JaffaCakes118_da5fc1116d581cf024ca37d8ce816d4311bbe9e48c270c0be1eec4df0ccc5e34

General

Target
JaffaCakes118_da5fc1116d581cf024ca37d8ce816d4311bbe9e48c270c0be1eec4df0ccc5e34
Size 829KB
Sample241228-25grdsvmfk
SHA256 da5fc1116d581cf024ca37d8ce816d4311bbe9e48c270c0be1eec4df0ccc5e34
MD5 734ae031b3a4a246f4211f4b378be099
SHA1 b98d03592af85cd345f8fd9db3bf1d575e6ce80a
SHA512 11e80d519e59ca626e504eb44f7f801cc1c355f6282a1037e988b8dd089ed3ec2ca59df7cf3a3d04840f0ec3d431d510361e1ef2042573b44abec4488ff94c07
SSDEEP 12288:ThydzySr8NfwOM9uj0hJeA6h9f37TXVY+6PbGu0lDdqD0SUF5y3sTl9unnwQ7/X:NuJuQhJC9f37hYNb4A0X5y30lOwA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_da5fc1116d581cf024ca37d8ce816d4311bbe9e48c270c0be1eec4df0ccc5e34

File Explorer

JaffaCakes118_da5fc1116d581cf024ca37d8ce816d4311bbe9e48c270c0be1eec4df0ccc5e34

.exe 829KB

JaffaCakes118_da5fc1116d581cf024ca37d8ce816d4311bbe9e48c270c0be1eec4df0ccc5e34

IMPHASH 48cfe16a49c9dcec905547ba5c78e3fd
SHA256 da5fc1116d581cf024ca37d8ce816d4311bbe9e48c270c0be1eec4df0ccc5e34
MD5 734ae031b3a4a246f4211f4b378be099
SHA1 b98d03592af85cd345f8fd9db3bf1d575e6ce80a
SHA512 11e80d519e59ca626e504eb44f7f801cc1c355f6282a1037e988b8dd089ed3ec2ca59df7cf3a3d04840f0ec3d431d510361e1ef2042573b44abec4488ff94c07
SSDEEP 12288:ThydzySr8NfwOM9uj0hJeA6h9f37TXVY+6PbGu0lDdqD0SUF5y3sTl9unnwQ7/X:NuJuQhJC9f37hYNb4A0X5y30lOwA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

18923

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\hesaka\gakus\focahonoyaguy 5\hugot\16-hexohokufog50.pdb

kernel32

LocalFlags GetConsoleTitleA LoadLibraryW InterlockedPopEntrySList LeaveCriticalSection WriteConsoleW GetModuleFileNameW lstrlenW GetShortPathNameA CreateDirectoryA GetConsoleAliasesW GetStdHandle GetCPInfoExW FillConsoleOutputCharacterW SetLastError SetMailslotInfo WriteProfileSectionA LoadLibraryA LocalAlloc SetCalendarInfoW MoveFileA SetProcessWorkingSetSize SetConsoleWindowInfo GetModuleFileNameA GetModuleHandleA FindFirstChangeNotificationA FreeEnvironmentStringsW VirtualProtect GetFileAttributesExW GetConsoleAliasesLengthW WriteConsoleOutputCharacterA UnregisterWait SetStdHandle CloseHandle GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess GetCurrentProcess HeapAlloc GetLastError HeapFree EnterCriticalSection SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetProcAddress GetModuleHandleW ExitProcess WriteFile GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep WideCharToMultiByte RtlUnwind IsProcessorFeaturePresent LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer HeapSize CreateFileW

gdi32

GetTextExtentExPointA

winhttp

WinHttpCloseHandle

Name

.text

Size

677KB

Virtual Size

677KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yedeta

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cog

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.lap

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.zero

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_da5fc1116d581cf024ca37d8ce816d4311bbe9e48c270c0be1eec4df0ccc5e34

kernel32

gdi32

winhttp

generic