JaffaCakes118_42c2ecba382ca7b7f5ae6fe76f2c8569

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_42c2ecba382ca7b7f5ae6fe76f2c8569
Size 415KB
Sample250101-b7htcszme1
SHA256 b64e2ed624b7d878d680265e2cb5bb0f824dea5e7decc7677b8ed5c06e6e8d95
MD5 42c2ecba382ca7b7f5ae6fe76f2c8569
SHA1 da4f435ad23ca386604809dc9467330a39e2af23
SHA512 ce18c1d90f6121096286b8c2605a22e2bb70c21cafbad967122bcb100d699d6a47b902e1927a45fbb96c8143af29c74e42313c4edecaeaf8bd435233d19f6aa5
SSDEEP 12288:WrKyKsimU291v+w04As8mzJB93sBNCG9n:WrKyKsiB0B+w04/Ujn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_42c2ecba382ca7b7f5ae6fe76f2c8569

File Explorer

JaffaCakes118_42c2ecba382ca7b7f5ae6fe76f2c8569

.exe 415KB

JaffaCakes118_42c2ecba382ca7b7f5ae6fe76f2c8569

IMPHASH 58e185299ecca757fe68ba83a6495fde
SHA256 b64e2ed624b7d878d680265e2cb5bb0f824dea5e7decc7677b8ed5c06e6e8d95
MD5 42c2ecba382ca7b7f5ae6fe76f2c8569
SHA1 da4f435ad23ca386604809dc9467330a39e2af23
SHA512 ce18c1d90f6121096286b8c2605a22e2bb70c21cafbad967122bcb100d699d6a47b902e1927a45fbb96c8143af29c74e42313c4edecaeaf8bd435233d19f6aa5
SSDEEP 12288:WrKyKsimU291v+w04As8mzJB93sBNCG9n:WrKyKsiB0B+w04/Ujn
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

msvcrt

__wgetmainargs _exit _XcptFilter exit _initterm _amsg_exit __setusermatherr memcpy _controlfp _except_handler4_common ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode _cexit

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetCurrentProcess OpenProcessToken GetCurrentProcessId GetCurrentThreadId

kernel32

LocalAlloc CloseHandle DelayLoadFailureHook GetProcAddress GetLastError FreeLibrary InterlockedCompareExchange LoadLibraryExA InterlockedExchange Sleep SetUnhandledExceptionFilter GetModuleHandleA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime UnhandledExceptionFilter DeactivateActCtx LoadLibraryExW ActivateActCtx LeaveCriticalSection lstrcmpW EnterCriticalSection RegCloseKey RegOpenKeyExW HeapSetInformation lstrcmpiW lstrlenW LCMapStringW RegQueryValueExW ReleaseActCtx CreateActCtxW ExpandEnvironmentStringsW GetCommandLineW ExitProcess SetProcessAffinityUpdateMode RegDisablePredefinedCacheEx InitializeCriticalSection GetProcessHeap SetErrorMode RegisterWaitForSingleObjectEx LocalFree HeapFree WideCharToMultiByte HeapAlloc

ntdll

RtlAllocateHeap RtlLengthRequiredSid RtlSubAuthoritySid RtlInitializeSid RtlCopySid RtlSubAuthorityCountSid RtlInitializeCriticalSection RtlSetProcessIsCritical RtlImageNtHeader RtlUnhandledExceptionFilter EtwEventWrite EtwEventEnabled EtwEventRegister RtlFreeHeap

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl AddAccessAllowedAce SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetTokenInformation InitializeSecurityDescriptor GetLengthSid InitializeAcl

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

rpcrt4

RpcMgmtSetServerStackSize I_RpcMapWin32Status RpcServerUnregisterIf RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcServerUnregisterIfEx RpcServerRegisterIf RpcServerUseProtseqEpW RpcServerListen

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_42c2ecba382ca7b7f5ae6fe76f2c8569

msvcrt

api-ms-win-core-processthreads-l1-1-0

kernel32

ntdll

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

rpcrt4

generic