f9c3968256f69ead7a751c744c88f498_JaffaCakes118

General

Target
f9c3968256f69ead7a751c744c88f498_JaffaCakes118
Size 503KB
Sample241218-c2jddazrbq
SHA256 69ac14ed2f1e37e37c70d7d60bd299703931017c43f5166055a43a651882c83d
MD5 f9c3968256f69ead7a751c744c88f498
SHA1 67d3b742fef638fbd0ed3fe8803add3bceea868e
SHA512 c88ce86f2dce10a3d935ef1a7dde457aaa9b0d5c1f63d78dbe6d624b249ffbb2d1d0fb993ed39c18719e627306877f8490553184344a3e168bafa97673970d67
SSDEEP 6144:RCD5te5vKgjyshbEuKNIl361EVTHzdokGZ9gNJyxLldvGm7knGyHM:UNEJK2p4uletZaYLlfI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9c3968256f69ead7a751c744c88f498_JaffaCakes118

File Explorer

f9c3968256f69ead7a751c744c88f498_JaffaCakes118

.exe 503KB

f9c3968256f69ead7a751c744c88f498_JaffaCakes118

IMPHASH d01336643bf96b29567aa2447e71141a
SHA256 69ac14ed2f1e37e37c70d7d60bd299703931017c43f5166055a43a651882c83d
MD5 f9c3968256f69ead7a751c744c88f498
SHA1 67d3b742fef638fbd0ed3fe8803add3bceea868e
SHA512 c88ce86f2dce10a3d935ef1a7dde457aaa9b0d5c1f63d78dbe6d624b249ffbb2d1d0fb993ed39c18719e627306877f8490553184344a3e168bafa97673970d67
SSDEEP 6144:RCD5te5vKgjyshbEuKNIl361EVTHzdokGZ9gNJyxLldvGm7knGyHM:UNEJK2p4uletZaYLlfI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kobudu88.pdb

kernel32

lstrlenA MoveFileExW InterlockedDecrement WritePrivateProfileSectionA ReadConsoleOutputAttribute GetProfileStringW GetUserDefaultLCID WaitForSingleObject GetComputerNameW SetEvent IsBadReadPtr GetConsoleAliasesLengthA ReadConsoleOutputA GetUserDefaultLangID InitializeCriticalSection GetVolumePathNameW GetConsoleCP LocalShrink GetSystemWindowsDirectoryA InterlockedPopEntrySList LeaveCriticalSection lstrcpynW GetConsoleAliasW SetConsoleCursorPosition GetFileAttributesW WriteConsoleW ReadFile CreateFileW CreateActCtxA GetACP VerifyVersionInfoW GetLastError SetLastError GetProcAddress PeekConsoleInputW EnumDateFormatsExA GetConsoleDisplayMode GetProcessId LocalAlloc DeleteTimerQueue DnsHostnameToComputerNameA CreateTapePartition SetFileApisToANSI GlobalGetAtomNameW SetSystemTime SetEnvironmentVariableA SetConsoleTitleW GetModuleHandleA lstrcatW UpdateResourceW CancelTimerQueueTimer GetConsoleTitleW BuildCommDCBA VirtualProtect SetCalendarInfoA EndUpdateResourceA GetVersionExA FindFirstVolumeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount VirtualAlloc HeapReAlloc HeapSize GetCPInfo GetOEMCP IsValidCodePage GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

RealGetWindowClassA

Sharing

General

Malware Config

Signatures

File Explorer

f9c3968256f69ead7a751c744c88f498_JaffaCakes118

kernel32

user32

generic