JaffaCakes118_350c038a1e1d9c2eed1f94fac6f7cab62266bffe9c26c7d7387f27d69c378b42

General

Target
JaffaCakes118_350c038a1e1d9c2eed1f94fac6f7cab62266bffe9c26c7d7387f27d69c378b42
Size 680KB
Sample241222-lm8jdssrew
SHA256 350c038a1e1d9c2eed1f94fac6f7cab62266bffe9c26c7d7387f27d69c378b42
MD5 0b2eb756e539c9d45895e1d1b92c9f89
SHA1 bcb1c7d4298c5798b15a2867fff9d5134084d46c
SHA512 6c171d83d39ab9adb05fd6d51a1cb76ba16e2774ad236be3d7719dfdcae0a42c1bd242123d601e363a8f3858207c711c6937a746e01ac0caba5a53aa8e204fec
SSDEEP 12288:vyMOwpKVYet+hMGrztpVCwRZbwiPdb0OpQ3OAr+9H4CWqliB/13Hngcp40ImMvPd:vGaeMhMQRpYwf/lQF3OC+F4CHcG0IT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/sample

File Explorer

JaffaCakes118_350c038a1e1d9c2eed1f94fac6f7cab62266bffe9c26c7d7387f27d69c378b42

.gz 680KB
sample

.exe 824KB

JaffaCakes118_350c038a1e1d9c2eed1f94fac6f7cab62266bffe9c26c7d7387f27d69c378b42

SHA256 350c038a1e1d9c2eed1f94fac6f7cab62266bffe9c26c7d7387f27d69c378b42
MD5 0b2eb756e539c9d45895e1d1b92c9f89
SHA1 bcb1c7d4298c5798b15a2867fff9d5134084d46c
SHA512 6c171d83d39ab9adb05fd6d51a1cb76ba16e2774ad236be3d7719dfdcae0a42c1bd242123d601e363a8f3858207c711c6937a746e01ac0caba5a53aa8e204fec
SSDEEP 12288:vyMOwpKVYet+hMGrztpVCwRZbwiPdb0OpQ3OAr+9H4CWqliB/13Hngcp40ImMvPd:vGaeMhMQRpYwf/lQF3OC+F4CHcG0IT
MD5 SHA1 SHA512 SSDEEP

sample

IMPHASH e83b007bebc757d28ed3361827c763fb
SHA256 eb7decebf8226f98cd64580f6ab6d001ddf7dc1c7cd28cd3c6175c505b13dc2f
MD5 24c8011aeb1714e43f7eea47dbfa1daa
SHA1 44012799fcfd02ac89a4469a047c72f3bb9485ba
SHA512 d771c86573f5051610e3bc14030614df56741fa1c2bdd3304a5088e99335b9fb2cada32d8f3d43dce74f12eba3e8946206247f480c0f06d7d516f700759fa9ee
SSDEEP 24576:SvlXzMoyhMQZF4w/ZR+B3OG+FSyHQiA/tB:4ljMoerFRa+GmvHQiA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

25794

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mivu\himurusosez22 xen\11_topesiro huvaxenuwez cafocay\bab.pdb

kernel32

FreeLibrary InitializeSListHead GetModuleHandleW GetConsoleAliasesA InitializeCriticalSection LoadLibraryW WriteConsoleW GetOverlappedResult ReleaseActCtx GetLastError GetProcAddress GetLongPathNameA lstrcpynA WriteProfileSectionA SetFileAttributesA WriteConsoleA LocalAlloc MoveFileA SetProcessWorkingSetSize GetModuleFileNameA WTSGetActiveConsoleSessionId EnumDateFormatsA GetConsoleTitleW GetShortPathNameW GetFileInformationByHandle ReadFile GetProcessHeap InterlockedIncrement InterlockedDecrement Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW HeapFree RtlUnwind HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType SetFilePointer RaiseException WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage GetStringTypeW MultiByteToWideChar WideCharToMultiByte GetConsoleCP GetConsoleMode HeapReAlloc CloseHandle CreateFileA SetStdHandle LCMapStringW FlushFileBuffers SetEndOfFile CreateFileW

winhttp

WinHttpSetDefaultProxyConfiguration

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_350c038a1e1d9c2eed1f94fac6f7cab62266bffe9c26c7d7387f27d69c378b42

sample

kernel32

winhttp

generic