JaffaCakes118_cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c
Size 725.9MB
Sample241224-p5dnhsxrhk
SHA256 cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c
MD5 eece8e698de79298592262c9adfacb82
SHA1 238cffd10523df3ecca73c74e63848cc85cc3fed
SHA512 87c1aecce22b26c0972555c7b09ba687c6cb7d2e61fa298627ea38b9974b0c2d4d0e1a3326973b3718822fc20194f4ada71554f048ec5ddf9e1dcea33ac6943c
SSDEEP 98304:CTCpxRMeauPe3jnnOyVin/WYMlFS6ysxUvRF2PDKyK//mR55BbLybHc7b2W+:oCpxS5nODYlF9ysx6RFikOBKbHcfw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c

File Explorer

JaffaCakes118_cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c

.exe 725.9MB

JaffaCakes118_cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c

IMPHASH d1d3d73d787337b3c2c781174515d692
SHA256 cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c
MD5 eece8e698de79298592262c9adfacb82
SHA1 238cffd10523df3ecca73c74e63848cc85cc3fed
SHA512 87c1aecce22b26c0972555c7b09ba687c6cb7d2e61fa298627ea38b9974b0c2d4d0e1a3326973b3718822fc20194f4ada71554f048ec5ddf9e1dcea33ac6943c
SSDEEP 98304:CTCpxRMeauPe3jnnOyVin/WYMlFS6ysxUvRF2PDKyK//mR55BbLybHc7b2W+:oCpxS5nODYlF9ysx6RFikOBKbHcfw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7503932

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateThread GetCurrentProcessorNumber GetModuleHandleA GetProcAddress MultiByteToWideChar FreeConsole CreateFileW HeapSize GetProcessHeap WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetSystemTimeAsFileTime CreateEventA GetModuleFileNameW GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc RaiseException LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

wvsprintfA CharUpperBuffW

Name

.text

Size

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ngxqwe

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gbdvfe

Size

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.THY0

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.THY1

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.THY2

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c

kernel32

user32

generic