JaffaCakes118_9a4238d07b78cedaf9f16693faadaf26e524d37d82989871b7e8875a38c16318

General

Target
JaffaCakes118_9a4238d07b78cedaf9f16693faadaf26e524d37d82989871b7e8875a38c16318
Size 1.1MB
Sample241222-y1gn2sxpct
SHA256 9a4238d07b78cedaf9f16693faadaf26e524d37d82989871b7e8875a38c16318
MD5 86293673d26bf1147c4d30b788a8daf1
SHA1 113e557deaa3602893bdd50ffb4ac9880cc20d79
SHA512 65a4d09416e6898c18bb91c80c666e47ae57b3a5f0cf4827f9602392a648e1f39984945e0b4706c906af15c06244da1bded9eae92356f95a8b7ec697037759ea
SSDEEP 24576:UGIllGQbztkD3hqAYZg7PEtMJa7Wz9XypI1DWF64xDsFae:7IlN/yDRDDEtMJLNyQWF64eFp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/new calc.bin

File Explorer

JaffaCakes118_9a4238d07b78cedaf9f16693faadaf26e524d37d82989871b7e8875a38c16318

.zip 1.1MB
new calc.bin

.exe 1.1MB

JaffaCakes118_9a4238d07b78cedaf9f16693faadaf26e524d37d82989871b7e8875a38c16318

SHA256 9a4238d07b78cedaf9f16693faadaf26e524d37d82989871b7e8875a38c16318
MD5 86293673d26bf1147c4d30b788a8daf1
SHA1 113e557deaa3602893bdd50ffb4ac9880cc20d79
SHA512 65a4d09416e6898c18bb91c80c666e47ae57b3a5f0cf4827f9602392a648e1f39984945e0b4706c906af15c06244da1bded9eae92356f95a8b7ec697037759ea
SSDEEP 24576:UGIllGQbztkD3hqAYZg7PEtMJa7Wz9XypI1DWF64xDsFae:7IlN/yDRDDEtMJLNyQWF64eFp
MD5 SHA1 SHA512 SSDEEP

Password

infected

new calc.bin

IMPHASH 9222d372923baed7aa9dfa28449a94ea
SHA256 098aef2de51c227361d72b5607b9ec7fe463d9a185ff5300577e96371c75a69c
MD5 0878b366dd695cc10da365b40f454062
SHA1 c21f65d76421ff06dab8ada263b5aca971a6d899
SHA512 9b8213a3eea6f7fab26796768812a944539c0d2ea449b1354b51a6e71938d280c66babfd823d483c5faf797b86396680f9072bc12e954c5d32ee9fb16607c279
SSDEEP 24576:RQox/GpVEAIT5XRtEyAPqsw97uN+XmxjeU/+sbG:RQoc45XTEyACt7uNHX/zbG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb

kernel32

CreateFileA FindResourceA FreeLibrary LoadResource WriteFile SizeofResource GetProcAddress LoadLibraryA LockResource EnumResourceNamesA CloseHandle FreeResource GetWindowsDirectoryA OutputDebugStringA GetTempPathA GetModuleHandleW ExitProcess DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW Sleep HeapSize GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LCMapStringW MultiByteToWideChar GetStringTypeW

shell32

ShellExecuteA SHGetSpecialFolderPathA

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_9a4238d07b78cedaf9f16693faadaf26e524d37d82989871b7e8875a38c16318

new calc.bin

kernel32

shell32

generic