82a8cefaea8e23b1c2081358482dcff4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
82a8cefaea8e23b1c2081358482dcff4_JaffaCakes118
Size 96KB
Sample241031-lxbbmswdkh
SHA256 7a2aa8c7ec38d13ea33f3832440f1d60d69424cc27bcd76360e4d24baf89bb06
MD5 82a8cefaea8e23b1c2081358482dcff4
SHA1 934ca32d0abea4a98ecac86ac6d1b60d61ed4655
SHA512 f857f3923f658084ab5c0ff0e87e61563a43460b03cfc0007d997f630e1a7da77a0176116396c5fa8000efda0206f322219ebdf31ef19dfffecff998a36b34be
SSDEEP 1536:eU7RJrqEIbuJUqrREcE5mKx4AP7hnaqNFNDHrSKACbD1hTdvjssqjcDPYrmEIT/J:eU7RJJtJUqrR/EbOAPNaINDOAlddvjf3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
82a8cefaea8e23b1c2081358482dcff4_JaffaCakes118

File Explorer

82a8cefaea8e23b1c2081358482dcff4_JaffaCakes118

.exe 96KB

82a8cefaea8e23b1c2081358482dcff4_JaffaCakes118

IMPHASH f6fb8c1a1cd71c635c85f4598c7c42d5
SHA256 7a2aa8c7ec38d13ea33f3832440f1d60d69424cc27bcd76360e4d24baf89bb06
MD5 82a8cefaea8e23b1c2081358482dcff4
SHA1 934ca32d0abea4a98ecac86ac6d1b60d61ed4655
SHA512 f857f3923f658084ab5c0ff0e87e61563a43460b03cfc0007d997f630e1a7da77a0176116396c5fa8000efda0206f322219ebdf31ef19dfffecff998a36b34be
SSDEEP 1536:eU7RJrqEIbuJUqrREcE5mKx4AP7hnaqNFNDHrSKACbD1hTdvjssqjcDPYrmEIT/J:eU7RJJtJUqrR/EbOAPNaINDOAlddvjf3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

qsort strstr _strcmpi NtQuerySystemInformation vsprintf memmove strrchr RtlUnicodeStringToAnsiString wcscmp RtlFreeAnsiString

setupapi

SetupGetLineTextA SetupOpenInfFileA SetupCloseInfFile

shell32

CommandLineToArgvW

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

msvcrt

_initterm __getmainargs _acmdln exit _cexit __setusermatherr _exit _c_exit malloc realloc free _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp _except_handler3 _XcptFilter

advapi32

SetFileSecurityA AllocateAndInitializeSid InitializeAcl InitializeSecurityDescriptor AddAce GetAclInformation SetSecurityDescriptorDacl SetFileSecurityW FreeSid RegOpenKeyExA RegQueryValueExA RegCloseKey RegSetValueExA RegisterEventSourceA ReportEventA DeregisterEventSource GetLengthSid CopySid

kernel32

CreateDirectoryA FindFirstFileA lstrcmpA SetFileAttributesA DeleteFileA MoveFileExA FindNextFileA FindClose RemoveDirectoryA WriteFile CopyFileA WaitForSingleObject GetExitCodeProcess CloseHandle GetCommandLineA GetCommandLineW GetModuleFileNameA GetCurrentProcessId GetWindowsDirectoryA GetLastError GlobalFree MoveFileA GetFileAttributesA VirtualFree VirtualAlloc GetLocalTime SetFilePointer CreateFileA HeapFree HeapAlloc GetProcessHeap DeviceIoControl SetEnvironmentVariableA GetVersionExA GetVolumeInformationW GetWindowsDirectoryW GetModuleHandleA GetStartupInfoA CreateProcessA

Sharing

General

Malware Config

Signatures

File Explorer

82a8cefaea8e23b1c2081358482dcff4_JaffaCakes118

ntdll

setupapi

shell32

version

msvcrt

advapi32

kernel32

generic