60eed08bdc53986d9043451245b35496_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
60eed08bdc53986d9043451245b35496_JaffaCakes118
Size 10.5MB
Sample241020-hr9epsvenc
SHA256 8447fcdd082afb9a2432a14609d924bed51a6acd45464f60eba697a2189e9b5a
MD5 60eed08bdc53986d9043451245b35496
SHA1 eb95c43e9090ba5259274b679bf4de24fd629c6f
SHA512 ddffeb4693f738190b2514b3be96f0665eb0b147b732e026afc7247666428935351e8dbbbda7fca597efac2b060cd259e76788244cf35064c5f60f36e2514875
SSDEEP 98304:a1Hs3oV4DoiaQZlYgYHvA2+V5tAXeoz2yrvM0pbhm6RPCEVZkz4YbRlfcHVQ2khD:a1M484gYGVMRHmQPTZTIbcHVSD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
60eed08bdc53986d9043451245b35496_JaffaCakes118

File Explorer

60eed08bdc53986d9043451245b35496_JaffaCakes118

.exe 10.5MB

60eed08bdc53986d9043451245b35496_JaffaCakes118

IMPHASH 08b2b759e2fdb8f29e60c592875ae04b
SHA256 8447fcdd082afb9a2432a14609d924bed51a6acd45464f60eba697a2189e9b5a
MD5 60eed08bdc53986d9043451245b35496
SHA1 eb95c43e9090ba5259274b679bf4de24fd629c6f
SHA512 ddffeb4693f738190b2514b3be96f0665eb0b147b732e026afc7247666428935351e8dbbbda7fca597efac2b060cd259e76788244cf35064c5f60f36e2514875
SSDEEP 98304:a1Hs3oV4DoiaQZlYgYHvA2+V5tAXeoz2yrvM0pbhm6RPCEVZkz4YbRlfcHVQ2khD:a1M484gYGVMRHmQPTZTIbcHVSD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mafipuxo_fovosizecozidabo dakoc.pdb

kernel32

WriteConsoleW GetSystemPowerStatus DeleteVolumeMountPointW GetDefaultCommConfigW CreateMutexW GetStdHandle InterlockedDecrement SetSystemTimeAdjustment FileTimeToSystemTime GetNamedPipeHandleStateW CallNamedPipeW EnumResourceNamesW BuildCommDCBAndTimeoutsA EnterCriticalSection DebugSetProcessKillOnExit EnumTimeFormatsW TlsSetValue GetACP WriteFile GetCurrentActCtx ReleaseActCtx AddRefActCtx GetHandleInformation OpenFile VerifyVersionInfoA GetVersionExA FreeLibrary LoadLibraryExW GetComputerNameA CommConfigDialogA VirtualProtect GetProcessPriorityBoost LoadLibraryW GlobalAlloc SetEndOfFile CancelWaitableTimer GetCurrentDirectoryW VirtualFree GetCommMask HeapFree RaiseException GetBinaryTypeA GlobalSize SetConsoleMode GetLargestConsoleWindowSize WriteConsoleInputW OpenMutexW SetThreadContext AddAtomW FindVolumeMountPointClose GetSystemTime GetCommandLineA SetLocalTime GetSystemTimeAsFileTime DisconnectNamedPipe SetConsoleCursorInfo TerminateProcess GetFileAttributesW GetLastError lstrlenA CompareStringW CompareStringA lstrcpyA CreateJobObjectW RtlUnwind GetStartupInfoA HeapAlloc LeaveCriticalSection SetHandleCount GetFileType DeleteCriticalSection GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA GetModuleHandleW TlsGetValue TlsAlloc TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetCurrentThread Sleep ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId FatalAppExitA VirtualAlloc HeapReAlloc InitializeCriticalSectionAndSpinCount GetCPInfo GetOEMCP IsValidCodePage MultiByteToWideChar HeapSize SetConsoleCtrlHandler InterlockedExchange LoadLibraryA GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale ReadFile SetFilePointer GetLocaleInfoW CloseHandle WriteConsoleA GetConsoleOutputCP SetStdHandle GetTimeZoneInformation CreateFileA SetEnvironmentVariableA

user32

GetComboBoxInfo

advapi32

ClearEventLogW

Name

.wrtddp

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.wcxuto

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.emsdwc

Size

325KB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.oqzjmz

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.lwgqto

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ubgiur

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nv_fatb

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rzatyj

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.zysibg

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

60eed08bdc53986d9043451245b35496_JaffaCakes118

kernel32

user32

advapi32

generic