JaffaCakes118_45d6e3b08081f6d7428f7038e94b5e20

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_45d6e3b08081f6d7428f7038e94b5e20
Size 782KB
Sample250101-d79yyswlam
SHA256 a01a1d5045612ecf6ab0ea50d19118c0fdc495cd19af373323fcc2cc4c1e6a57
MD5 45d6e3b08081f6d7428f7038e94b5e20
SHA1 6235527c57778541094728357e6a8262539100fb
SHA512 4a1edd05290de8928a24cf57c5bfdb6d6d8ef10cdaa7d97b07f8a7d7d37be2d53a4be8bd2bdda6959de268b1f5c51def130179c9387b7aa157ba7d0c0435cdeb
SSDEEP 24576:KMxPKUYcs3VmKP3ONNKBCiwcC93oYjLbKPJI8p66:TNKUYcs3VmKP3ONKBCi+93rOPaX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_45d6e3b08081f6d7428f7038e94b5e20

File Explorer

JaffaCakes118_45d6e3b08081f6d7428f7038e94b5e20

.exe 782KB

JaffaCakes118_45d6e3b08081f6d7428f7038e94b5e20

IMPHASH 630c3b2ff241475c363668e52b8bbb89
SHA256 a01a1d5045612ecf6ab0ea50d19118c0fdc495cd19af373323fcc2cc4c1e6a57
MD5 45d6e3b08081f6d7428f7038e94b5e20
SHA1 6235527c57778541094728357e6a8262539100fb
SHA512 4a1edd05290de8928a24cf57c5bfdb6d6d8ef10cdaa7d97b07f8a7d7d37be2d53a4be8bd2bdda6959de268b1f5c51def130179c9387b7aa157ba7d0c0435cdeb
SSDEEP 24576:KMxPKUYcs3VmKP3ONNKBCiwcC93oYjLbKPJI8p66:TNKUYcs3VmKP3ONKBCi+93rOPaX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

PresentationHost.pdb

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey OpenProcessToken GetTokenInformation CreateRestrictedToken CreateProcessAsUserW EqualSid CreateWellKnownSid LsaOpenPolicy LsaLookupPrivilegeValue LsaNtStatusToWinError LsaClose CopySid GetKernelObjectSecurity GetSecurityDescriptorDacl SetTokenInformation GetAclInformation GetLengthSid InitializeAcl AddAccessAllowedAce GetAce AddAce RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW GetSidSubAuthority GetSidSubAuthorityCount RegisterTraceGuidsW GetTraceLoggerHandle GetTraceEnableLevel TraceEvent

kernel32

CreateEventW ResetEvent CloseHandle SetEvent InterlockedIncrement InterlockedDecrement GetFileAttributesExW FileTimeToSystemTime RaiseException MultiByteToWideChar GetLastError GetVersionExW ExitProcess GetCurrentProcess GetStartupInfoW GetCommandLineW GetModuleFileNameW GetCurrentProcessId FreeLibrary InterlockedExchange SwitchToThread LoadLibraryW GetProcAddress InterlockedCompareExchange lstrlenW GetModuleHandleW lstrcmpiW SizeofResource LoadResource FindResourceW LoadLibraryExW DeleteCriticalSection InitializeCriticalSection HeapSetInformation IsDebuggerPresent OpenEventW LocalFree FormatMessageW ReleaseActCtx CreateActCtxW ActivateActCtx DeactivateActCtx TerminateProcess CreateTimerQueueTimer FindFirstFileW FindClose OpenProcess LocalAlloc OutputDebugStringW GetTempPathW GetTempFileNameW CreateFileW WriteFile GetNativeSystemInfo GetEnvironmentVariableW CreateProcessW WaitForSingleObject GetExitCodeProcess GetUserDefaultUILanguage GetSystemDefaultUILanguage UnmapViewOfFile CreateFileMappingW MapViewOfFile FindResourceExW GetProcessHeap FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW GetConsoleMode GetConsoleCP SearchPathW SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount LoadLibraryA LCMapStringW LCMapStringA HeapSize IsValidCodePage GetOEMCP GetACP GetCPInfo UnhandledExceptionFilter HeapReAlloc VirtualAlloc EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetFileType SetHandleCount GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetCommandLineA GetStartupInfoA HeapAlloc HeapFree SetUnhandledExceptionFilter Sleep GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings

user32

PostMessageW MessageBoxA PeekMessageW MsgWaitForMultipleObjects LoadStringW DispatchMessageW TranslateMessage GetMessageW CharNextW WaitForInputIdle MessageBeep MessageBoxW PostQuitMessage

ntdll

RtlInitUnicodeString RtlUnwind

ole32

CoMarshalInterThreadInterfaceInStream CoRevokeClassObject CoReleaseMarshalData CreateBindCtx CLSIDFromProgID CoTaskMemAlloc CoUninitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoInitialize CoRegisterClassObject

oleaut32

SysFreeString SysAllocStringLen VarUI4FromStr

mscoree

LoadLibraryShim CoEEShutDownCOM

shlwapi

PathFindExtensionW AssocQueryStringW

wininet

InternetCreateUrlW InternetCrackUrlW

urlmon

CreateURLMonikerEx CoInternetParseUrl RegisterBindStatusCallback CoInternetCreateSecurityManager CoInternetCombineUrl URLDownloadToCacheFileW GetClassFileOrMime

shell32

CommandLineToArgvW ShellExecuteExW SHGetFolderPathW ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_45d6e3b08081f6d7428f7038e94b5e20

advapi32

kernel32

user32

ntdll

ole32

oleaut32

mscoree

shlwapi

wininet

urlmon

shell32

generic