JaffaCakes118_621af9ea3a44e4fab71237e384a0ca3808339d2d566a1b0144af74fe9d48bd02

General

Target
JaffaCakes118_621af9ea3a44e4fab71237e384a0ca3808339d2d566a1b0144af74fe9d48bd02
Size 220KB
Sample241229-nl85mszran
SHA256 621af9ea3a44e4fab71237e384a0ca3808339d2d566a1b0144af74fe9d48bd02
MD5 5c43af858cebe82b1ad78c645061cc44
SHA1 5babb64955d52797a58604a9aef14d689e90d35f
SHA512 2d2c7e9483b0b13dd8cabbbc5d1218fe0acdac78f1c676c8fc302e91c3d11cf44ea5f2c3ea53bbfa125e60769f1c99b0da9e27fc05c7f2a743116915aec39c60
SSDEEP 3072:IUlCE+24yRwiP95GXu0bJ/rWrxpzbgqru+sxkgaBChmx/LI03qbN:ZV+Tybjijuzbgwu7igaQk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_621af9ea3a44e4fab71237e384a0ca3808339d2d566a1b0144af74fe9d48bd02

File Explorer

JaffaCakes118_621af9ea3a44e4fab71237e384a0ca3808339d2d566a1b0144af74fe9d48bd02

.exe 220KB

JaffaCakes118_621af9ea3a44e4fab71237e384a0ca3808339d2d566a1b0144af74fe9d48bd02

IMPHASH 9e3ac2424cecff905bdab3e7336b91cb
SHA256 621af9ea3a44e4fab71237e384a0ca3808339d2d566a1b0144af74fe9d48bd02
MD5 5c43af858cebe82b1ad78c645061cc44
SHA1 5babb64955d52797a58604a9aef14d689e90d35f
SHA512 2d2c7e9483b0b13dd8cabbbc5d1218fe0acdac78f1c676c8fc302e91c3d11cf44ea5f2c3ea53bbfa125e60769f1c99b0da9e27fc05c7f2a743116915aec39c60
SSDEEP 3072:IUlCE+24yRwiP95GXu0bJ/rWrxpzbgqru+sxkgaBChmx/LI03qbN:ZV+Tybjijuzbgwu7igaQk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8468

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xehemo-mop96\rowokehoz\woxuzit\luker\p.pdb

kernel32

SetThreadContext WriteConsoleOutputCharacterW GetDefaultCommConfigW HeapAlloc UpdateResourceA HeapFree GetEnvironmentStringsW BackupSeek GetTickCount GlobalAlloc LoadLibraryW SizeofResource GetTapePosition SetConsoleCursorPosition WriteConsoleW GetAtomNameW LCMapStringA GetLastError GetProcAddress VirtualAlloc GetFirmwareEnvironmentVariableW LoadLibraryA WriteConsoleA BeginUpdateResourceA GetModuleFileNameA SetConsoleCursorInfo AddConsoleAliasA FindNextVolumeA lstrcpyA SetProcessAffinityMask CreateFileW GetStringTypeW GetModuleHandleW ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess IsProcessorFeaturePresent WriteFile GetStdHandle GetModuleFileNameW HeapCreate EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind SetHandleCount GetFileType DeleteCriticalSection SetFilePointer CloseHandle TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime RaiseException Sleep CreateFileA GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers HeapSize HeapReAlloc SetEndOfFile GetProcessHeap MultiByteToWideChar ReadFile LCMapStringW

user32

GetCursorPos

advapi32

NotifyChangeEventLog

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_621af9ea3a44e4fab71237e384a0ca3808339d2d566a1b0144af74fe9d48bd02

kernel32

user32

advapi32

generic