500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118

General

Target
500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118
Size 194KB
Sample241017-bjjezsteqa
SHA256 1db938561f06adbe8fe35c140f9e834924bf99357a002166bc91a6de8ca46f9d
MD5 500b2c927713d8577a3e1e7a55123a3c
SHA1 c06a6ee3b009e910a56571334924b084f5ab7ac6
SHA512 1dd9eafe697cace9bae306bbd765aa0b23a14237de8133ed2401d2bccb699059ec146daf46d5aec2d32d60e7d50c5740bf4b9ca994fc1b0a88578881637c5dee
SSDEEP 1536:iemSTpI20clBAXu42VFgmoxsJA2krXlbpPCq1YhV5cRw3lau2lN5jazzOlfQkHRZ:nDTguSe4H2Al1EhV5cReauYqW5MzYp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118

File Explorer

500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118

.exe 194KB

500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118

IMPHASH 30e4b792b6b8ae5a334a9c9fb4ac52af
SHA256 1db938561f06adbe8fe35c140f9e834924bf99357a002166bc91a6de8ca46f9d
MD5 500b2c927713d8577a3e1e7a55123a3c
SHA1 c06a6ee3b009e910a56571334924b084f5ab7ac6
SHA512 1dd9eafe697cace9bae306bbd765aa0b23a14237de8133ed2401d2bccb699059ec146daf46d5aec2d32d60e7d50c5740bf4b9ca994fc1b0a88578881637c5dee
SSDEEP 1536:iemSTpI20clBAXu42VFgmoxsJA2krXlbpPCq1YhV5cRw3lau2lN5jazzOlfQkHRZ:nDTguSe4H2Al1EhV5cReauYqW5MzYp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18219

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\codes-svn\Sophia\Release\Sophia.pdb

wininet

InternetCloseHandle InternetOpenUrlA InternetReadFile InternetQueryDataAvailable HttpQueryInfoA HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA

kernel32

OpenProcess VirtualAllocEx WriteProcessMemory CreateRemoteThread GetModuleHandleA LoadLibraryA GetProcAddress CreateToolhelp32Snapshot Module32First Module32Next GetProcessId ExitProcess GetCurrentThread GetLastError GetCurrentProcess LocalAlloc LocalFree OpenMutexA CreateMutexA CreateThread GetModuleFileNameA GetWindowsDirectoryA CopyFileA Process32First Process32Next DeviceIoControl CloseHandle WriteFile CreateFileA GetVolumeInformationA GetVersionExA GetComputerNameA GetTempFileNameA GetTempPathA Sleep SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers WaitForSingleObject HeapAlloc HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetStdHandle GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetLocaleInfoA

advapi32

FreeSid AccessCheck IsValidSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid InitializeSecurityDescriptor AllocateAndInitializeSid DuplicateToken OpenProcessToken OpenThreadToken RegCloseKey RegSetValueExA RegCreateKeyExA GetUserNameA RegOpenKeyExA

shell32

ShellExecuteA

Sharing

General

Malware Config

Signatures

File Explorer

500b2c927713d8577a3e1e7a55123a3c_JaffaCakes118

wininet

kernel32

advapi32

shell32

generic