JaffaCakes118_9674f8093e7a4372c9ac6220c77c7e8cf1c9f42c725ea9c20b9c21465a7b2819

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_9674f8093e7a4372c9ac6220c77c7e8cf1c9f42c725ea9c20b9c21465a7b2819
Size 299KB
Sample241230-b2yydstmgr
SHA256 9674f8093e7a4372c9ac6220c77c7e8cf1c9f42c725ea9c20b9c21465a7b2819
MD5 e6000425f67565c7d4234f3d380b2504
SHA1 866fb85524643bfecb3c6682196d4f0ae90e3114
SHA512 ee95aadc6808319fa9e4acca541da55c461de164c87280c2e3271a168fbd23bccaf457e81508bd51f3c3e932b261070f6a271b2cf1c3c77a4de484066e2a630e
SSDEEP 3072:d2QC1KyeOzjzX4Ud67OBKExAxWtrFmXz7UFAeO2qciZf3Ox1RYphOXSuuW35KiIV:dakOBKZXzIFwBZf3g1RkhOCU345oNC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_9674f8093e7a4372c9ac6220c77c7e8cf1c9f42c725ea9c20b9c21465a7b2819

File Explorer

JaffaCakes118_9674f8093e7a4372c9ac6220c77c7e8cf1c9f42c725ea9c20b9c21465a7b2819

.exe 299KB

JaffaCakes118_9674f8093e7a4372c9ac6220c77c7e8cf1c9f42c725ea9c20b9c21465a7b2819

IMPHASH bbdd2cf254995e4ca97a5ff76031c345
SHA256 9674f8093e7a4372c9ac6220c77c7e8cf1c9f42c725ea9c20b9c21465a7b2819
MD5 e6000425f67565c7d4234f3d380b2504
SHA1 866fb85524643bfecb3c6682196d4f0ae90e3114
SHA512 ee95aadc6808319fa9e4acca541da55c461de164c87280c2e3271a168fbd23bccaf457e81508bd51f3c3e932b261070f6a271b2cf1c3c77a4de484066e2a630e
SSDEEP 3072:d2QC1KyeOzjzX4Ud67OBKExAxWtrFmXz7UFAeO2qciZf3Ox1RYphOXSuuW35KiIV:dakOBKZXzIFwBZf3g1RkhOCU345oNC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

116560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wah_zuxiteneroya\ladiyeligote\gogofuduwonix\bemadupojapaz.pdb

kernel32

CallNamedPipeW TerminateThread GetExitCodeProcess GetVersionExA GetConsoleCP GetConsoleAliasesLengthW CommConfigDialogA FindFirstFileExA GetDriveTypeA FreeEnvironmentStringsA SetProcessPriorityBoost SetVolumeMountPointA GetLongPathNameA CopyFileW TlsGetValue SetConsoleCursorInfo GlobalHandle TzSpecificLocalTimeToSystemTime FindAtomA ReleaseSemaphore GetNamedPipeHandleStateA CreateMailslotW BuildCommDCBAndTimeoutsA VirtualProtect GetModuleHandleA LocalAlloc TryEnterCriticalSection TlsSetValue GetCommandLineA InterlockedExchange GetCalendarInfoA DeleteFileA CreateActCtxA CreateRemoteThread CreateThread GetPriorityClass WritePrivateProfileStringW GetProcessHeaps GetProcessHeap GlobalUnWire ReadConsoleOutputCharacterW GetStartupInfoA GetDiskFreeSpaceExA GetCPInfoExA GetWindowsDirectoryW GetSystemWow64DirectoryW GetProfileStringA WriteProfileSectionW GetProfileStringW GetLastError GetStringTypeExA DebugBreak GetPrivateProfileSectionA lstrcmpW WriteFile GetConsoleMode GetThreadSelectorEntry lstrcatA CreateActCtxW SetMailslotInfo GetSystemTimeAdjustment DefineDosDeviceW EndUpdateResourceW WriteConsoleW GetPrivateProfileStructW HeapLock DisableThreadLibraryCalls PeekConsoleInputW GetTapeStatus TransmitCommChar WaitNamedPipeW FindResourceExA GetLocalTime GetOverlappedResult CreateSemaphoreW SetThreadLocale SetFileShortNameW lstrcpyW VerLanguageNameW LockFile SetConsoleCP GetConsoleAliasA EnumDateFormatsW GetWriteWatch GetNumberOfConsoleInputEvents WriteConsoleOutputCharacterA GetConsoleAliasExesLengthW GetComputerNameW HeapFree SetLastError LocalReAlloc SetCommMask SetMessageWaitingIndicator FindClose PostQueuedCompletionStatus AreFileApisANSI SetWaitableTimer EnumResourceNamesW GetProcessTimes FatalAppExitW lstrcpynW GetNamedPipeInfo FillConsoleOutputCharacterW GetCompressedFileSizeA FindNextVolumeMountPointA GetFullPathNameW WriteProfileStringW SetHandleCount GlobalAddAtomA TerminateJobObject QueryDosDeviceW InitializeCriticalSection Process32FirstW SetCurrentDirectoryA GetBinaryTypeW OpenMutexA UnhandledExceptionFilter SetUnhandledExceptionFilter MoveFileA RaiseException GetStartupInfoW HeapValidate IsBadReadPtr TerminateProcess GetCurrentProcess IsDebuggerPresent GetModuleFileNameW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep InterlockedIncrement InterlockedDecrement GetProcAddress ExitProcess GetModuleFileNameA GetStdHandle GetFileType QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW TlsAlloc TlsFree HeapDestroy HeapCreate VirtualFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage SetFilePointer WideCharToMultiByte OutputDebugStringA OutputDebugStringW LoadLibraryW MultiByteToWideChar RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP FlushFileBuffers ReadFile CreateFileA CloseHandle

Name

.text

Size

236KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kivih

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fafotub

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.litozu

Size

512B

Virtual Size

234B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.coha

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_9674f8093e7a4372c9ac6220c77c7e8cf1c9f42c725ea9c20b9c21465a7b2819

kernel32

generic