JaffaCakes118_6394bcb9eeb8524dafdc15efe191d940

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_6394bcb9eeb8524dafdc15efe191d940
Size 895KB
Sample250102-jka41a1pat
SHA256 7e6885d9476397b4644fcdb91ef38ba8117440adebc21a317e0b6f65a1dcc661
MD5 6394bcb9eeb8524dafdc15efe191d940
SHA1 c4178fd9d2f882f60652c7d82117d6677191850c
SHA512 077b78baeb292e480a79e761497fcf8f583259528563130219cbfc64e72bbdbc131a9d1a6a2f336313d51f1e294f52a77b685b00df7cf514d96481a74f4b1d15
SSDEEP 24576:AekqcetqShNCXkJekzWloK8QbQ5V3Kl/:/kqjtqShN3JeXE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_6394bcb9eeb8524dafdc15efe191d940

File Explorer

JaffaCakes118_6394bcb9eeb8524dafdc15efe191d940

.exe 895KB

JaffaCakes118_6394bcb9eeb8524dafdc15efe191d940

IMPHASH d4d812a56b78d38330998cf86ac74da8
SHA256 7e6885d9476397b4644fcdb91ef38ba8117440adebc21a317e0b6f65a1dcc661
MD5 6394bcb9eeb8524dafdc15efe191d940
SHA1 c4178fd9d2f882f60652c7d82117d6677191850c
SHA512 077b78baeb292e480a79e761497fcf8f583259528563130219cbfc64e72bbdbc131a9d1a6a2f336313d51f1e294f52a77b685b00df7cf514d96481a74f4b1d15
SSDEEP 24576:AekqcetqShNCXkJekzWloK8QbQ5V3Kl/:/kqjtqShN3JeXE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW

msi

ord70

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile

kernel32

WriteFile SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetVolumeInformationW GetFullPathNameW GetModuleFileNameW GetProcAddress GetModuleHandleW InterlockedDecrement FreeLibrary lstrlenA ReadFile GetCurrentProcessId LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree InterlockedIncrement CompareStringW GetFileSizeEx GetFileTime GlobalFlags GetCurrentThreadId GlobalAddAtomW GetModuleHandleA GetVersionExA LoadLibraryA GlobalDeleteAtom GlobalFindAtomW CompareStringA GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW HeapReAlloc RtlUnwind RaiseException SetStdHandle GetFileType HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA QueryPerformanceCounter GetTickCount GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA LoadLibraryW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW GlobalFree GlobalAlloc GlobalLock GlobalUnlock WideCharToMultiByte DeleteFileW MoveFileW LocalAlloc FindClose lstrcmpW FindFirstFileW lstrcmpA SetFileAttributesW CreateFileW CopyFileW CreateThread LocalFree CloseHandle CreateToolhelp32Snapshot Process32NextW LockResource Process32FirstW GetLocalTime SetLastError GetLongPathNameW GetLastError GetTempPathW lstrlenW MultiByteToWideChar GetFileAttributesW GetExitCodeProcess GetVersionExW FormatMessageW SizeofResource Sleep OpenProcess GetPrivateProfileStringW GetProcessHeap GetCurrentThread WaitForSingleObject HeapFree GetCurrentProcess HeapAlloc CreateProcessW LoadResource FindResourceW

user32

EnableMenuItem ModifyMenuW LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps PostQuitMessage DestroyMenu DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu CheckMenuItem SystemParametersInfoA IsIconic GetWindowPlacement GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetWindowsHookExW CallNextHookEx DispatchMessageW GetKeyState PeekMessageW ValidateRect SetWindowPos SetWindowLongW IsWindow ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowThreadProcessId SendMessageW GetParent MessageBoxW GetForegroundWindow SetWindowTextW GetDlgItem GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow GetWindowTextW RegisterWindowMessageW LoadIconW WinHelpW FindWindowW GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetTopWindow GetSubMenu GetMenuItemCount UnhookWindowsHookEx CharUpperW GetSystemMetrics GetMenuState GetMenuItemID GetFocus

advapi32

GetSidLengthRequired CryptHashData ConvertSidToStringSidW CryptDestroyHash CryptCreateHash GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyW CryptReleaseContext CryptAcquireContextW CryptGetHashParam RegSetValueExW RegCloseKey CheckTokenMembership GetLengthSid InitializeSid RegOpenKeyExW IsValidSid RegEnumValueW RegDeleteValueW DuplicateTokenEx LookupAccountSidW RegQueryInfoKeyW DuplicateToken CreateProcessAsUserW RegQueryValueExW RegCreateKeyExW CopySid GetTokenInformation RegCreateKeyW OpenThreadToken GetSidSubAuthority OpenProcessToken

shell32

SHChangeNotify ShellExecuteW SHGetFolderPathW

ole32

CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize

shlwapi

PathIsUNCW PathFindFileNameW PathStripToRootW

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptDecodeObject CryptMsgClose CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

CreateStdAccessibleObject LresultFromObject

gdi32

GetStockObject CreateBitmap DeleteDC ScaleWindowExtEx SetBkColor RestoreDC SetMapMode GetClipBox SetTextColor SaveDC DeleteObject GetDeviceCaps ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible SetWindowExtEx

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

comdlg32

GetFileTitleW

oleaut32

VariantInit VariantClear VariantChangeType

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_6394bcb9eeb8524dafdc15efe191d940

psapi

msi

userenv

kernel32

user32

advapi32

shell32

ole32

shlwapi

crypt32

wintrust

oleacc

gdi32

winspool.drv

comdlg32

oleaut32

generic