6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118
Size 1.8MB
Sample241022-flqpas1bjm
SHA256 801181c4b83bae110650f8ebff90e02a207659623ec884c9057b571618c5181a
MD5 6901a90704d24c86e6ce821c0caf3f7c
SHA1 43de6e052dd5c5e2e51df6834a957d71793ea541
SHA512 b92a59585bd5c2f80bb33979e12c1ea8b92fa8e1863a51c04a226c866f928adfbb572d66d2eaf6ed2003ae4e3884021a6244f5a602c48b4074db3028d2771c2a
SSDEEP 24576:gcocf49vcQKqrsu22upB+RFUcmSuf4VSjRv1vxOWnUL9K5b1w2TLjTJe65h8hDYM:gcPSMCP84VSjVO5LMR1w2Tb5hwKk
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118

.exe 1.8MB

6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118

IMPHASH de0f54c458140295e0c422baab2f210c
SHA256 801181c4b83bae110650f8ebff90e02a207659623ec884c9057b571618c5181a
MD5 6901a90704d24c86e6ce821c0caf3f7c
SHA1 43de6e052dd5c5e2e51df6834a957d71793ea541
SHA512 b92a59585bd5c2f80bb33979e12c1ea8b92fa8e1863a51c04a226c866f928adfbb572d66d2eaf6ed2003ae4e3884021a6244f5a602c48b4074db3028d2771c2a
SSDEEP 24576:gcocf49vcQKqrsu22upB+RFUcmSuf4VSjRv1vxOWnUL9K5b1w2TLjTJe65h8hDYM:gcPSMCP84VSjVO5LMR1w2Tb5hwKk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

8b:3c:48:59:76:64:69:b8:cb:87:1b:56:c0:f3:9e:97:fe:ab:1d:7f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=InstallX\, LLC,O=InstallX\, LLC,L=Sartell,ST=Minnesota,C=US

Chains

Oct 21, 2024

Minor OS version

Major OS version

Entry point

61161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\tfs.vs2012\admin\windows\MAIN\Installer.Desktop.Application\ReleaseNoMFC\FreezeWrapWin.pdb

comctl32

ImageList_Create InitCommonControlsEx ImageList_Add

kernel32

InitializeCriticalSection UnlockFileEx LockFile UnlockFile InterlockedCompareExchange UnmapViewOfFile MapViewOfFile GetFullPathNameW FormatMessageW GetFileAttributesW GetTempPathW LockFileEx InitializeCriticalSectionAndSpinCount MultiByteToWideChar GetPrivateProfileStringA GetPrivateProfileIntA CopyFileA SystemTimeToFileTime GetLocalTime WritePrivateProfileStringA WaitForSingleObject CreateMutexA ReleaseMutex RtlCaptureStackBackTrace SetUnhandledExceptionFilter GetTickCount GetDiskFreeSpaceW Sleep GetLastError FindResourceExW FindResourceW LoadResource LockResource SizeofResource CreateFileMappingA GetDiskFreeSpaceA GetFileAttributesExW SetEnvironmentVariableA SetEndOfFile WriteConsoleW FlushFileBuffers SetStdHandle LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryW OutputDebugStringW GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode GetStringTypeW DeleteFileW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetFileType GetCPInfo GetOEMCP GetACP IsValidCodePage WideCharToMultiByte GetCurrentThreadId GetModuleHandleW GetStartupInfoW RaiseException FormatMessageA GetModuleHandleA LocalAlloc lstrlenA LocalFree BeginUpdateResourceA HeapAlloc GetProcessHeap UpdateResourceA HeapFree EndUpdateResourceA LoadLibraryA EnumResourceNamesA EnumResourceLanguagesA FreeLibrary FindResourceA LoadLibraryExA FindResourceExA GetUserDefaultUILanguage GetTempPathA FindFirstFileA FindNextFileA FindClose CreateDirectoryA GetSystemTime GetTempFileNameA DeleteFileA RemoveDirectoryA SetFileAttributesA GetFileAttributesA MoveFileA GetModuleFileNameA GetCurrentDirectoryA GetFullPathNameA GetLongPathNameA CloseHandle GetPrivateProfileSectionNamesA CreateProcessA OpenProcess CreateToolhelp32Snapshot Process32First Process32Next TerminateProcess GetExitCodeProcess Module32First Module32Next GetProcAddress GetCurrentProcessId VirtualQuery GetCurrentThread GetCurrentProcess CreateEventA WaitForSingleObjectEx ResetEvent SetEvent FileTimeToSystemTime GetTimeZoneInformation CreateFileA GetFileTime FileTimeToLocalFileTime TzSpecificLocalTimeToSystemTime GetFileSize ReadFile WriteFile SetFilePointer GetVersionExA GetSystemInfo GetWindowsDirectoryA GetSystemDirectoryA ExpandEnvironmentStringsA GlobalMemoryStatus CreateFileW WaitForMultipleObjects EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapDestroy HeapReAlloc HeapSize EncodePointer DecodePointer InterlockedDecrement ExitProcess GetModuleHandleExW AreFileApisANSI IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineA CreateThread ExitThread LoadLibraryExW GetSystemTimeAsFileTime RtlUnwind GetStdHandle GetModuleFileNameW SetLastError InterlockedIncrement UnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

