68d148faccdf0e6f645770a14fed3451_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
68d148faccdf0e6f645770a14fed3451_JaffaCakes118
Size 1.5MB
Sample241022-ely51awdla
SHA256 8904f88cf4b3b67d7827332c4508495920e9313561da7480a0b0b32e530c059f
MD5 68d148faccdf0e6f645770a14fed3451
SHA1 0f31c9a524f984d4e454119c94ba8430a4f9a9ca
SHA512 afaf120c60de3535e91e46420b8270034ea7558e86790f496dbe2e766ec0ae2299255b5094325f6d0ae08beb487e0c79c83cb959a074db69745caa64c2ee8d57
SSDEEP 24576:JLJZoU7YgH4A2UBmRtgB5LK5YZhO24A7Tw6rnhDAJZDt3MO1xVTehWTI1/cqGxEQ:bYTOYgekj7trhMJZX1x4WTU1+wq8IP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

68d148faccdf0e6f645770a14fed3451_JaffaCakes118

.exe 1.5MB

68d148faccdf0e6f645770a14fed3451_JaffaCakes118

IMPHASH e6d12ae91805b1d98df7aa729a94dabf
SHA256 8904f88cf4b3b67d7827332c4508495920e9313561da7480a0b0b32e530c059f
MD5 68d148faccdf0e6f645770a14fed3451
SHA1 0f31c9a524f984d4e454119c94ba8430a4f9a9ca
SHA512 afaf120c60de3535e91e46420b8270034ea7558e86790f496dbe2e766ec0ae2299255b5094325f6d0ae08beb487e0c79c83cb959a074db69745caa64c2ee8d57
SSDEEP 24576:JLJZoU7YgH4A2UBmRtgB5LK5YZhO24A7Tw6rnhDAJZDt3MO1xVTehWTI1/cqGxEQ:bYTOYgekj7trhMJZX1x4WTU1+wq8IP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

50:2d:45:86:cf:fa:3d:b0:f5:f4:10:d2:ec:a0:a9:81:4b:33:cc:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=InstallX\, LLC,O=InstallX\, LLC,L=Sartell,ST=Minnesota,C=US

Chains

Oct 21, 2024

Minor OS version

Major OS version

Entry point

290877

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\tfs.vs2012\admin\windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\quickstart.pdb

kernel32

InterlockedDecrement ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind GetStdHandle WriteFile GetModuleFileNameW SetLastError InterlockedIncrement GetCurrentThread GetFileType GetStartupInfoW GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW OutputDebugStringW LoadLibraryW GetDateFormatW GetTimeFormatW CompareStringW GetCommandLineA GetConsoleCP GetConsoleMode SetFilePointerEx GetTempPathA WriteConsoleW FlushFileBuffers CreateFileW Process32Next Process32First CreateToolhelp32Snapshot OpenProcess CreateProcessA VirtualQuery GetLongPathNameA CloseHandle MultiByteToWideChar FileTimeToSystemTime SystemTimeToFileTime GetLocalTime WaitForSingleObject CreateMutexA RtlCaptureStackBackTrace ReleaseMutex WideCharToMultiByte Sleep GetTickCount GetCurrentThreadId SetUnhandledExceptionFilter GetLastError GetExitCodeProcess Module32First Module32Next GetVersionExA GetSystemInfo InitializeCriticalSectionAndSpinCount FindResourceExW FindResourceW LoadResource LockResource DecodePointer EncodePointer GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LCMapStringW GetFullPathNameA RaiseException SetEnvironmentVariableA ReadConsoleW ExitThread CreateThread DeleteFileW GetFileAttributesExW GetDiskFreeSpaceA CreateFileMappingA GetDiskFreeSpaceW LockFileEx GetTempPathW GetFileAttributesW FormatMessageW InitializeCriticalSection UnlockFileEx LockFile UnlockFile InterlockedCompareExchange SetEndOfFile UnmapViewOfFile MapViewOfFile GetFullPathNameW WritePrivateProfileStringA GetPrivateProfileIntA GetPrivateProfileStringA GetTimeZoneInformation SetEvent ResetEvent WaitForSingleObjectEx CreateEventA SetFilePointer ReadFile GetFileSize CreateFileA ExpandEnvironmentStringsA GetCurrentDirectoryA GetSystemDirectoryA SizeofResource SetStdHandle FormatMessageA GetModuleHandleA LocalAlloc lstrlenA LocalFree BeginUpdateResourceA UpdateResourceA EndUpdateResourceA LoadLibraryA EnumResourceNamesA EnumResourceLanguagesA FindResourceA LoadLibraryExA FindResourceExA GetUserDefaultUILanguage FindFirstFileA FindNextFileA FindClose CreateDirectoryA GetSystemTime GetTempFileNameA DeleteFileA RemoveDirectoryA SetFileAttributesA CopyFileA GetFileAttributesA GetWindowsDirectoryA

