JaffaCakes118_61a941ab1a809add413ece5c3bcf2c40

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_61a941ab1a809add413ece5c3bcf2c40
Size 927KB
Sample250102-a67westpey
SHA256 c993608b720fae897e77eab4b1a590bfb714864241b906359f0512869b0d26fd
MD5 61a941ab1a809add413ece5c3bcf2c40
SHA1 67b7bbdee13aed9b9856142ec0d1a6dc2f1cf78c
SHA512 f2f087fdc94d3679c0bbd6b9ea7c369d1212b86244184bb453525d2780b357e13ad35687034000af1b1918f3780a38c33341b68b3bf9ab8b48bbbf4c642d69e0
SSDEEP 24576:hpkqcetqSIDK8M4Ki2BnN0D5yli4sdG/flQb:nkqjtqSIKHdiuNo5ygG0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_61a941ab1a809add413ece5c3bcf2c40

File Explorer

JaffaCakes118_61a941ab1a809add413ece5c3bcf2c40

.exe 927KB

JaffaCakes118_61a941ab1a809add413ece5c3bcf2c40

IMPHASH d4d812a56b78d38330998cf86ac74da8
SHA256 c993608b720fae897e77eab4b1a590bfb714864241b906359f0512869b0d26fd
MD5 61a941ab1a809add413ece5c3bcf2c40
SHA1 67b7bbdee13aed9b9856142ec0d1a6dc2f1cf78c
SHA512 f2f087fdc94d3679c0bbd6b9ea7c369d1212b86244184bb453525d2780b357e13ad35687034000af1b1918f3780a38c33341b68b3bf9ab8b48bbbf4c642d69e0
SSDEEP 24576:hpkqcetqSIDK8M4Ki2BnN0D5yli4sdG/flQb:nkqjtqSIKHdiuNo5ygG0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW

msi

ord70

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile

kernel32

WriteFile SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetVolumeInformationW GetFullPathNameW GetModuleFileNameW GetProcAddress GetModuleHandleW InterlockedDecrement FreeLibrary lstrlenA ReadFile GetCurrentProcessId LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree InterlockedIncrement CompareStringW GetFileSizeEx GetFileTime GlobalFlags GetCurrentThreadId GlobalAddAtomW GetModuleHandleA GetVersionExA LoadLibraryA GlobalDeleteAtom GlobalFindAtomW CompareStringA GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW HeapReAlloc RtlUnwind RaiseException SetStdHandle GetFileType HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA QueryPerformanceCounter GetTickCount GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA LoadLibraryW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW GlobalFree GlobalAlloc GlobalLock GlobalUnlock WideCharToMultiByte DeleteFileW MoveFileW LocalAlloc FindClose lstrcmpW FindFirstFileW lstrcmpA SetFileAttributesW CreateFileW CopyFileW CreateThread LocalFree CloseHandle CreateToolhelp32Snapshot Process32NextW LockResource Process32FirstW GetLocalTime SetLastError GetLongPathNameW GetLastError GetTempPathW lstrlenW MultiByteToWideChar GetFileAttributesW GetExitCodeProcess GetVersionExW FormatMessageW SizeofResource Sleep OpenProcess GetPrivateProfileStringW GetProcessHeap GetCurrentThread WaitForSingleObject HeapFree GetCurrentProcess HeapAlloc CreateProcessW LoadResource FindResourceW

user32

EnableMenuItem ModifyMenuW LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps PostQuitMessage DestroyMenu DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu CheckMenuItem SystemParametersInfoA IsIconic GetWindowPlacement GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetWindowsHookExW CallNextHookEx DispatchMessageW GetKeyState PeekMessageW ValidateRect SetWindowPos SetWindowLongW IsWindow ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowThreadProcessId SendMessageW GetParent MessageBoxW GetForegroundWindow SetWindowTextW GetDlgItem GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow GetWindowTextW RegisterWindowMessageW LoadIconW WinHelpW FindWindowW GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetTopWindow GetSubMenu GetMenuItemCount UnhookWindowsHookEx CharUpperW GetSystemMetrics GetMenuState GetMenuItemID GetFocus

advapi32

GetSidLengthRequired CryptHashData ConvertSidToStringSidW CryptDestroyHash CryptCreateHash GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyW CryptReleaseContext CryptAcquireContextW CryptGetHashParam RegSetValueExW RegCloseKey CheckTokenMembership GetLengthSid InitializeSid RegOpenKeyExW IsValidSid RegEnumValueW RegDeleteValueW DuplicateTokenEx LookupAccountSidW RegQueryInfoKeyW DuplicateToken CreateProcessAsUserW RegQueryValueExW RegCreateKeyExW CopySid GetTokenInformation RegCreateKeyW OpenThreadToken GetSidSubAuthority OpenProcessToken

shell32

SHChangeNotify ShellExecuteW SHGetFolderPathW

ole32

CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize

shlwapi

PathIsUNCW PathFindFileNameW PathStripToRootW

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptDecodeObject CryptMsgClose CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

CreateStdAccessibleObject LresultFromObject

gdi32

GetStockObject CreateBitmap DeleteDC ScaleWindowExtEx SetBkColor RestoreDC SetMapMode GetClipBox SetTextColor SaveDC DeleteObject GetDeviceCaps ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible SetWindowExtEx

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

comdlg32

GetFileTitleW

oleaut32

VariantInit VariantClear VariantChangeType

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_61a941ab1a809add413ece5c3bcf2c40

psapi

msi

userenv

kernel32

user32

advapi32

shell32

ole32

shlwapi

crypt32

wintrust

oleacc

gdi32

winspool.drv

comdlg32

oleaut32

generic