JaffaCakes118_69e88f109ae5a31aa838b84c2bdbc870

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_69e88f109ae5a31aa838b84c2bdbc870
Size 898KB
Sample250103-dtalyaxlet
SHA256 a0fda440bdb738ad31df32b4ec82ff588b545378a59131ea0b533c89dd11a0a4
MD5 69e88f109ae5a31aa838b84c2bdbc870
SHA1 c2c684251a11e9e5a2bf07e9e19eb723a0141ddb
SHA512 e628c16ed18bd7d8d7130675744fb72c1deb0c497c380f84000151fc455e001bd31ddd5c3bb0521f1b0c34d107179072a41bf0a4b58b6ac3b17c9bf2c7b79e73
SSDEEP 24576:sRimzIbwuLL7Hs20f3aP3qPh/qYXAjIUMI:sRiT8uLnM20fqvqhqFjIUM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_69e88f109ae5a31aa838b84c2bdbc870

File Explorer

JaffaCakes118_69e88f109ae5a31aa838b84c2bdbc870

.exe 898KB

JaffaCakes118_69e88f109ae5a31aa838b84c2bdbc870

IMPHASH 2e3de9ad69d94821def54b38a15fa0ee
SHA256 a0fda440bdb738ad31df32b4ec82ff588b545378a59131ea0b533c89dd11a0a4
MD5 69e88f109ae5a31aa838b84c2bdbc870
SHA1 c2c684251a11e9e5a2bf07e9e19eb723a0141ddb
SHA512 e628c16ed18bd7d8d7130675744fb72c1deb0c497c380f84000151fc455e001bd31ddd5c3bb0521f1b0c34d107179072a41bf0a4b58b6ac3b17c9bf2c7b79e73
SSDEEP 24576:sRimzIbwuLL7Hs20f3aP3qPh/qYXAjIUMI:sRiT8uLnM20fqvqhqFjIUM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77507

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\ARM\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb

msi

ord70

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

kernel32

lstrlenA GetCurrentProcessId LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree InterlockedIncrement CompareStringW GetFileSizeEx GetFileTime GlobalFlags GetCurrentThreadId FreeLibrary GlobalAddAtomW GetModuleHandleA GetVersionExA LoadLibraryA GlobalDeleteAtom GlobalFindAtomW CompareStringA GetSystemTimeAsFileTime GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc RtlUnwind RaiseException SetStdHandle GetFileType HeapSize Sleep ExitProcess HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA QueryPerformanceCounter GetTickCount GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CreateFileA SetEnvironmentVariableA InterlockedDecrement GetModuleHandleW GetProcAddress GetModuleFileNameW GetFullPathNameW GetVolumeInformationW GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile LoadLibraryW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW GlobalFree GlobalAlloc GlobalLock GlobalUnlock WideCharToMultiByte DeleteFileW MoveFileW LocalFree LocalAlloc FindClose lstrcmpW GetFileAttributesW FindFirstFileW lstrcmpA SetFileAttributesW CreateFileW CopyFileW CloseHandle CreateToolhelp32Snapshot Process32NextW LockResource Process32FirstW SetLastError GetLastError GetTempPathW lstrlenW MultiByteToWideChar GetExitCodeProcess GetVersionExW FormatMessageW SizeofResource OpenProcess GetPrivateProfileStringW GetProcessHeap WaitForSingleObject HeapFree HeapAlloc CreateProcessW LoadResource FindResourceW

user32

DestroyMenu GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SystemParametersInfoA IsIconic GetWindowPlacement EnableMenuItem GrayStringW DrawTextW TabbedTextOutW SetWindowsHookExW CallNextHookEx DispatchMessageW GetKeyState PeekMessageW ValidateRect SetWindowPos SetWindowLongW IsWindow GetDlgItem GetFocus ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect SetWindowTextW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowThreadProcessId SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow CheckMenuItem RegisterWindowMessageW LoadIconW WinHelpW GetWindowTextW UnhookWindowsHookEx CharUpperW GetSystemMetrics GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetCapture GetClassLongW SetPropW GetPropW PostQuitMessage SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW DrawTextExW ModifyMenuW RemovePropW GetForegroundWindow MessageBoxW

advapi32

RegSetValueExW RegCloseKey RegOpenKeyExW RegDeleteValueW DuplicateTokenEx LookupAccountSidW CreateProcessAsUserW RegQueryValueExW RegCreateKeyExW GetTokenInformation RegCreateKeyW OpenProcessToken

shell32

ShellExecuteW SHGetFolderPathW

shlwapi

PathStripToRootW PathFindFileNameW PathIsUNCW

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptDecodeObject CryptMsgClose CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

LresultFromObject CreateStdAccessibleObject

psapi

GetModuleBaseNameW EnumProcesses EnumProcessModules GetModuleFileNameExW

gdi32

RestoreDC SetBkColor DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx SetTextColor SaveDC GetClipBox GetStockObject CreateBitmap SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW DeleteObject SetMapMode GetDeviceCaps RectVisible PtVisible OffsetViewportOrgEx

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

comdlg32

GetFileTitleW

oleaut32

VariantChangeType VariantClear VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_69e88f109ae5a31aa838b84c2bdbc870

msi

userenv

kernel32

user32

advapi32

shell32

shlwapi

crypt32

wintrust

oleacc

psapi

gdi32

winspool.drv

comdlg32

oleaut32

generic