JaffaCakes118_3e837470875b62682d0a8c451e8d1389a0ae559b9e6de08edcaa69ec38e5216c

General

Target
JaffaCakes118_3e837470875b62682d0a8c451e8d1389a0ae559b9e6de08edcaa69ec38e5216c
Size 760KB
Sample241222-zvywtaypcv
SHA256 3e837470875b62682d0a8c451e8d1389a0ae559b9e6de08edcaa69ec38e5216c
MD5 d834245925248f4b8f04e15ddba11730
SHA1 7ce6870e8d2279db38dd7972e2bbdfd54d33df3d
SHA512 fa86c51e7008063956cc67f7f5309024baad40fb27c9f99adeee955ff807c8d6187d0a3977fc4d28bbd29a874d56b46006d5ae1a08c719f5d9c11d922afc160d
SSDEEP 12288:UzyDo/o6oH5jpcnUniUk1F0oysY3x4eeeZfgWT0OBBvd7MjvrRremiB:S/uZKwk1SSYukZzT0WF78Rre7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_3e837470875b62682d0a8c451e8d1389a0ae559b9e6de08edcaa69ec38e5216c

File Explorer

JaffaCakes118_3e837470875b62682d0a8c451e8d1389a0ae559b9e6de08edcaa69ec38e5216c

.exe 760KB

JaffaCakes118_3e837470875b62682d0a8c451e8d1389a0ae559b9e6de08edcaa69ec38e5216c

IMPHASH 5fe1cebf1b69cc6694ca96a35f84fba1
SHA256 3e837470875b62682d0a8c451e8d1389a0ae559b9e6de08edcaa69ec38e5216c
MD5 d834245925248f4b8f04e15ddba11730
SHA1 7ce6870e8d2279db38dd7972e2bbdfd54d33df3d
SHA512 fa86c51e7008063956cc67f7f5309024baad40fb27c9f99adeee955ff807c8d6187d0a3977fc4d28bbd29a874d56b46006d5ae1a08c719f5d9c11d922afc160d
SSDEEP 12288:UzyDo/o6oH5jpcnUniUk1F0oysY3x4eeeZfgWT0OBBvd7MjvrRremiB:S/uZKwk1SSYukZzT0WF78Rre7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

40192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vigesok-homuho\lunihom\wahuworanoro\jahihi\lejeb_ticohicaw\wok.pdb

kernel32

HeapWalk GetNamedPipeHandleStateW SystemTimeToFileTime FillConsoleOutputCharacterW CreateMailslotW TerminateProcess GetLastError GetVersionExA FreeResource EnumResourceNamesA FindNextFileA CopyFileExW BuildCommDCBW SetDefaultCommConfigA WriteProfileStringW WritePrivateProfileStructW LocalCompact ChangeTimerQueueTimer ReadConsoleInputA WriteConsoleInputA LoadResource AddAtomW SearchPathA GetThreadTimes CallNamedPipeW GetDriveTypeA BuildCommDCBAndTimeoutsW VirtualProtect GetModuleHandleA GlobalAlloc SetThreadIdealProcessor GetProfileSectionW DeleteFileW FindFirstChangeNotificationA VerifyVersionInfoA FormatMessageA SetDllDirectoryW LoadLibraryA WritePrivateProfileStringA GetUserDefaultLCID SetWaitableTimer SetConsoleTextAttribute InterlockedDecrement GetStartupInfoW GetSystemWow64DirectoryA CopyFileW SetCalendarInfoA ContinueDebugEvent EndUpdateResourceW SetLastError FreeLibraryAndExitThread GetModuleFileNameW FatalAppExitA SetSystemTime OpenFileMappingA lstrcmpW WriteFileGather FlushConsoleInputBuffer FindNextVolumeA VirtualAllocEx InterlockedExchangeAdd GlobalUnfix GetSystemWindowsDirectoryA CopyFileA GetACP GlobalFindAtomW lstrcatW GetPrivateProfileStringW SetMailslotInfo CreateActCtxW GetPrivateProfileIntW _lwrite OutputDebugStringW CreateNamedPipeA GetAtomNameA SetConsoleActiveScreenBuffer EnumResourceTypesA lstrlenA DebugActiveProcess WriteConsoleW lstrcpyA ReadConsoleOutputW GetThreadContext ReleaseActCtx GetStringTypeA GetPrivateProfileStringA GetFileAttributesExA LocalFileTimeToFileTime MoveFileW GetVolumePathNameA GetCommMask SetFileShortNameW VerLanguageNameW LockFile ProcessIdToSessionId GetQueuedCompletionStatus AllocConsole GlobalGetAtomNameW SetComputerNameA GetConsoleAliasExesLengthA WriteConsoleInputW SystemTimeToTzSpecificLocalTime MoveFileWithProgressA GetStringTypeExW EnumSystemLocalesA GetPrivateProfileIntA GetModuleHandleW OpenWaitableTimerA GetConsoleAliasesLengthW GlobalUnWire FillConsoleOutputCharacterA GetCompressedFileSizeA FindNextVolumeMountPointA WriteConsoleOutputCharacterA QueryInformationJobObject GetConsoleAliasExesA EnumDateFormatsA SetDefaultCommConfigW OpenMutexA RaiseException GetCommandLineA GetStartupInfoA HeapValidate IsBadReadPtr DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime Sleep InterlockedIncrement GetProcAddress ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree HeapDestroy HeapCreate HeapFree VirtualFree WriteFile HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetOEMCP GetCPInfo IsValidCodePage RtlUnwind InitializeCriticalSectionAndSpinCount DebugBreak OutputDebugStringA LoadLibraryW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP CreateFileA CloseHandle FlushFileBuffers

advapi32

InitiateSystemShutdownW

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_3e837470875b62682d0a8c451e8d1389a0ae559b9e6de08edcaa69ec38e5216c

kernel32

advapi32

generic