JaffaCakes118_9484a44f677fc8ebd6dbbb9480dc039f3e799ca9f2381c580e1e3914b2b919f7

General

Target
JaffaCakes118_9484a44f677fc8ebd6dbbb9480dc039f3e799ca9f2381c580e1e3914b2b919f7
Size 730.0MB
Sample241229-d22qds1ndm
SHA256 9484a44f677fc8ebd6dbbb9480dc039f3e799ca9f2381c580e1e3914b2b919f7
MD5 06c4093950b292b57084643fdbef20d8
SHA1 e9cfc6ef108e0e6ab1f33060a92bf91debd03bce
SHA512 9b2d8b257982fc745fa8b5e906844ab54a66daf66f03f6482cec3fa584657270fd285ab15b6c9df19e44c29e52c7939c4d50e4de5683e9da0f6e886ce3eb389d
SSDEEP 196608:Dqkq7xWxHjSwvcWgSNXqAK/9CHeB5DiWSzvkICfH8HryeuqKI:dxDSJQolfnDiW66cHzh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_9484a44f677fc8ebd6dbbb9480dc039f3e799ca9f2381c580e1e3914b2b919f7

File Explorer

JaffaCakes118_9484a44f677fc8ebd6dbbb9480dc039f3e799ca9f2381c580e1e3914b2b919f7

.exe 730.0MB

JaffaCakes118_9484a44f677fc8ebd6dbbb9480dc039f3e799ca9f2381c580e1e3914b2b919f7

IMPHASH e9fa0dc321486a0834a2759b64589900
SHA256 9484a44f677fc8ebd6dbbb9480dc039f3e799ca9f2381c580e1e3914b2b919f7
MD5 06c4093950b292b57084643fdbef20d8
SHA1 e9cfc6ef108e0e6ab1f33060a92bf91debd03bce
SHA512 9b2d8b257982fc745fa8b5e906844ab54a66daf66f03f6482cec3fa584657270fd285ab15b6c9df19e44c29e52c7939c4d50e4de5683e9da0f6e886ce3eb389d
SSDEEP 196608:Dqkq7xWxHjSwvcWgSNXqAK/9CHeB5DiWSzvkICfH8HryeuqKI:dxDSJQolfnDiW66cHzh
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

17021851

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalSize lstrlenA LocalAlloc IsBadCodePtr GetProcAddress LoadLibraryA GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA RaiseException HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

gdi32

GetDeviceCaps

ole32

CoInitialize

user32

CharUpperBuffW

Name

.text

Size

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.l_m

Size

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

._(S

Size

1024B

Virtual Size

884B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.s?H

Size

9.6MB

Virtual Size

9.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

422KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_9484a44f677fc8ebd6dbbb9480dc039f3e799ca9f2381c580e1e3914b2b919f7

kernel32

gdi32

ole32

user32

generic