JaffaCakes118_adfb9e52d341ceb8c6f1bea96b23b80f1828b8f902e509b524c55c2b25d6aaf8

General

Target
JaffaCakes118_adfb9e52d341ceb8c6f1bea96b23b80f1828b8f902e509b524c55c2b25d6aaf8
Size 730.1MB
Sample241230-b8d7katpem
SHA256 adfb9e52d341ceb8c6f1bea96b23b80f1828b8f902e509b524c55c2b25d6aaf8
MD5 4c293c10a4a2014fd811c08dbb8e9d17
SHA1 f65cabfbfc454bbdda91ec4cd45495d442abdd36
SHA512 3ca5bc6f1b342154b248451f2b910e43f9b325579059c58968b17654490bc773bffedec18b0ff2114e896353de0b5cacc94a9afbe4cd592f38b669f594def1f8
SSDEEP 393216:/eh8bCTZIQ6UgKYAS91oxquhFuhPAUlmpqP:/88GTZIQ6qSCThcTlmp+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_adfb9e52d341ceb8c6f1bea96b23b80f1828b8f902e509b524c55c2b25d6aaf8

File Explorer

JaffaCakes118_adfb9e52d341ceb8c6f1bea96b23b80f1828b8f902e509b524c55c2b25d6aaf8

.exe 730.1MB

JaffaCakes118_adfb9e52d341ceb8c6f1bea96b23b80f1828b8f902e509b524c55c2b25d6aaf8

IMPHASH e9fa0dc321486a0834a2759b64589900
SHA256 adfb9e52d341ceb8c6f1bea96b23b80f1828b8f902e509b524c55c2b25d6aaf8
MD5 4c293c10a4a2014fd811c08dbb8e9d17
SHA1 f65cabfbfc454bbdda91ec4cd45495d442abdd36
SHA512 3ca5bc6f1b342154b248451f2b910e43f9b325579059c58968b17654490bc773bffedec18b0ff2114e896353de0b5cacc94a9afbe4cd592f38b669f594def1f8
SSDEEP 393216:/eh8bCTZIQ6UgKYAS91oxquhFuhPAUlmpqP:/88GTZIQ6qSCThcTlmp+
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16209564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalSize lstrlenA LocalAlloc IsBadCodePtr GetProcAddress LoadLibraryA GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA RaiseException HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

gdi32

GetDeviceCaps

ole32

CoInitialize

user32

CharUpperBuffW

Name

.text

Size

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.7Uv

Size

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.=!?

Size

1024B

Virtual Size

884B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.2R5

Size

9.6MB

Virtual Size

9.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

550KB

Virtual Size

549KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_adfb9e52d341ceb8c6f1bea96b23b80f1828b8f902e509b524c55c2b25d6aaf8

kernel32

gdi32

ole32

user32

generic