JaffaCakes118_52e18c8057ae2b88a14bba6d4b69e7d7

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_52e18c8057ae2b88a14bba6d4b69e7d7
Size 269KB
Sample250101-nbvjhasrgv
SHA256 3083e34ab72890d2a8255b7c71dc76b5b4e1a3262e7c6d8e3dbc0f9721987ef4
MD5 52e18c8057ae2b88a14bba6d4b69e7d7
SHA1 6f7e27548e2a0f583eed983abf244e16ff8dfdb1
SHA512 f28da611b9febc140980393e3343f4c911ea82eec7ccb40d534736d966916c4eba3484695cc98596cd90523ab4f6eb64c781d9ae7a566575daa2bf61030d5fd5
SSDEEP 6144:OJ3oS2G8MnHFaKrU3SZaHkTqITycShQHeQFQssNLgRwYE7z:Oe99EQK9Zek6QPsGC7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_52e18c8057ae2b88a14bba6d4b69e7d7

File Explorer

JaffaCakes118_52e18c8057ae2b88a14bba6d4b69e7d7

.exe 269KB

JaffaCakes118_52e18c8057ae2b88a14bba6d4b69e7d7

IMPHASH 73caba00f20b95e99e56c1e55b40f163
SHA256 3083e34ab72890d2a8255b7c71dc76b5b4e1a3262e7c6d8e3dbc0f9721987ef4
MD5 52e18c8057ae2b88a14bba6d4b69e7d7
SHA1 6f7e27548e2a0f583eed983abf244e16ff8dfdb1
SHA512 f28da611b9febc140980393e3343f4c911ea82eec7ccb40d534736d966916c4eba3484695cc98596cd90523ab4f6eb64c781d9ae7a566575daa2bf61030d5fd5
SSDEEP 6144:OJ3oS2G8MnHFaKrU3SZaHkTqITycShQHeQFQssNLgRwYE7z:Oe99EQK9Zek6QPsGC7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegQueryValueExA OpenSCManagerA ControlService RegCloseKey RevertToSelf RegEnumValueA RegQueryInfoKeyA DeleteService RegEnumKeyExA QueryServiceStatus RegDeleteKeyA RegFlushKey OpenServiceA RegOpenKeyExA RegDeleteValueA StartServiceA CloseServiceHandle RegSetValueExA RegCreateKeyExA ImpersonateSelf

psapi

EnumProcessModules EnumProcesses GetModuleBaseNameA

ole32

CoUninitialize CoInitialize CoCreateInstance

kernel32

SetLastError FormatMessageA GetTimeZoneInformation FindClose lstrcmpiW RemoveDirectoryA TlsSetValue FindResourceExA WideCharToMultiByte CompareStringW DeleteFileA VirtualProtect TlsFree SetStdHandle LCMapStringA GetStringTypeExA GetACP FindNextFileA DeleteCriticalSection HeapReAlloc SetThreadPriority GetModuleHandleA GetStdHandle GetSystemDirectoryA OpenEventA MoveFileExA GetOEMCP GetUserDefaultLCID lstrcmpiA WriteFile IsValidLocale TlsAlloc SetEndOfFile GetDateFormatA SizeofResource CreateProcessA GetSystemInfo ReleaseMutex RtlUnwind VirtualFree HeapSize VirtualQuery LoadLibraryExW LeaveCriticalSection SetEnvironmentVariableA ReadFile FreeResource OpenProcess UnhandledExceptionFilter IsBadCodePtr SetHandleCount GetCurrentDirectoryA GetLocalTime GetThreadLocale LCMapStringW GetTempPathA HeapDestroy lstrlenW EnterCriticalSection ResumeThread LocalFree TlsGetValue GetWindowsDirectoryA VirtualAlloc GetTimeFormatA CreateMutexA FreeLibrary CompareStringA FreeEnvironmentStringsW GetCurrentThreadId CloseHandle SetFilePointer FlushFileBuffers FatalAppExitA SetUnhandledExceptionFilter FreeEnvironmentStringsA LockResource HeapAlloc SetFileAttributesA GetSystemTimeAsFileTime lstrlenA SetPriorityClass GetProcessHeap LoadLibraryExA CreateFileA RaiseException EnumSystemLocalesA GetPrivateProfileStringA IsValidCodePage GetCommandLineA FindFirstFileA LoadResource GetStringTypeExW WaitForSingleObject GetFileType HeapFree SetConsoleCtrlHandler VirtualAllocEx

shell32

SHGetMalloc SHGetFolderPathA SHGetSpecialFolderLocation SHGetDesktopFolder

user32

UnregisterClassA MessageBoxA CharToOemA wsprintfA RegisterWindowMessageA FindWindowA CharUpperW GetSystemMetrics FindWindowExA LoadStringA CharUpperA CharLowerW PostMessageA CharLowerA

setupapi

SetupInstallServicesFromInfSectionA SetupOpenInfFileA SetupInstallFromInfSectionA

rtm

RtmCloseEnumerationHandle RtmDeleteRouteList RtmMarkDestForChangeNotification RtmGetMostSpecificDestination CheckTable RtmAddRoute RtmCreateDestEnum RtmLookupIPDestination

asycfilt

DllCanUnloadNow

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_52e18c8057ae2b88a14bba6d4b69e7d7

advapi32

psapi

ole32

kernel32

shell32

user32

setupapi

rtm

asycfilt

generic