JaffaCakes118_392f7ce030ab889583e63eca5b2c6bcc9bb846b945f89876fdbc772f193e3a29

General

Target
JaffaCakes118_392f7ce030ab889583e63eca5b2c6bcc9bb846b945f89876fdbc772f193e3a29
Size 794KB
Sample241230-xt8cratrdp
SHA256 392f7ce030ab889583e63eca5b2c6bcc9bb846b945f89876fdbc772f193e3a29
MD5 004c25b803ca4778d78a42880cb3946a
SHA1 1c9fe4ee956952b508faf794526ebf553af4da2f
SHA512 bcde735381b8b8b97cdeb463151d5d4a440dbe0d248001b9f9d577a24f57aadb2170aef93464d47ad8ac30778d7ae81192599314f47ab38a0bb223d29f150e2b
SSDEEP 12288:rC5/849S8RhH2irOK23GQxq0FI3NNi3RD7k5HEtPkfjxxwCGX0VzVNVoBCG8VsnG:6z9SHmkqUI9Y3Zk5sPkfTwLXiUClVR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_392f7ce030ab889583e63eca5b2c6bcc9bb846b945f89876fdbc772f193e3a29

File Explorer

JaffaCakes118_392f7ce030ab889583e63eca5b2c6bcc9bb846b945f89876fdbc772f193e3a29

.exe 794KB

JaffaCakes118_392f7ce030ab889583e63eca5b2c6bcc9bb846b945f89876fdbc772f193e3a29

IMPHASH 28bd666374957ad640bfcdff27cdedf7
SHA256 392f7ce030ab889583e63eca5b2c6bcc9bb846b945f89876fdbc772f193e3a29
MD5 004c25b803ca4778d78a42880cb3946a
SHA1 1c9fe4ee956952b508faf794526ebf553af4da2f
SHA512 bcde735381b8b8b97cdeb463151d5d4a440dbe0d248001b9f9d577a24f57aadb2170aef93464d47ad8ac30778d7ae81192599314f47ab38a0bb223d29f150e2b
SSDEEP 12288:rC5/849S8RhH2irOK23GQxq0FI3NNi3RD7k5HEtPkfjxxwCGX0VzVNVoBCG8VsnG:6z9SHmkqUI9Y3Zk5sPkfTwLXiUClVR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

39872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\har_nowu_vajonafipol_sidahafow.pdb

kernel32

GetFileSize lstrcmpA WriteConsoleInputW TryEnterCriticalSection WritePrivateProfileStructA GetConsoleAliasesLengthW CopyFileExW SetComputerNameExA GetDriveTypeW lstrcpynA GetConsoleAliasExesLengthA FindResourceW BuildCommDCBAndTimeoutsA LoadResource UpdateResourceA InterlockedIncrement _lwrite GetQueuedCompletionStatus VerSetConditionMask MoveFileExW ReadConsoleA InterlockedDecrement ZombifyActCtx WritePrivateProfileSectionA SetDefaultCommConfigW GetSystemWindowsDirectoryW GetNamedPipeHandleStateA GetProfileSectionA SetConsoleScreenBufferSize InterlockedCompareExchange WriteConsoleInputA GetComputerNameW ConnectNamedPipe GetModuleHandleW GetTickCount VirtualFree GetConsoleAliasesLengthA GetDllDirectoryW GetPrivateProfileStringW GetConsoleTitleA ReadConsoleOutputA GetConsoleAliasExesW GetDateFormatA GetCommandLineA CreateActCtxW EnumResourceTypesA SetProcessPriorityBoost GetDriveTypeA GetPriorityClass GetVolumePathNameW GlobalAlloc GetPrivateProfileIntA GetSystemDirectoryW SetFileShortNameW LoadLibraryW IsProcessInJob CopyFileW AssignProcessToJobObject GetCalendarInfoW ReadProcessMemory GetSystemWow64DirectoryW GetSystemWindowsDirectoryA FormatMessageW GetSystemTimeAdjustment GetVersionExW GetFileAttributesA SetConsoleMode GetConsoleAliasW GetWriteWatch VerifyVersionInfoA WriteConsoleW GetBinaryTypeA TerminateProcess GetAtomNameW GetMailslotInfo GetCompressedFileSizeA GetTimeZoneInformation CreateFileW lstrcatA GetOverlappedResult GetACP lstrlenW FindNextVolumeMountPointW CreateMailslotW DeactivateActCtx GetNamedPipeHandleStateW GetConsoleAliasesW ReleaseActCtx SetCurrentDirectoryA GetStartupInfoA GetCPInfoExW FillConsoleOutputCharacterW GetHandleInformation GetLastError GetLongPathNameW ReadConsoleOutputCharacterA CreateNamedPipeA EnumDateFormatsExA CreateTimerQueueTimer WriteProfileSectionA SetComputerNameA VerLanguageNameW GlobalGetAtomNameA DefineDosDeviceA ResetEvent OpenWaitableTimerA GetLocalTime LoadLibraryA UnhandledExceptionFilter InterlockedExchangeAdd SetCalendarInfoW WritePrivateProfileStringA MoveFileA SetConsoleOutputCP GetExitCodeThread AddAtomW GetProfileStringA VirtualLock HeapLock GetCommMask HeapWalk GetTapeParameters FoldStringW SetSystemTime GlobalWire GetModuleFileNameA GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA FindFirstChangeNotificationA lstrcatW FreeEnvironmentStringsW FindNextFileW GetStringTypeW BuildCommDCBA VirtualProtect OutputDebugStringA SetThreadAffinityMask EndUpdateResourceA GetVersionExA GetVersion DeleteFileW GetCurrentProcessId MoveFileWithProgressW GetFileInformationByHandle DebugBreak FindActCtxSectionStringW SuspendThread lstrcpyA SetUnhandledExceptionFilter WideCharToMultiByte DeleteFileA GetStartupInfoW HeapValidate IsBadReadPtr RaiseException Sleep GetProcAddress ExitProcess WriteFile GetStdHandle LeaveCriticalSection EnterCriticalSection SetStdHandle GetFileType GetConsoleCP GetConsoleMode GetCurrentProcess IsDebuggerPresent GetModuleFileNameW GetOEMCP GetCPInfo IsValidCodePage TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId TlsFree SetLastError SetHandleCount DeleteCriticalSection QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW GetCommandLineW HeapDestroy HeapCreate HeapFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP MultiByteToWideChar SetFilePointer RtlUnwind OutputDebugStringW LCMapStringA LCMapStringW GetStringTypeA GetLocaleInfoA CreateFileA CloseHandle FlushFileBuffers

Name

.text

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

586KB

Virtual Size

841KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.letugu

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.faxa

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.hehel

Size

512B

Virtual Size

34B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_392f7ce030ab889583e63eca5b2c6bcc9bb846b945f89876fdbc772f193e3a29

kernel32

generic