845e11334f4125815fb64641b866d764_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
845e11334f4125815fb64641b866d764_JaffaCakes118
Size 210KB
Sample241101-l4pgva1mgl
SHA256 b065af195b8b94be76fdf7fbba48ee335352c32818749108bbb1ccb42d1f3c2a
MD5 845e11334f4125815fb64641b866d764
SHA1 a74e8734428144da9e19dfa4d7e559b76205fd7d
SHA512 779bf21fb567360f33add38bfb240e157c33f47cc1816473847335c6ae255ede07f574c551c77ae975558c7dac9dd7c9ee0fda6367bf49aa991e9a945e14019a
SSDEEP 6144:Z7xbm2ovXZr6nwnkrJjA1uWuS05Nw3rlkq9xPgLO:Z7xkQrJ2oEOWqC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
845e11334f4125815fb64641b866d764_JaffaCakes118

File Explorer

845e11334f4125815fb64641b866d764_JaffaCakes118

.exe 210KB

845e11334f4125815fb64641b866d764_JaffaCakes118

IMPHASH 125115444f0d0181ff7cf65b4d28d544
SHA256 b065af195b8b94be76fdf7fbba48ee335352c32818749108bbb1ccb42d1f3c2a
MD5 845e11334f4125815fb64641b866d764
SHA1 a74e8734428144da9e19dfa4d7e559b76205fd7d
SHA512 779bf21fb567360f33add38bfb240e157c33f47cc1816473847335c6ae255ede07f574c551c77ae975558c7dac9dd7c9ee0fda6367bf49aa991e9a945e14019a
SSDEEP 6144:Z7xbm2ovXZr6nwnkrJjA1uWuS05Nw3rlkq9xPgLO:Z7xkQrJ2oEOWqC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDefaultLCID ReadFile GlobalGetAtomNameW GetModuleFileNameA FatalAppExitW CreateMutexA GetModuleHandleA FindAtomA GetUserDefaultLCID OpenMutexA GetLogicalDrives GetTempFileNameA Beep ReadDirectoryChangesW DisconnectNamedPipe CreateSemaphoreW OpenSemaphoreW GetEnvironmentVariableA CompareStringW lstrlenA SetPriorityClass GetCommandLineW GetSystemDirectoryA GlobalGetAtomNameA lstrcpynA GetCPInfo FindResourceA OpenWaitableTimerW QueryPerformanceCounter EnumTimeFormatsA SetCurrentDirectoryA IsBadCodePtr GetTimeFormatA lstrcmp GetVersion CreateFileA EndUpdateResourceW SetCurrentDirectoryW lstrcpyA GetTimeFormatW CopyFileExW IsValidCodePage GetCalendarInfoW GetTempFileNameW ExitProcess GetComputerNameA GetProcAddress DosDateTimeToFileTime GetSystemTime lstrcpyW GetSystemDefaultLangID ExpandEnvironmentStringsW OpenWaitableTimerA GetCurrentProcess CreateFileMappingA

user32

GetMessageW SetWindowTextA SetParent GetClassInfoExA GetWindowLongA SetTimer IsWindowEnabled TrackPopupMenuEx SetCursor SendDlgItemMessageA RegisterClassExA GetActiveWindow GetDlgItemTextA CharNextW CheckMenuRadioItem FillRect CreateDesktopA CreateDialogIndirectParamA LoadCursorW DefDlgProcA CreateWindowExW InsertMenuA GetClassLongW

gdi32

ExtCreateRegion Ellipse GetDeviceCaps GetAspectRatioFilterEx SetAbortProc SelectBrushLocal SetArcDirection FloodFill CreateDCA GetSystemPaletteEntries FillPath GetCharWidthFloatW AnimatePalette ExtFloodFill ExcludeClipRect

advapi32

RegReplaceKeyA RegOpenKeyExA RegQueryValueA RegOpenKeyExW RegCreateKeyExA RegDeleteKeyA RegDeleteValueA

oleaut32

VarCyCmp VariantChangeTypeEx VarI4FromStr VarUI1FromI4

inetcomm

CreatePOP3Transport MimeOleSMimeCapsToDlg MimeOleGetDefaultCharset EssSecurityLabelEncodeEx MimeOleGenerateFileName MimeOleGetPropW CreateIMAPTransport MimeOleObjectFromMoniker EssMLHistoryDecodeEx EssSecurityLabelDecodeEx MimeOleSetPropW EssMLHistoryEncodeEx MimeOleOpenFileStream HrDoAttachmentVerb HrSaveAttachToFile CreateRangeList MimeOleGenerateMID MimeOleGetRelatedSection

sqlunirl

_SendMessage@16 _ClearEventLog_@8 _RegReplaceKey_@16 _FindExecutable_@12 _RegUnLoadKey_@8 _ShellExecute_@24 _PeekMessage@20 _lstrcpyn_@12 _ReadConsoleInput_@16 _OpenWaitableTimer_@12 _RegEnumValue_@32 _GetWindowTextLength@4

crypt32

PFXVerifyPassword CertSerializeCRLStoreElement CertEnumCTLContextProperties CertAddCTLContextToStore CertNameToStrA CryptEncryptMessage CryptGetKeyIdentifierProperty RegEnumValueU CryptVerifyMessageSignature CryptSetOIDFunctionValue CryptRegisterOIDFunction CryptSIPCreateIndirectData CryptSIPPutSignedDataMsg CertAddEnhancedKeyUsageIdentifier CertAddEncodedCRLToStore

Name

.text

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.qRTHoW

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vVVua

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.MCS

Size

512B

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SdGAP

Size

4KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xa

Size

1KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Avk

Size

1KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.OOSv

Size

1KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.KPO

Size

1KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

845e11334f4125815fb64641b866d764_JaffaCakes118

kernel32

user32

gdi32

advapi32

oleaut32

inetcomm

sqlunirl

crypt32

generic