3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118

General

Target
3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118
Size 178KB
Sample241027-yw56vasern
SHA256 1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c
MD5 3c7dc6cd19e758840ed1aa76c8571f67
SHA1 5f7b02bd8c8854adfb132817f0edae1771bcdb72
SHA512 ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b
SSDEEP 3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118

File Explorer

3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118

.exe 178KB

3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118

IMPHASH 4298de65f805d20d62ca7927379d1fdd
SHA256 1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c
MD5 3c7dc6cd19e758840ed1aa76c8571f67
SHA1 5f7b02bd8c8854adfb132817f0edae1771bcdb72
SHA512 ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b
SSDEEP 3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

60076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

__WSAFDIsSet

ntdll

RtlCaptureContext RtlUnwindEx RtlCompareMemory RtlLookupFunctionEntry RtlPcToFileHeader RtlVirtualUnwind

shlwapi

StrToIntA StrToIntExA StrDupA StrStrA

kernel32

FreeEnvironmentStringsW WriteConsoleW HeapSize GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP lstrlenA lstrcatW lstrcpyW HeapFree HeapAlloc GetProcessHeap HeapReAlloc lstrcpyA lstrcmpiA lstrcpynA GetModuleHandleA GetProcAddress lstrcmpA WideCharToMultiByte LoadLibraryA GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx CloseHandle CreateFileW GetStringTypeW SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetConsoleMode GetLastError SetLastError EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile LCMapStringW GetFileType FlushFileBuffers GetConsoleCP

user32

wsprintfW wsprintfA

Name

.text

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118

ws2_32

ntdll

shlwapi

kernel32

user32

generic