c5e621bfac711e041543ddc7a2ab1974_JaffaCakes118

General

Target
c5e621bfac711e041543ddc7a2ab1974_JaffaCakes118
Size 504KB
Sample241205-e2syxsynas
SHA256 0503af61fcc1260a86771eb486d9f01df5ca37f3634d248c739322dcba03ae7b
MD5 c5e621bfac711e041543ddc7a2ab1974
SHA1 d39a416b9538a8640d92b35537ed0c0022cf7cfc
SHA512 2869f1420f1573052a1e58c8a363461823e00f42ed6749ba4ff01684c6f636175514aab848235dfb8558b6865d07e500a4520fa525cde754dc03fa39a1983fa6
SSDEEP 6144:qxyK6b7nMRDnRTTOiyXiWWDU6vkVYizSAclbQH80hc9a0rYbYa7FCOc7knGyHM:qxmbbanhTaXJWY9mZ9FzavbFwI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c5e621bfac711e041543ddc7a2ab1974_JaffaCakes118

File Explorer

c5e621bfac711e041543ddc7a2ab1974_JaffaCakes118

.exe 504KB

c5e621bfac711e041543ddc7a2ab1974_JaffaCakes118

IMPHASH 4b405a935ba1896da801696a6c1a4ade
SHA256 0503af61fcc1260a86771eb486d9f01df5ca37f3634d248c739322dcba03ae7b
MD5 c5e621bfac711e041543ddc7a2ab1974
SHA1 d39a416b9538a8640d92b35537ed0c0022cf7cfc
SHA512 2869f1420f1573052a1e58c8a363461823e00f42ed6749ba4ff01684c6f636175514aab848235dfb8558b6865d07e500a4520fa525cde754dc03fa39a1983fa6
SSDEEP 6144:qxyK6b7nMRDnRTTOiyXiWWDU6vkVYizSAclbQH80hc9a0rYbYa7FCOc7knGyHM:qxmbbanhTaXJWY9mZ9FzavbFwI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xucis 85_rawef.pdb

kernel32

GetComputerNameA lstrlenA LocalCompact MoveFileExW InterlockedDecrement WritePrivateProfileSectionA ReadConsoleOutputAttribute GetProfileStringW GetUserDefaultLCID SetEvent IsBadReadPtr GetConsoleAliasesLengthA ReadConsoleOutputA InitializeCriticalSection GetVolumePathNameW GetConsoleCP GetSystemWindowsDirectoryA InterlockedPopEntrySList LeaveCriticalSection lstrcpynW GetConsoleAliasW SetConsoleCursorPosition GetFileAttributesW WriteConsoleW ReadFile CreateFileW CreateActCtxA GetACP VerifyVersionInfoW GetLastError GetProcAddress PeekConsoleInputW EnumDateFormatsExA GetConsoleDisplayMode GetProcessId LocalAlloc DeleteTimerQueue DnsHostnameToComputerNameA CreateTapePartition GlobalGetAtomNameW WaitForMultipleObjects SetSystemTime SetEnvironmentVariableA SetConsoleTitleW GetModuleHandleA lstrcatW UpdateResourceW CancelTimerQueueTimer GetConsoleTitleW BuildCommDCBA VirtualProtect SetCalendarInfoA FindFirstVolumeA EndUpdateResourceA GetVersionExA AreFileApisANSI UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount VirtualAlloc HeapReAlloc HeapSize GetCPInfo GetOEMCP IsValidCodePage GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

RealGetWindowClassA

Sharing

General

Malware Config

Signatures

File Explorer

c5e621bfac711e041543ddc7a2ab1974_JaffaCakes118

kernel32

user32

generic