5c373c2116ab4a615e622f577e22e9be_JaffaCakes118

General

Target
5c373c2116ab4a615e622f577e22e9be_JaffaCakes118
Size 304KB
Sample241019-mnkdmatdnl
SHA256 0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493
MD5 5c373c2116ab4a615e622f577e22e9be
SHA1 ea940cc09b54b9ec060e65d9ccc3a00c3cb00921
SHA512 0d015fce2a7caa87f51b298f3dcce96875b3e6c710b9f9fd0b440a8b889c4f0e7fb5cf7112a4bef9c3d54d3c03e398df894b7ee2289c5539192ca02655311f59
SSDEEP 6144:Y5KVAtFaFoGI0fJtnnDeCXhc0pASzJBjo:Y5Ky7aGGVznD7XFLJBjo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c373c2116ab4a615e622f577e22e9be_JaffaCakes118

File Explorer

5c373c2116ab4a615e622f577e22e9be_JaffaCakes118

.dll 304KB

5c373c2116ab4a615e622f577e22e9be_JaffaCakes118

IMPHASH 23a7dbe071e826457a9ee2eac6296f32
SHA256 0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493
MD5 5c373c2116ab4a615e622f577e22e9be
SHA1 ea940cc09b54b9ec060e65d9ccc3a00c3cb00921
SHA512 0d015fce2a7caa87f51b298f3dcce96875b3e6c710b9f9fd0b440a8b889c4f0e7fb5cf7112a4bef9c3d54d3c03e398df894b7ee2289c5539192ca02655311f59
SSDEEP 6144:Y5KVAtFaFoGI0fJtnnDeCXhc0pASzJBjo:Y5Ky7aGGVznD7XFLJBjo
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

108384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDeriveKey CryptImportKey CryptEncrypt CryptReleaseContext CryptDestroyKey CryptDestroyHash CryptDecrypt

kernel32

GetLastError DeleteFileW SetLastError IsBadReadPtr LoadLibraryA OutputDebugStringA OutputDebugStringW WideCharToMultiByte MultiByteToWideChar GetProcAddress ExitProcess FileTimeToSystemTime GetFileType GetFileInformationByHandle GetSystemTime GetLocalTime SystemTimeToFileTime GetFileSize SetFilePointer ReadFile FileTimeToDosDateTime GetCurrentProcess CreateFileW CreateFileMappingW MapViewOfFile CloseHandle UnmapViewOfFile WriteFile FindFirstFileW FindNextFileW FindClose InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection Sleep GetStringTypeW IsDebuggerPresent IsProcessorFeaturePresent HeapReAlloc HeapFree GetSystemTimeAsFileTime GetCommandLineA GetCurrentThreadId RaiseException RtlUnwind HeapAlloc InitializeCriticalSectionAndSpinCount GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree TerminateProcess GetStartupInfoW GetModuleHandleW SetStdHandle GetStdHandle InitOnceExecuteOnce GetConsoleCP GetConsoleMode ReadConsoleW GetProcessHeap IsValidCodePage GetACP GetOEMCP GetModuleFileNameW GetModuleHandleExW HeapSize SetFilePointerEx FlushFileBuffers GetTimeZoneInformation GetModuleFileNameA QueryPerformanceCounter GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringEx LCMapStringEx WriteConsoleW LoadLibraryExW LoadLibraryW SetEndOfFile SetEnvironmentVariableA

Name

.text

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

5c373c2116ab4a615e622f577e22e9be_JaffaCakes118

advapi32

kernel32

generic