JaffaCakes118_5464df8918e5977f6e16e1f39898b92b5b69a4f0ab6d2f3374bf0b4aca246eee

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_5464df8918e5977f6e16e1f39898b92b5b69a4f0ab6d2f3374bf0b4aca246eee
Size 299KB
Sample241229-evdwesslhl
SHA256 5464df8918e5977f6e16e1f39898b92b5b69a4f0ab6d2f3374bf0b4aca246eee
MD5 fc7e642644626b8857777f4b253f115d
SHA1 17b38fb3dd5826a4f6d5208dbd2292011b13ee28
SHA512 6799435871d1dd58f240cff67b5c3718609c5b679d84bae4552901561e37f2ac8dd3fb68ba20538e7dcdc02a6a5cac6e25f48906da0722280ac17144295f4b14
SSDEEP 6144:f/blk14f8PO3ZCxKjlndRHaTQPr4EZdtgIP:fZbrCxKXRHaTQ0KQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_5464df8918e5977f6e16e1f39898b92b5b69a4f0ab6d2f3374bf0b4aca246eee

File Explorer

JaffaCakes118_5464df8918e5977f6e16e1f39898b92b5b69a4f0ab6d2f3374bf0b4aca246eee

.exe 299KB

JaffaCakes118_5464df8918e5977f6e16e1f39898b92b5b69a4f0ab6d2f3374bf0b4aca246eee

IMPHASH 11caefc927578dff0bd17e4ef4b3bd12
SHA256 5464df8918e5977f6e16e1f39898b92b5b69a4f0ab6d2f3374bf0b4aca246eee
MD5 fc7e642644626b8857777f4b253f115d
SHA1 17b38fb3dd5826a4f6d5208dbd2292011b13ee28
SHA512 6799435871d1dd58f240cff67b5c3718609c5b679d84bae4552901561e37f2ac8dd3fb68ba20538e7dcdc02a6a5cac6e25f48906da0722280ac17144295f4b14
SSDEEP 6144:f/blk14f8PO3ZCxKjlndRHaTQPr4EZdtgIP:fZbrCxKXRHaTQ0KQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

116848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xijusucosufi\xokevabateji\pifi84 jamagi-lebojotiru.pdb

kernel32

CallNamedPipeW TerminateThread GetExitCodeProcess GetVersionExA SetConsoleCP GetConsoleAliasesLengthW GetDefaultCommConfigA FindFirstFileExA GetDriveTypeA FreeEnvironmentStringsA SetProcessPriorityBoost SetVolumeMountPointA GetLongPathNameA CopyFileW TlsGetValue SetConsoleCursorInfo GlobalHandle TzSpecificLocalTimeToSystemTime FindAtomA ReleaseSemaphore GetNamedPipeHandleStateA CreateMailslotW BuildCommDCBAndTimeoutsA VirtualProtect GetModuleHandleA LocalAlloc TryEnterCriticalSection TlsSetValue GetCommandLineA InterlockedExchange GetCalendarInfoA DeleteFileW CreateActCtxA CreateRemoteThread CreateThread GetPriorityClass WritePrivateProfileStringW GetProcessHeaps GetProcessHeap GlobalUnWire ReadConsoleOutputCharacterW GetStartupInfoA GetDiskFreeSpaceExW GetCPInfoExA GetWindowsDirectoryW GetSystemWow64DirectoryW GetProfileStringA WriteProfileSectionW GetProfileStringW GetLastError GetStringTypeExW DebugBreak GetPrivateProfileSectionA lstrcmpW WriteFile GetConsoleMode TerminateProcess GetThreadSelectorEntry lstrcatA CreateActCtxW SetMailslotInfo GetSystemTimeAdjustment DefineDosDeviceW EndUpdateResourceW WriteConsoleW GetPrivateProfileStructA HeapLock DisableThreadLibraryCalls PeekConsoleInputW GetTapeStatus TransmitCommChar WaitNamedPipeW FindResourceExA GetLocalTime GetOverlappedResult CreateSemaphoreW SetThreadLocale SetFileShortNameW lstrcpyW VerLanguageNameW LockFile GetConsoleAliasA EnumDateFormatsW GetWriteWatch GetNumberOfConsoleInputEvents WriteConsoleOutputCharacterA GetConsoleAliasExesLengthW OpenMutexW GetComputerNameW HeapFree SetLastError OpenMutexA LocalReAlloc SetCommMask SetMessageWaitingIndicator FindClose PostQueuedCompletionStatus AreFileApisANSI SetWaitableTimer EnumResourceNamesW GetProcessHandleCount FatalAppExitA lstrcpynW GetNamedPipeInfo FillConsoleOutputCharacterW GetCompressedFileSizeA FindNextVolumeMountPointA GetFullPathNameW WriteProfileStringW SetHandleCount GlobalAddAtomA TerminateJobObject QueryDosDeviceA InitializeCriticalSection Process32FirstW SetCurrentDirectoryA GetBinaryTypeA UnhandledExceptionFilter SetUnhandledExceptionFilter MoveFileA RaiseException GetStartupInfoW HeapValidate IsBadReadPtr GetCurrentProcess IsDebuggerPresent GetModuleFileNameW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep InterlockedIncrement InterlockedDecrement GetProcAddress ExitProcess GetModuleFileNameA GetStdHandle GetFileType QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW TlsAlloc TlsFree HeapDestroy HeapCreate VirtualFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage SetFilePointer WideCharToMultiByte GetConsoleCP OutputDebugStringA OutputDebugStringW LoadLibraryW MultiByteToWideChar RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP FlushFileBuffers ReadFile CreateFileA CloseHandle

Name

.text

Size

237KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nehey

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tecote

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fepacu

Size

512B

Virtual Size

234B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ror

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_5464df8918e5977f6e16e1f39898b92b5b69a4f0ab6d2f3374bf0b4aca246eee

kernel32

generic