IsWindowEnabled GetWindowThreadProcessId FindWindowExA GetClassNameA EnumChildWindows GetSystemMetrics SystemParametersInfoA GetShellWindow FindWindowA GetDesktopWindow LoadCursorA CreateWindowExA GetClassInfoExA RegisterClassExA GetMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA CallWindowProcA DefWindowProcA LoadBitmapA LoadImageA SetCursor ReleaseCapture GetKeyboardState CreatePopupMenu DestroyMenu AppendMenuA TrackPopupMenu WaitForInputIdle SetDlgItemTextA AdjustWindowRectEx OffsetRect SetClassLongA EnumWindows DrawIcon ReleaseDC GetMessagePos CopyRect SendMessageW GetDlgItem EndDialog CreateDialogParamA DialogBoxParamA GetWindowTextLengthA SetWindowLongA GetWindowLongA PostMessageA SendMessageA LoadStringA InflateRect FrameRect SetWindowTextA BeginPaint EndPaint GetDlgCtrlID ScreenToClient ClientToScreen GetCursorPos EnableMenuItem GetSystemMenu SetWindowPos LoadIconA IsIconic GetFocus SetFocus IsWindowVisible SetTimer KillTimer GetParent GetSysColor LoadAcceleratorsA DestroyWindow MessageBoxA MessageBoxExA ShowWindow GetSysColorBrush GetWindowTextA GetDC PostQuitMessage EnableWindow SetForegroundWindow UpdateWindow IsWindow InvalidateRgn InvalidateRect MoveWindow GetClientRect GetWindowRect SetParent

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteExA

ole32

CoTaskMemAlloc CoUninitialize CoInitialize CoTaskMemFree CoInitializeEx StringFromGUID2 CoCreateInstance OleInitialize CoInitializeSecurity OleUninitialize CoCreateGuid

oleaut32

SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector SysAllocString VariantChangeType VariantClear VariantInit SysStringLen SysFreeString SysAllocStringLen SafeArrayDestroy

psapi

EnumProcesses GetModuleFileNameExA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

userenv

ExpandEnvironmentStringsForUserA

wininet

InternetConnectA HttpOpenRequestA HttpAddRequestHeadersA InternetOpenA HttpSendRequestA HttpQueryInfoA InternetSetStatusCallback InternetErrorDlg InternetSetOptionA InternetCrackUrlA InternetCanonicalizeUrlA InternetCombineUrlA InternetGetCookieA InternetSetCookieA FindFirstUrlCacheEntryA FindNextUrlCacheEntryA FindCloseUrlCache InternetCloseHandle InternetReadFileExA

shlwapi

PathCombineA PathFindExtensionA PathRenameExtensionA UrlEscapeA SHDeleteEmptyKeyA PathStripPathA PathRemoveFileSpecA PathIsDirectoryEmptyA

urlmon

IsValidURL

rpcrt4

UuidFromStringA

gdi32

CreateCompatibleBitmap CreateCompatibleDC GetStockObject SelectObject GetObjectA DeleteObject BitBlt SetWindowOrgEx PatBlt SetBkColor DeleteDC

advapi32

RegDeleteKeyA RegEnumValueA RegEnumKeyExA RevertToSelf OpenProcessToken GetTokenInformation IsValidSid GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority SetTokenInformation LookupPrivilegeValueA DuplicateTokenEx ImpersonateLoggedOnUser GetLengthSid AdjustTokenPrivileges RegOpenCurrentUser RegOpenUserClassesRoot RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegDeleteValueA RegQueryInfoKeyA

gdiplus

GdipSetCompositingMode GdipDeleteGraphics GdipCreateFromHDC

comdlg32

GetOpenFileNameA

Name

.text

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-de

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-ti

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

512B

Virtual Size

59B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text-co

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

371KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-de

Size

512B

Virtual Size

45B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-ti

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data-co

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118

PE Signature issue

comctl32

kernel32

user32

shell32

ole32

oleaut32

psapi

version

userenv

wininet

shlwapi

urlmon

rpcrt4

gdi32

advapi32

gdiplus

comdlg32

generic