4e9769d9d4bfc45bf9b7e64e13e4b8c3_JaffaCakes118

General

Target
4e9769d9d4bfc45bf9b7e64e13e4b8c3_JaffaCakes118
Size 137KB
Sample241016-x3fdbsxepd
SHA256 b816bcdd8bafe5e2d2939a4e9b00da81c5c47b285b1da65b74a3094386052be6
MD5 4e9769d9d4bfc45bf9b7e64e13e4b8c3
SHA1 14a048ba501d96ef00dce0a1e20cf177e6ebb48f
SHA512 6617a701bc25ffffc113c7bc07f045d5de3ee789140e508ffd0ca050a19ed09b437686cb20aecb7e10aaa00dc27bde26b190da634f90c827c0d349623f36de15
SSDEEP 3072:eyzMO9omCwgrABYQ7OPwRQRdsFCtmIFxkvb/e2GO7ZH:DzfvEABb7O4iRbmI/0RG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e9769d9d4bfc45bf9b7e64e13e4b8c3_JaffaCakes118

File Explorer

4e9769d9d4bfc45bf9b7e64e13e4b8c3_JaffaCakes118

.exe 137KB

4e9769d9d4bfc45bf9b7e64e13e4b8c3_JaffaCakes118

IMPHASH 629a71d885440f1962b44654b6a4fc49
SHA256 b816bcdd8bafe5e2d2939a4e9b00da81c5c47b285b1da65b74a3094386052be6
MD5 4e9769d9d4bfc45bf9b7e64e13e4b8c3
SHA1 14a048ba501d96ef00dce0a1e20cf177e6ebb48f
SHA512 6617a701bc25ffffc113c7bc07f045d5de3ee789140e508ffd0ca050a19ed09b437686cb20aecb7e10aaa00dc27bde26b190da634f90c827c0d349623f36de15
SSDEEP 3072:eyzMO9omCwgrABYQ7OPwRQRdsFCtmIFxkvb/e2GO7ZH:DzfvEABb7O4iRbmI/0RG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5065

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_lclose GetLastError ExitThread GetStringTypeW HeapAlloc CreateActCtxA GetModuleHandleA DeleteTimerQueueEx FreeLibrary WriteConsoleW lstrlenA LoadLibraryW VirtualAlloc GetProcAddress OutputDebugStringA VirtualFree GetCurrentProcess CopyLZFile GetWindowsDirectoryA FindFirstFileW VirtualProtect

msvcrt

iswgraph fprintf __p__commode wcscat _iob srand _onexit fclose _initterm fflush swprintf wcsncat realloc _purecall strchr _vsnprintf __set_app_type wcslen free memcpy wcscmp _cexit wcscpy swscanf _wtol _acmdln wcsncpy

user32

CopyRect LoadMenuW BeginPaint DispatchMessageW RegisterClassA ClientToScreen MapWindowPoints GetMenuItemCount DestroyWindow CheckDlgButton DialogBoxParamA GetCursorPos ScreenToClient SendMessageA SetCapture LoadImageW SendMessageW ReleaseCapture wsprintfW ReleaseDC UnregisterClassW LoadCursorW IsWindow SetScrollPos GetProcessWindowStation LoadCursorA GetParent

gdi32

SetBkMode CreateBitmap PatBlt CreateFontIndirectW Rectangle TranslateCharsetInfo RestoreDC CreateCompatibleDC StretchBlt SetTextColor

opengl32

glTexCoord2dv glColor4i glStencilMask glFogfv wglShareLists glColor3ui glTexCoord2d GlmfBeginGlsBlock glColor4f glColor4d

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.crt

Size

512B

Virtual Size

17B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

106B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4e9769d9d4bfc45bf9b7e64e13e4b8c3_JaffaCakes118

kernel32

msvcrt

user32

gdi32

opengl32

generic