user32

IsWindow SetWindowTextA DestroyWindow UpdateWindow GetWindowTextA GetWindowTextLengthA SetWindowLongA GetWindowLongA PostMessageA SendMessageA ScreenToClient ClientToScreen SetWindowPos MessageBoxA SetTimer KillTimer GetParent SetForegroundWindow SetParent GetWindowRect GetClientRect MoveWindow MessageBoxExA LoadStringA EnumWindows IsWindowEnabled EnableWindow ShowWindow GetClassNameA EnumChildWindows GetSystemMetrics GetShellWindow FindWindowA GetDesktopWindow LoadCursorA CreateWindowExA GetClassInfoExA RegisterClassExA GetMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA CallWindowProcA DefWindowProcA LoadBitmapA LoadImageA SetCursor ReleaseCapture GetKeyboardState CreatePopupMenu DestroyMenu AppendMenuA LoadAcceleratorsA DialogBoxParamA CreateDialogParamA EndDialog GetDlgItem SendMessageW CopyRect InflateRect FrameRect BeginPaint EndPaint FindWindowExA InvalidateRect InvalidateRgn IsWindowVisible SetFocus GetWindowThreadProcessId TrackPopupMenu WaitForInputIdle SetDlgItemTextA GetCursorPos OffsetRect SystemParametersInfoA AdjustWindowRectEx SetClassLongA LoadIconA PostQuitMessage IsIconic GetFocus

oleaut32

SysAllocStringLen SysStringLen VariantInit VariantClear VariantChangeType SysAllocString SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SysFreeString

shlwapi

PathFindExtensionA PathRenameExtensionA PathStripPathA PathRemoveFileSpecA PathIsDirectoryEmptyA SHDeleteEmptyKeyA UrlEscapeA PathCombineA

comctl32

ImageList_Create InitCommonControlsEx ImageList_Add

shell32

ShellExecuteExA Shell_NotifyIconA SHGetSpecialFolderPathA

ole32

StringFromGUID2 CoCreateGuid CoCreateInstance CoTaskMemAlloc OleUninitialize CoInitializeSecurity OleInitialize CoTaskMemFree

psapi

GetModuleFileNameExA EnumProcesses

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

userenv

ExpandEnvironmentStringsForUserA

wininet

InternetReadFileExA InternetSetOptionA InternetErrorDlg InternetCrackUrlA InternetCanonicalizeUrlA InternetCombineUrlA InternetGetCookieA InternetSetCookieA FindCloseUrlCache InternetCloseHandle InternetOpenA InternetSetStatusCallback HttpQueryInfoA InternetConnectA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA

gdiplus

GdipDeleteGraphics GdipCreateFromHDC GdipSetCompositingMode

urlmon

IsValidURL

gdi32

GetStockObject CreateCompatibleDC CreateCompatibleBitmap PatBlt SetWindowOrgEx BitBlt DeleteDC SelectObject GetObjectA DeleteObject

advapi32

RegEnumKeyExA AdjustTokenPrivileges RevertToSelf OpenProcessToken GetTokenInformation IsValidSid GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority RegOpenCurrentUser RegOpenUserClassesRoot RegCloseKey RegCreateKeyExA RegOpenKeyExA GetLengthSid RegQueryValueExA RegSetValueExA RegDeleteValueA RegQueryInfoKeyA SetTokenInformation LookupPrivilegeValueA DuplicateTokenEx ImpersonateLoggedOnUser

Name

.text

Size

408KB

Virtual Size

407KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-qu

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-ti

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

512B

Virtual Size

59B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-qu

Size

512B

Virtual Size

41B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-ti

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

428KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

68d148faccdf0e6f645770a14fed3451_JaffaCakes118

PE Signature issue

kernel32

user32

oleaut32

shlwapi

comctl32

shell32

ole32

psapi

version

userenv

wininet

gdiplus

urlmon

gdi32

advapi32

generic