JaffaCakes118_49dd8a16d3047c8a1d0b12f5179775e61bdf45b585e672a5b66bfab4dace0f89

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_49dd8a16d3047c8a1d0b12f5179775e61bdf45b585e672a5b66bfab4dace0f89
Size 299KB
Sample241222-ptp76syjfs
SHA256 49dd8a16d3047c8a1d0b12f5179775e61bdf45b585e672a5b66bfab4dace0f89
MD5 2d2caed4cbe8b934b47006ea0afdae52
SHA1 bfa6821af66ab22dcdcff90de4c0a1f20a0b6077
SHA512 fc27d1c30d7953d66c4f5dcc2a702e6780eb999fe7a9b2035696daf894c5549a9f52f89892c9b4f6708f36ffd87e0a1b05bf26790b5fa3213253b86233bc5de7
SSDEEP 3072:IdvQC1KyeOzo/ujVI5Oc6sQO5V7UFHeosqUOZWssdglsnhOuShs9nthQIP5Ylryt:G3EupTDO5VIFLLZWsegl+hOFYnUtT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_49dd8a16d3047c8a1d0b12f5179775e61bdf45b585e672a5b66bfab4dace0f89

File Explorer

JaffaCakes118_49dd8a16d3047c8a1d0b12f5179775e61bdf45b585e672a5b66bfab4dace0f89

.exe 299KB

JaffaCakes118_49dd8a16d3047c8a1d0b12f5179775e61bdf45b585e672a5b66bfab4dace0f89

IMPHASH bbdd2cf254995e4ca97a5ff76031c345
SHA256 49dd8a16d3047c8a1d0b12f5179775e61bdf45b585e672a5b66bfab4dace0f89
MD5 2d2caed4cbe8b934b47006ea0afdae52
SHA1 bfa6821af66ab22dcdcff90de4c0a1f20a0b6077
SHA512 fc27d1c30d7953d66c4f5dcc2a702e6780eb999fe7a9b2035696daf894c5549a9f52f89892c9b4f6708f36ffd87e0a1b05bf26790b5fa3213253b86233bc5de7
SSDEEP 3072:IdvQC1KyeOzo/ujVI5Oc6sQO5V7UFHeosqUOZWssdglsnhOuShs9nthQIP5Ylryt:G3EupTDO5VIFLLZWsegl+hOFYnUtT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

116832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\pukizemur\puj.pdb

kernel32

CallNamedPipeW TerminateThread GetExitCodeProcess GetVersionExA GetConsoleCP GetConsoleAliasesLengthW CommConfigDialogA FindFirstFileExA GetDriveTypeA FreeEnvironmentStringsA SetProcessPriorityBoost SetVolumeMountPointA GetLongPathNameA CopyFileW TlsGetValue SetConsoleCursorInfo GlobalHandle TzSpecificLocalTimeToSystemTime FindAtomA ReleaseSemaphore GetNamedPipeHandleStateA CreateMailslotW BuildCommDCBAndTimeoutsA VirtualProtect GetModuleHandleA LocalAlloc TryEnterCriticalSection TlsSetValue GetCommandLineA InterlockedExchange GetCalendarInfoA DeleteFileA CreateActCtxA CreateRemoteThread CreateThread GetPriorityClass WritePrivateProfileStringW GetProcessHeaps GetProcessHeap GlobalUnWire ReadConsoleOutputCharacterW GetStartupInfoA GetDiskFreeSpaceExA GetCPInfoExA GetWindowsDirectoryW GetSystemWow64DirectoryW GetProfileStringA WriteProfileSectionW GetProfileStringW GetLastError GetStringTypeExA DebugBreak GetPrivateProfileSectionA lstrcmpW WriteFile GetConsoleMode GetThreadSelectorEntry lstrcatA CreateActCtxW SetMailslotInfo GetSystemTimeAdjustment DefineDosDeviceW EndUpdateResourceW WriteConsoleW GetPrivateProfileStructW HeapLock DisableThreadLibraryCalls PeekConsoleInputW GetTapeStatus TransmitCommChar WaitNamedPipeW FindResourceExA GetLocalTime GetOverlappedResult CreateSemaphoreW SetThreadLocale SetFileShortNameW lstrcpyW VerLanguageNameW LockFile SetConsoleCP GetConsoleAliasA EnumDateFormatsW GetWriteWatch GetNumberOfConsoleInputEvents WriteConsoleOutputCharacterA GetConsoleAliasExesLengthW GetComputerNameW HeapFree SetLastError LocalReAlloc SetCommMask SetMessageWaitingIndicator FindClose PostQueuedCompletionStatus AreFileApisANSI SetWaitableTimer EnumResourceNamesW GetProcessTimes FatalAppExitW lstrcpynW GetNamedPipeInfo FillConsoleOutputCharacterW GetCompressedFileSizeA FindNextVolumeMountPointA GetFullPathNameW WriteProfileStringW SetHandleCount GlobalAddAtomA TerminateJobObject QueryDosDeviceW InitializeCriticalSection Process32FirstW SetCurrentDirectoryA GetBinaryTypeW OpenMutexA UnhandledExceptionFilter SetUnhandledExceptionFilter MoveFileA RaiseException GetStartupInfoW HeapValidate IsBadReadPtr TerminateProcess GetCurrentProcess IsDebuggerPresent GetModuleFileNameW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep InterlockedIncrement InterlockedDecrement GetProcAddress ExitProcess GetModuleFileNameA GetStdHandle GetFileType QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW TlsAlloc TlsFree HeapDestroy HeapCreate VirtualFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage SetFilePointer WideCharToMultiByte OutputDebugStringA OutputDebugStringW LoadLibraryW MultiByteToWideChar RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP FlushFileBuffers ReadFile CreateFileA CloseHandle

Name

.text

Size

237KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fopalu

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cihojit

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mazum

Size

512B

Virtual Size

234B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xeja

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_49dd8a16d3047c8a1d0b12f5179775e61bdf45b585e672a5b66bfab4dace0f89

kernel32

generic