JaffaCakes118_04d36a03d0672b6bd208e1494ab2f8ffebf60c2cc10005a8da199dad9e89fc53
- SHA256 04d36a03d0672b6bd208e1494ab2f8ffebf60c2cc10005a8da199dad9e89fc53
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
lb777.exe
Resource
win7-20241010-en
windows7-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
lb777.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target JaffaCakes118_04d36a03d0672b6bd208e1494ab2f8ffebf60c2cc10005a8da199dad9e89fc53
- Size 156KB
- Sample241222-flzbfavlfm
- SHA256 04d36a03d0672b6bd208e1494ab2f8ffebf60c2cc10005a8da199dad9e89fc53
- MD5 c5c962823a76a2b95b7b86fe7a4699bc
- SHA1 34c8cf4d7a6bf9509d0b5bc2eb321aba6cecb7b0
- SHA512 e4c294e0888559b44ce021a348033637cd90943cd23f94b3d341ac35d998a4e9a4c4f8fe6942556e122a102d37b69d632853d1001d38aec28301df8873e2501e
- SSDEEP 3072:2U1jjNFTB7p8prBm3Gy4XSnUKdAj9m7iaWPCpcImyyg:2o3Nb7p8pr82y4XSncjWjKyX
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/lb777.bin
File Explorer
-
JaffaCakes118_04d36a03d0672b6bd208e1494ab2f8ffebf60c2cc10005a8da199dad9e89fc53.zip 156KB
-
lb777.bin.exe 231KB
lb777.bin
- IMPHASH 2465707e827cc6922177fd5db0a18593
- SHA256 a39ffdc433fc726128c22452dd70b8b3407cc9db02a90307b937e8ab4a3aae97
- MD5 fe49d7d1ebd25845774acc939b6aad3b
- SHA1 28c7959a129cb4549985ba4cea38993e92cbe478
- SHA512 f5fa1dcc51639e1230620665c5466adefd85ef95570793a0464857fde496acd3d0bddb88436fb034dea33d05142687e6fdf3f4015e43687779ffc14e0db97384
- SSDEEP 3072:f6/mwNj47XTyfvWyeBukAHm+cjCbhMsGjxPUC87vazsf3salBZdDmeVsPH:SbeTTyfvphBPcjCbGsGqC87rtbQTf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
29701
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapAlloc
WriteTapemark
ReadConsoleA
WaitNamedPipeA
ZombifyActCtx
GetEnvironmentStringsW
SetTapeParameters
GetModuleHandleW
GetTickCount
GetConsoleTitleA
WriteFile
GlobalAlloc
ReadConsoleInputA
FreeConsole
GetSystemWindowsDirectoryA
SetConsoleCP
GetFileAttributesW
LocalReAlloc
GetAtomNameW
GetDevicePowerState
ReleaseActCtx
GetCPInfoExW
GetProcAddress
CreateConsoleScreenBuffer
BeginUpdateResourceW
HeapUnlock
InterlockedExchangeAdd
BuildCommDCBAndTimeoutsW
SetConsoleWindowInfo
FoldStringW
GetModuleFileNameA
CreateMutexA
DeleteCriticalSection
GetWindowsDirectoryW
QueryDepthSList
lstrcpyW
CommConfigDialogW
CreateFileW
WriteConsoleW
lstrcpynA
SetDefaultCommConfigA
HeapReAlloc
VerifyVersionInfoA
PulseEvent
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
GetLastError
HeapFree
RtlUnwind
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetFilePointer
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
MultiByteToWideChar
LoadLibraryW
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringW
CloseHandle
user32
GetAncestor
advapi32
BackupEventLogW
NotifyChangeEventLog
RegQueryValueExA
CloseEventLog
Name
.text
Size
158KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
46.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.kicaxi
Size
512B
Virtual Size
1B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=21, id=158, productName=VS2010 build 30319, version=30319,
count=38, id=171, productName=VS2010 build 30319, version=30319,
count=107, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=132, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,