9f65088f71e73c4cccd9b8f178dd8929_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
9f65088f71e73c4cccd9b8f178dd8929_JaffaCakes118
Size 350KB
Sample241126-da66ssxjfp
SHA256 e4abdfa09a913c7a45e7acc3e9944fa38dc36af6dd9feef3070e216ca6c51bed
MD5 9f65088f71e73c4cccd9b8f178dd8929
SHA1 eebf7cba8811876c66325dd79e9925d4fae703d8
SHA512 ddc0101637d54b38e3555dd0cec4501919b447efd3e5aa4f2c9def44b79c61140dc050d5731b405c126ae797c648f4ec4894ffef0531a22e0fedfa3cb1ccebb8
SSDEEP 6144:RukiCIXQRFUPRLLHpsn4k84JMWmaF0oc:R0vXqFMFHps4kReuz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f65088f71e73c4cccd9b8f178dd8929_JaffaCakes118

File Explorer

9f65088f71e73c4cccd9b8f178dd8929_JaffaCakes118

.exe 350KB

9f65088f71e73c4cccd9b8f178dd8929_JaffaCakes118

IMPHASH cbe4e98d1a8a97f8b718d29a2fd9a8aa
SHA256 e4abdfa09a913c7a45e7acc3e9944fa38dc36af6dd9feef3070e216ca6c51bed
MD5 9f65088f71e73c4cccd9b8f178dd8929
SHA1 eebf7cba8811876c66325dd79e9925d4fae703d8
SHA512 ddc0101637d54b38e3555dd0cec4501919b447efd3e5aa4f2c9def44b79c61140dc050d5731b405c126ae797c648f4ec4894ffef0531a22e0fedfa3cb1ccebb8
SSDEEP 6144:RukiCIXQRFUPRLLHpsn4k84JMWmaF0oc:R0vXqFMFHps4kReuz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36605

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Such\Fun\best\Both\Thousand\even\wintermatch.pdb

kernel32

HeapReAlloc LoadLibraryW WriteConsoleW SetStdHandle CreateFileW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID CloseHandle SetFilePointer CompareStringW GetTempPathA GetCurrentProcessId TlsAlloc GetCurrentDirectoryA GetModuleHandleA FindNextFileA GetModuleFileNameA WaitForMultipleObjects LoadLibraryA GetTempFileNameA GetProcAddress FindFirstFileA GetShortPathNameA MultiByteToWideChar GetEnvironmentVariableA GetFileAttributesA Sleep TlsSetValue GetWindowsDirectoryA WaitForSingleObject ExitProcess WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate TlsGetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetStringTypeW GetLocaleInfoW HeapSize GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetEnvironmentVariableA

user32

CallNextHookEx EnumWindows GetWindowLongA CreateWindowExA ReleaseDC DefWindowProcA GetClassInfoExA

gdi32

RestoreDC ExtTextOutA StartDocA Rectangle CreateFontIndirectA StartPage

comctl32

ImageList_Remove ImageList_GetImageCount ImageList_SetBkColor ImageList_SetIconSize ImageList_Destroy

shlwapi

StrRetToBufA StrCmpNA StrStrA UrlIsA PathCreateFromUrlA

advapi32

RegCloseKey RegEnumKeyA RegOpenKeyA FreeSid OpenSCManagerA AllocateAndInitializeSid QueryServiceStatus RegOpenKeyExA RegCreateKeyExA LookupPrivilegeValueA InitializeSecurityDescriptor RegDeleteKeyA RegQueryValueExA RegisterServiceCtrlHandlerA RegSetValueExA GetTokenInformation SetEntriesInAclA OpenThreadToken DeleteService StartServiceCtrlDispatcherA OpenProcessToken OpenServiceA

Sharing

General

Malware Config

Signatures

File Explorer

9f65088f71e73c4cccd9b8f178dd8929_JaffaCakes118

kernel32

user32

gdi32

comctl32

shlwapi

advapi32

generic