531068090fef4f124b4b66c75d3c2635_JaffaCakes118

General

Target
531068090fef4f124b4b66c75d3c2635_JaffaCakes118
Size 504KB
Sample241017-w2ws9a1grp
SHA256 4db326a2737abb2f7822cebea35e82135f7577feb6ba7f0e5657afe2a0f3d0c9
MD5 531068090fef4f124b4b66c75d3c2635
SHA1 6d11c82cc37984e099cabb71bb87c9ac6f5ce1b5
SHA512 a80904209ba217f0eaf217e68a576ee67ce652760e278aaf66fd31aad28659f71d2b7790a7b7744a044a29b3df71b5c1147b64602ae4d69822b58ae4a238fdb6
SSDEEP 12288:OuFJ3FM5SxE/WxqdrBZ+FqZpQwqnSHKocJYrpI:OuL1MQ6jhGFwfqnSHKoc8pI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
531068090fef4f124b4b66c75d3c2635_JaffaCakes118

File Explorer

531068090fef4f124b4b66c75d3c2635_JaffaCakes118

.exe 504KB

531068090fef4f124b4b66c75d3c2635_JaffaCakes118

IMPHASH d3a683e5c9bc8c05c0c2f946c056969b
SHA256 4db326a2737abb2f7822cebea35e82135f7577feb6ba7f0e5657afe2a0f3d0c9
MD5 531068090fef4f124b4b66c75d3c2635
SHA1 6d11c82cc37984e099cabb71bb87c9ac6f5ce1b5
SHA512 a80904209ba217f0eaf217e68a576ee67ce652760e278aaf66fd31aad28659f71d2b7790a7b7744a044a29b3df71b5c1147b64602ae4d69822b58ae4a238fdb6
SSDEEP 12288:OuFJ3FM5SxE/WxqdrBZ+FqZpQwqnSHKocJYrpI:OuL1MQ6jhGFwfqnSHKoc8pI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wam.pdb

kernel32

GetComputerNameA lstrlenA WriteConsoleOutputCharacterA LocalCompact MoveFileExW InterlockedDecrement GetCurrentProcess WritePrivateProfileSectionA GetSystemWindowsDirectoryW GetUserDefaultLCID WriteConsoleInputA SetEvent IsBadReadPtr GetConsoleAliasesLengthA ReadConsoleOutputA GetUserDefaultLangID InitializeCriticalSection GetVolumePathNameW FindResourceExA GetConsoleCP GlobalAlloc InterlockedPopEntrySList LeaveCriticalSection DnsHostnameToComputerNameW lstrcpynW GetConsoleAliasW SetConsoleCursorPosition GetFileAttributesW WriteConsoleW ReadFile CreateFileW CreateActCtxA GetACP VerifyVersionInfoW GetCPInfoExW GetLastError GetProcAddress PeekConsoleInputW EnumDateFormatsExA GetConsoleDisplayMode DeleteTimerQueue CreateTapePartition GlobalGetAtomNameW WaitForMultipleObjects SetSystemTime SetEnvironmentVariableA SetConsoleTitleW GetModuleHandleA lstrcatW UpdateResourceW CancelTimerQueueTimer GetConsoleTitleW BuildCommDCBA VirtualProtect SetCalendarInfoA FindFirstVolumeA EndUpdateResourceA GetVersionExA ReadConsoleInputW DeleteFileW GetPrivateProfileSectionW AreFileApisANSI UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess IsDebuggerPresent HeapAlloc HeapFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount VirtualAlloc HeapReAlloc HeapSize GetCPInfo GetOEMCP IsValidCodePage GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

GetAltTabInfoW RealGetWindowClassA

Sharing

General

Malware Config

Signatures

File Explorer

531068090fef4f124b4b66c75d3c2635_JaffaCakes118

kernel32

user32

generic