JaffaCakes118_65275918852986782eba3a17422da213

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_65275918852986782eba3a17422da213
Size 635KB
Sample250102-pt1nxaskdy
SHA256 bf121d562c7c7b94ad46b0f48668659e2f41fa6a0a5f482fdf22f3a6a2195836
MD5 65275918852986782eba3a17422da213
SHA1 976edab0177ae84c34c3ccebab862eba63faa02d
SHA512 1d3b8dde856409c7e5ef02322e27a4a676c2010651cd72758cb5578a0fe4a6cdbbfdf47331a3b22ad1158381e8c48964112d7d63789d748b662ce055e725edf5
SSDEEP 12288:RaIH1DGXNWHcbQueOqk2FIaHgv1HqdWZm6jORchUmaEvlUpSZA15WS77:9mNmpWHhW5EvlSSq1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_65275918852986782eba3a17422da213

File Explorer

JaffaCakes118_65275918852986782eba3a17422da213

.exe 635KB

JaffaCakes118_65275918852986782eba3a17422da213

IMPHASH 86a36791052bd0113bea807eeb7ec831
SHA256 bf121d562c7c7b94ad46b0f48668659e2f41fa6a0a5f482fdf22f3a6a2195836
MD5 65275918852986782eba3a17422da213
SHA1 976edab0177ae84c34c3ccebab862eba63faa02d
SHA512 1d3b8dde856409c7e5ef02322e27a4a676c2010651cd72758cb5578a0fe4a6cdbbfdf47331a3b22ad1158381e8c48964112d7d63789d748b662ce055e725edf5
SSDEEP 12288:RaIH1DGXNWHcbQueOqk2FIaHgv1HqdWZm6jORchUmaEvlUpSZA15WS77:9mNmpWHhW5EvlSSq1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\lobiclient\x86\ship\0\bcssync.pdb

msvcr90

_XcptFilter ?_type_info_dtor_internal_method@type_info@@QAEXXZ _controlfp_s _invoke_watson ?terminate@@YAXXZ _exit _cexit _crt_debugger_hook _decode_pointer _onexit _lock __dllonexit _unlock _except_handler4_common __set_app_type _encode_pointer __p__fmode __p__commode bsearch _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _wcmdln ??3@YAXPAX@Z __wgetmainargs _amsg_exit vswprintf_s _callnewh _itow_s _wcsnicmp _errno wcscat_s wcscpy_s _snwprintf_s memcpy _recalloc _wtoi wcsncpy_s memcpy_s free malloc _wcsicmp memset wcsstr wcsrchr ??_V@YAXPAX@Z exit

kernel32

GetUserDefaultLangID GetVersionExA GetModuleHandleExW RtlCaptureStackBackTrace UnmapViewOfFile MapViewOfFile CreateFileMappingA CreateFileW FindResourceA WriteFile ReadFile IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW CloseHandle OpenProcess lstrlenW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetLastError GetProcAddress GetModuleHandleW lstrcmpiW WaitForSingleObject CreateProcessW GetModuleFileNameW GetCurrentThreadId SetEvent FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetVersionExW CreateEventW CreateMutexW GetCurrentDirectoryW WaitForMultipleObjects InterlockedCompareExchange CreateThread OpenMutexW OpenEventW Sleep GetCommandLineW GetCurrentProcess SetUnhandledExceptionFilter ReleaseMutex ResetEvent GetSystemPowerStatus GetLocaleInfoW SetLastError GetCurrentProcessId LoadLibraryW LockResource VirtualProtect QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetProcessHeap HeapFree HeapAlloc InterlockedExchange

user32

DestroyWindow KillTimer DialogBoxIndirectParamW CreateWindowExW UnregisterClassW LoadIconW PostThreadMessageW RegisterWindowMessageW CharUpperW EnableWindow DestroyIcon RegisterClassExW ReleaseDC GetDC SendMessageW CharNextW PeekMessageW DispatchMessageA DispatchMessageW TranslateMessage GetMessageA GetDlgItem SetForegroundWindow EndDialog SetTimer MsgWaitForMultipleObjects IsWindowUnicode DefWindowProcW GetMessageW GetWindowTextW GetWindowThreadProcessId IsWindowVisible EnumWindows GetWindow PostMessageW

advapi32

RegisterTraceGuidsA GetTraceEnableLevel GetTraceEnableFlags RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegisterTraceGuidsW TraceEvent UnregisterTraceGuids RegQueryValueExW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken DeregisterEventSource ReportEventW RegisterEventSourceW RegOpenKeyExA GetTraceLoggerHandle

psapi

GetModuleBaseNameW EnumProcesses

comctl32

InitCommonControlsEx

shell32

ShellExecuteW Shell_NotifyIconW

ole32

CoCreateInstance StringFromGUID2 CoRegisterClassObject CoUninitialize CoInitialize CoTaskMemFree CLSIDFromProgID CoTaskMemRealloc CoTaskMemAlloc CoRevokeClassObject

gdi32

GetTextExtentPointW GetTextMetricsW SelectObject

oleaut32

SysStringByteLen VarBstrCat RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString VarUI4FromStr SysAllocStringByteLen SafeArrayDestroy VariantCopy VariantClear VariantInit SysAllocStringLen SysStringLen SafeArrayGetVartype SafeArrayUnlock SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SysFreeString

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

mscoree

GetCORVersion CorBindToRuntimeEx

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_65275918852986782eba3a17422da213

msvcr90

kernel32

user32

advapi32

psapi

comctl32

shell32

ole32

gdi32

oleaut32

rpcrt4

mscoree

generic