JaffaCakes118_d6d6581e266a3f1d371dd4ddff0240e50b9aeee252373b15caad66eecacb873b
- SHA256 d6d6581e266a3f1d371dd4ddff0240e50b9aeee252373b15caad66eecacb873b
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1e65f9c773cc00d08dda0f9971fbb971c033d32382bdd1a59194adcde2c3e7e.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1e65f9c773cc00d08dda0f9971fbb971c033d32382bdd1a59194adcde2c3e7e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target JaffaCakes118_d6d6581e266a3f1d371dd4ddff0240e50b9aeee252373b15caad66eecacb873b
- Size 164KB
- Sample241226-2whbkatpbs
- SHA256 d6d6581e266a3f1d371dd4ddff0240e50b9aeee252373b15caad66eecacb873b
- MD5 3b03a74a060d81bc5f249914436cf9b2
- SHA1 cdd3fa6edb335c7c6937ef85f3f2607a4ddaac71
- SHA512 f8c1da2d036b11ed887e18e3141e91376bb0d90d09b28423d944b079aabef85f8da49abcaec13c7017f95880eaedec834ada04f8bac59adeb8309a4042a10297
- SSDEEP 3072:1Grofl0FEH2fqwNhmS/PA7KlmrNQvBY8nsApTzkQwq2KlT3gc:EoflCEoqg8SwKlmr6JWMfkQ/TB
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e1e65f9c773cc00d08dda0f9971fbb971c033d32382bdd1a59194adcde2c3e7e
File Explorer
-
JaffaCakes118_d6d6581e266a3f1d371dd4ddff0240e50b9aeee252373b15caad66eecacb873b.zip 164KB
-
e1e65f9c773cc00d08dda0f9971fbb971c033d32382bdd1a59194adcde2c3e7e.exe 337KB
e1e65f9c773cc00d08dda0f9971fbb971c033d32382bdd1a59194adcde2c3e7e
- IMPHASH 9aeb2463a45e44e4b568bf1d36aa5947
- SHA256 e1e65f9c773cc00d08dda0f9971fbb971c033d32382bdd1a59194adcde2c3e7e
- MD5 64765141b86d4bce1470e9b8b9de492d
- SHA1 8497035ee193ff0351f8ca6a5b924bf6db8f706d
- SHA512 f8404a22092a659585eafa2f5504e630abe0302713e3ad13848f4809d92c39f284d85eb4db6c9cf9dc660ebe22b397e97b116cc196d698ab2ccdf1836b48507a
- SSDEEP 6144:xiu5EIbeIz5anwf7Beqh4QUslWmsos3xub+gQXcIjzqw:xuozSwf7Q2/UslWmkxK+gQXZl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
110256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\manacan\puvu.pdb
kernel32
ExitProcess
GetComputerNameA
SetInformationJobObject
FindFirstChangeNotificationW
lstrlenA
CopyFileExW
TlsGetValue
SetLocalTime
CommConfigDialogA
FreeLibrary
SetDllDirectoryW
InterlockedIncrement
InterlockedDecrement
ZombifyActCtx
SetFirmwareEnvironmentVariableA
SetEnvironmentVariableW
GetNamedPipeHandleStateA
SetVolumeMountPointW
OpenSemaphoreA
OutputDebugStringW
GetTickCount
GetProcessHeap
GetConsoleAliasesLengthA
GetConsoleTitleA
ReadConsoleW
CreateRemoteThread
CreateActCtxW
TlsSetValue
GetConsoleCP
GetPrivateProfileIntA
LoadLibraryW
GetConsoleMode
TerminateThread
CopyFileW
GetCalendarInfoA
LeaveCriticalSection
GlobalFlags
HeapValidate
CreateSemaphoreA
GetModuleFileNameW
CompareStringW
CreateJobObjectA
VerifyVersionInfoW
SetCurrentDirectoryA
FindFirstFileA
GetLastError
GetProcAddress
GetLongPathNameA
HeapSize
BackupWrite
VerLanguageNameA
CreateNamedPipeA
SearchPathA
GetNumaHighestNodeNumber
GetPrivateProfileStringA
LoadLibraryA
ProcessIdToSessionId
LocalAlloc
GetFileType
WritePrivateProfileStringA
BuildCommDCBAndTimeoutsW
GetVolumePathNamesForVolumeNameA
GetModuleFileNameA
FindNextFileA
WriteProfileStringA
GetModuleHandleA
FindFirstChangeNotificationA
GetProcessShutdownParameters
FreeEnvironmentStringsW
WriteProfileStringW
BuildCommDCBA
GetConsoleCursorInfo
FindFirstVolumeA
GetVersionExA
TlsAlloc
ReadConsoleOutputCharacterW
GetSystemTime
TlsFree
GetProfileSectionW
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsBadReadPtr
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetLastError
HeapCreate
WriteFile
SetFilePointer
WideCharToMultiByte
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
OutputDebugStringA
WriteConsoleW
HeapAlloc
HeapReAlloc
HeapQueryInformation
HeapFree
RtlUnwind
SetStdHandle
MultiByteToWideChar
GetStringTypeW
LCMapStringW
RaiseException
CreateFileW
CloseHandle
FlushFileBuffers
Name
.text
Size
235KB
Virtual Size
234KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
39.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wuhaz
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.xic
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ragejuh
Size
512B
Virtual Size
234B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=171, productName=VS2010 build 30319, version=30319,
count=29, id=158, productName=VS2010 build 30319, version=30319,
count=122, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=136, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,