmymcdkVuJtFIXFLx8aCZgrIKa:34u5uCDHUu6P1BaXF4aFkVuhwLyaC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4afddd219dc8c243d138580df9cd7cea_JaffaCakes118

File Explorer

4afddd219dc8c243d138580df9cd7cea_JaffaCakes118

.exe 860KB

4afddd219dc8c243d138580df9cd7cea_JaffaCakes118

IMPHASH ec1ea8bb0f81830557219805e15debc0
SHA256 63c724085a2d7a0010f5d52883840f8a16c5ce055f3fdf5a74909265bd7a6565
MD5 4afddd219dc8c243d138580df9cd7cea
SHA1 9136b1a764aa44eebca15a39af456406af6820d2
SHA512 9960c3a46c335a6a6ac6298711864652af421c14bdd68f9d1dd9127d7d5d203612480eaf007de3ec92e5f2e8e493cb250dee11377abfb4e3db5a590a9e325771
SSDEEP 12288:3Byu5uy1DcMk+bJEZpZuYBjb1B8pXxY84V1qQKmymcdkVuJtFIXFLx8aCZgrIKa:34u5uCDHUu6P1BaXF4aFkVuhwLyaC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

435268

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d3d8thk

OsThunkD3dContextDestroy OsThunkDdDestroySurface OsThunkDdGetBltStatus OsThunkDdGetScanLine OsThunkDdUpdateOverlay OsThunkDdGetInternalMoCompInfo OsThunkDdGetFlipStatus OsThunkDdCreateMoComp OsThunkD3dDrawPrimitives2 OsThunkDdLock OsThunkDdCanCreateD3DBuffer OsThunkDdCreateSurface OsThunkDdFlipToGDISurface OsThunkDdAddAttachedSurface OsThunkDdRenderMoComp OsThunkDdCreateSurfaceObject OsThunkDdReenableDirectDrawObject OsThunkDdAlphaBlt OsThunkDdResetVisrgn OsThunkDdGetAvailDriverMemory OsThunkDdGetDC OsThunkDdCanCreateSurface OsThunkDdGetDriverState OsThunkDdCreateDirectDrawObject OsThunkD3dValidateTextureStageState OsThunkDdGetMoCompBuffInfo OsThunkDdWaitForVerticalBlank OsThunkDdAttachSurface OsThunkDdUnattachSurface OsThunkDdQueryMoCompStatus OsThunkDdGetDxHandle OsThunkD3dContextCreate OsThunkD3dContextDestroyAll

kernel32

CreateFileMappingA FillConsoleOutputCharacterW GetUserDefaultLCID LZClose SizeofResource GetTimeZoneInformation FindActCtxSectionGuid CreateProcessInternalW CancelDeviceWakeupRequest SetFileShortNameW BaseCleanupAppcompatCacheSupport lstrcat GetDefaultCommConfigA GetProfileStringA GetOEMCP GetProcessHeap IsValidLocale GetProfileIntA VirtualAlloc SetConsoleDisplayMode FreeResource IsValidCodePage GetConsoleKeyboardLayoutNameA WriteFile lstrcmpiA FindVolumeMountPointClose InterlockedFlushSList GetVolumePathNamesForVolumeNameW FatalExit HeapCreate GetVersion LoadLibraryA GetSystemWindowsDirectoryW DisconnectNamedPipe GetSystemTimeAsFileTime Process32FirstW FileTimeToSystemTime ActivateActCtx SetVolumeLabelW BaseInitAppcompatCacheSupport WriteProfileStringA GetLastError GetPrivateProfileIntW SetConsoleNumberOfCommandsA MulDiv FindResourceExW SwitchToThread LeaveCriticalSection GetCommConfig EnumDateFormatsExW ResetWriteWatch AttachConsole IsBadReadPtr GetSystemTimeAdjustment ReadConsoleOutputCharacterW PurgeComm SystemTimeToFileTime GlobalAddAtomA GetFullPathNameW lstrlenA ReadConsoleInputW GetExitCodeThread IsDebuggerPresent OpenEventW SetThreadLocale TlsFree CreateFileW MoveFileExW BaseDumpAppcompatCache GetConsoleDisplayMode HeapCompact GetMailslotInfo EnterCriticalSection GetConsoleWindow GetSystemWindowsDirectoryA GetProfileIntW

msvcrt

__getmainargs strtok _wcreat _findnexti64 _mbsdup _mbcasemap __setlc_active div _wtof _mbsnbcpy _strdate $I10_OUTPUT ?_query_new_handler@@YAP6AHI@ZXZ ??1exception@@UAE@XZ _ismbslead getc _spawnv _strrev _CIcosh _wfindfirsti64 ___unguarded_readlc_active_add_func _Gettnames strtol _wfindnext64 isgraph _wspawnlpe __set_app_type _set_sbh_threshold _lsearch __pctype_func _wasctime _ctime64 _adj_fdivr_m64 _wstati64 ??4bad_typeid@@QAEAAV0@ABV0@@Z exit _adj_fpatan __RTCastToVoid _putch realloc __p__commode _mbsnbcnt ?before@type_info@@QBEHABV1@@Z __argv _ismbbprint _spawnlp _mbsncat wcscspn

advapi32

WmiSetSingleInstanceW CredMarshalCredentialA CloseEncryptedFileRaw ReadEncryptedFileRaw RegRestoreKeyW RegSetValueW AddAccessAllowedObjectAce LogonUserExA GetUserNameA MakeAbsoluteSD RemoveTraceCallback WmiFileHandleToInstanceNameW SaferGetPolicyInformation CredWriteDomainCredentialsA EnumServicesStatusW BuildTrusteeWithObjectsAndSidW RegCreateKeyW LsaQuerySecret LsaDelete BuildSecurityDescriptorA CreateServiceA CryptAcquireContextA RegSetValueA AllocateAndInitializeSid AddAuditAccessAce AddAuditAccessObjectAce TraceEventInstance SystemFunction034 CryptDestroyHash

lz32

LZClose LZSeek LZRead LZOpenFileA LZDone LZStart CopyLZFile LZCopy LZOpenFileW GetExpandedNameA LZInit LZCloseFile

user32

EndDialog

Sharing

General

Malware Config

Signatures

File Explorer

4afddd219dc8c243d138580df9cd7cea_JaffaCakes118

d3d8thk

kernel32

msvcrt

advapi32

lz32

user32

generic