JaffaCakes118_1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036

General

Target
JaffaCakes118_1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036
Size 305KB
Sample241224-ql2fxaykav
SHA256 1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036
MD5 3cc97570660f299ac6bfd71c41161d14
SHA1 261cd155b045aa2aa7859839d2225e5fc85862c4
SHA512 f327fde63260752f8e69a6c2b0b775c829618165f6f088fbb9ecddc7f03df4804c0949c4f9d9f35b1cbeec0e32c9572eee017c86b3cf0814f85972cd05f46787
SSDEEP 6144:eSLXimqL97bFsmSqhxg+EApS/irarL6MCOhxxFeTr/ekI:ecXuJ7bimSI80WL6+zxF6L
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036

File Explorer

JaffaCakes118_1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036

.exe 305KB

JaffaCakes118_1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036

IMPHASH e1dc734f9d3fd8ffe237c21274508ba5
SHA256 1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036
MD5 3cc97570660f299ac6bfd71c41161d14
SHA1 261cd155b045aa2aa7859839d2225e5fc85862c4
SHA512 f327fde63260752f8e69a6c2b0b775c829618165f6f088fbb9ecddc7f03df4804c0949c4f9d9f35b1cbeec0e32c9572eee017c86b3cf0814f85972cd05f46787
SSDEEP 6144:eSLXimqL97bFsmSqhxg+EApS/irarL6MCOhxxFeTr/ekI:ecXuJ7bimSI80WL6+zxF6L
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\rovuva bew\vofo.pdb

kernel32

HeapReAlloc GlobalDeleteAtom GetLocaleInfoA InterlockedIncrement GetQueuedCompletionStatus GetEnvironmentStringsW SetEvent ReadConsoleW GetCommandLineA CreateActCtxW GlobalAlloc CopyFileW FreeConsole LeaveCriticalSection GetFileAttributesA HeapCreate WriteConsoleW lstrlenW ReleaseSemaphore SetConsoleTitleA FlushFileBuffers DeactivateActCtx InterlockedExchange GetProcAddress BeginUpdateResourceW RemoveDirectoryA VerLanguageNameW LocalAlloc SetConsoleWindowInfo SetEnvironmentVariableA GetModuleFileNameA SetConsoleTitleW GetModuleHandleA EraseTape VirtualProtect EndUpdateResourceA FindFirstVolumeW GetCurrentProcessId GetPrivateProfileSectionW FindNextVolumeA lstrcpyW GetConsoleOutputCP WideCharToMultiByte InterlockedDecrement InterlockedCompareExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection GetLastError HeapFree HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetCPInfo RtlUnwind RaiseException LCMapStringW LCMapStringA GetStringTypeW VirtualFree VirtualAlloc GetModuleHandleW ExitProcess WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId SetHandleCount GetFileType GetStartupInfoA SetFilePointer GetACP GetOEMCP IsValidCodePage GetModuleFileNameW FreeEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetStringTypeA HeapSize GetUserDefaultLCID EnumSystemLocalesA IsValidLocale InitializeCriticalSectionAndSpinCount LoadLibraryA CloseHandle CreateFileA SetStdHandle GetConsoleCP GetConsoleMode GetLocaleInfoW SetEndOfFile GetProcessHeap ReadFile WriteConsoleA

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036

kernel32

generic