JaffaCakes118_1cf25999202dc9426ae5f2e7f77e67dfac062bb1a8a99dd9959b6451f3f499a0

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_1cf25999202dc9426ae5f2e7f77e67dfac062bb1a8a99dd9959b6451f3f499a0
Size 83.9MB
Sample241223-1bdbfasjgl
SHA256 1cf25999202dc9426ae5f2e7f77e67dfac062bb1a8a99dd9959b6451f3f499a0
MD5 4af39f5f5f586b73c91dae10eb527949
SHA1 0bd19b2327a1365753f555703eb1f20b2ab797f3
SHA512 12ad79eb3b1be3f6e3dfa9a65f4bbba3d2ecf12f46cb360ba1a90e9188571ddc6ae68e25719c5e9b4194e77bdd038dd1cd7ec25187ffc7834c54bf69aa7c22bf
SSDEEP 1572864:yi9S2rG8Xzsjq9+Jt2/JYul9eO+B7bgIykbQJd8Lmseadm14Bqt:yic2Ub2/JYW9eO+B7b5ykbSd8Lmseay5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PlexDlnaServer.exe

File Explorer

JaffaCakes118_1cf25999202dc9426ae5f2e7f77e67dfac062bb1a8a99dd9959b6451f3f499a0

.7z 83.9MB
PlexDlnaServer.exe

.exe 122.5MB

JaffaCakes118_1cf25999202dc9426ae5f2e7f77e67dfac062bb1a8a99dd9959b6451f3f499a0

SHA256 1cf25999202dc9426ae5f2e7f77e67dfac062bb1a8a99dd9959b6451f3f499a0
MD5 4af39f5f5f586b73c91dae10eb527949
SHA1 0bd19b2327a1365753f555703eb1f20b2ab797f3
SHA512 12ad79eb3b1be3f6e3dfa9a65f4bbba3d2ecf12f46cb360ba1a90e9188571ddc6ae68e25719c5e9b4194e77bdd038dd1cd7ec25187ffc7834c54bf69aa7c22bf
SSDEEP 1572864:yi9S2rG8Xzsjq9+Jt2/JYul9eO+B7bgIykbQJd8Lmseadm14Bqt:yic2Ub2/JYW9eO+B7b5ykbSd8Lmseay5
MD5 SHA1 SHA512 SSDEEP

Password

infected

PlexDlnaServer.exe

IMPHASH ad3427a846d7d2b1db90e6b34d95e738
SHA256 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778
MD5 c893af41e33ca5da0a8acf8ac623c2ae
SHA1 65412f1aa3839e41a00adc2ebc7162880c258be7
SHA512 20474b4ab6e85a7b33d544a5f8cdb5d6b03b86ee67b07a54a17ee6358d51abdcd0711a78999fceb83f971590707c62941f0d2c5d18abc1c091694ea29ceb517f
SSDEEP 3145728:zvTXJ9SA7SJ4rS5rCf5PSiDLJHYbxYUBQDLfy/LEXwzce:zTJsrc56YLJHYVlBQHKN4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1938917

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

ShellExecuteA

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeKillEvent timeSetEvent

userenv

GetUserProfileDirectoryW

ws2_32

WSAAsyncSelect

netapi32

NetApiBufferFree NetShareEnum

kernel32

InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection Sleep CreateFileW FlushFileBuffers SetFilePointer WriteFile CloseHandle SetEvent GetStdHandle DuplicateHandle GetLastError WaitForSingleObject GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess GetStartupInfoW OpenProcess GetConsoleWindow GetCurrentThreadId SetThreadPriority GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree CreateDirectoryW DeleteFileW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFileTime CopyFileW MoveFileExW GetCurrentDirectoryW GetLongPathNameW GetTempPathW GetSystemDirectoryW WideCharToMultiByte CreateEventW ReadFile FindClose FindFirstFileW FindNextFileW LocalFree FormatMessageW ResetEvent ReleaseMutex WaitForMultipleObjects OutputDebugStringW IsProcessorFeaturePresent GetModuleHandleW GetProcAddress WaitForSingleObjectEx GetCommandLineW QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 GetSystemTime GetLocalTime CreateThread GetCurrentThread GetThreadPriority TerminateThread ResumeThread GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW GetUserDefaultLCID GetUserPreferredUILanguages GetModuleFileNameW GetFileInformationByHandle GetSystemInfo GetLogicalDrives GetVolumePathNamesForVolumeNameW SetErrorMode DeviceIoControl MoveFileW TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetComputerNameW GetFileType SetFilePointerEx CreateFileMappingW MapViewOfFile UnmapViewOfFile UnregisterWaitEx RegisterWaitForSingleObject FindFirstFileExW FreeLibrary GetModuleHandleExW LoadLibraryW LoadLibraryA CreateFileA InitializeCriticalSectionEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx RaiseException GetLocaleInfoEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead IsDebuggerPresent RtlUnwind InterlockedPushEntrySList SetLastError LoadLibraryExW ExitProcess ExitThread FreeLibraryAndExitThread GetCommandLineA GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle GetFileSizeEx HeapFree HeapReAlloc HeapAlloc CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap HeapSize WriteConsoleW InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock VirtualFree VirtualAlloc CreateMutexA GetUserGeoID GetGeoInfoW GetDynamicTimeZoneInformation LCIDToLocaleName LocaleNameToLCID SetEnvironmentVariableW GetTimeZoneInformation GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx GetFullPathNameW ResolveLocaleName GetCurrencyFormatEx GetNumberFormatEx

user32

TranslateMessage CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW SetWindowLongW GetWindowLongW KillTimer SetTimer MsgWaitForMultipleObjectsEx GetQueueStatus DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DispatchMessageW PostMessageW PeekMessageW DefWindowProcW

advapi32

GetSidSubAuthorityCount GetSidSubAuthority RegSetValueExW RegQueryInfoKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW BuildTrusteeWithSidW GetNamedSecurityInfoW GetEffectiveRightsFromAclW LookupAccountSidW MapGenericMask GetTokenInformation GetLengthSid FreeSid DuplicateToken CopySid AllocateAndInitializeSid AccessCheck OpenProcessToken SystemFunction036 RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoUninitialize CoCreateInstance CoTaskMemFree CoInitialize

generic

count=49, id=259, version=27412,

count=200, id=261, version=27412,

count=3, id=253, version=28518,

count=19, id=260, version=30034,

count=28, id=259, version=30034,

count=96, id=261, version=30034,

count=2, id=253, version=23601,

count=45, productName=Unmarked objects (old),

count=518, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=394, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=39, id=260, version=27412,

count=1, id=262, version=27412,

count=23, id=257, version=27412,

count=281, id=1, productName=Unmarked objects,

count=1, id=265, version=30137,

count=1, id=256, productName=VS2019 v16.11.6 build 30137, version=30137,

count=1, id=255, productName=VS2019 v16.11.6 build 30137, version=30137,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.11.6 build 30137, version=30137,